Privacy Policy

Effective date: October 12, 2026

Compass helps you run a job search: it keeps your profile and resumes, finds and tracks openings, drafts tailored materials with AI, and helps you fill in applications. This policy explains what personal data that involves, what we do with it, who else handles it, and the choices and rights you have. It covers the Compass web app at compass-os.dev and the Compass Apply Chrome extension.

1. Who we are

Compass is operated by Eli Tsinovoi, an individual based in the United States (“we”, “us”). We decide how your personal data is used, which makes us the “controller” under European and UK data protection law. For any privacy question or request, email support@compass-os.dev.

2. What we collect

Account details: your email address, and if you sign in with Google, the name and profile picture Google shares with us. We never see your Google password.
What you put in: your profile, work history, resumes, cover letters, job descriptions, tracked jobs, notes, settings, and the documents you create.
Application answers: answers you save for common application questions, such as work authorization, whether you need visa sponsorship, salary expectations, and how to answer demographic questions (for example, to always decline). Some of these are sensitive. We use them only to fill forms you choose to fill.
AI results: the drafts and analyses AI features produce for you. We keep the most recent results for each feature so you don’t pay to regenerate them.
API keys you add for AI providers or job search: encrypted with AES-256-GCM before they’re stored, and never shown again after you save them.
Forwarded job alerts: if you set up LinkedIn job-alert forwarding, those emails come to a private Compass address. We keep the job listings found in them (title, company, location, link) and, while you set up forwarding, the confirmation details Gmail sends. We don’t keep the rest of the email.
Application forms (Chrome extension): when you click “Read this form”, Compass Apply reads the questions and choices on that page and sends them to your Compass account to draft answers. See section 8.
Plan and billing: your plan, usage counts (such as tailored documents this month), access codes you redeem, and referral codes and who joined through them. If you subscribe, Stripe collects your payment details; we receive your Stripe customer ID, subscription status, renewal date, and billing country for tax, but never your full card number.
Waitlist: your email address if you join a waitlist.
Technical data: like most websites, our hosting and network providers log requests (IP address, browser type, the page requested, and the time) to keep the service secure and working.

We don’t ask for government ID numbers, and we ask you not to put them, health information, or other people’s personal data into Compass.

3. How we use it, and our legal basis

To provide the service you signed up for (performance of our contract with you): storing your data, matching jobs to your profile, drafting materials and answers, filling forms you choose to fill, and managing your plan and payments.
To keep the service secure and working (our legitimate interests): preventing abuse and fraud, enforcing plan limits, fixing bugs, and responding to support requests.
To meet legal obligations: tax and accounting records, and responding to lawful requests.
With your consent: sensitive answers you choose to save (such as demographic answers or immigration status) are stored and used only because you entered them for that purpose. You can delete them at any time on the Profile page.
To email you: sign-in links, receipts, and important notices about your account, plan, or these policies. We don’t send marketing emails today. If we start, we’ll only send them where the law allows, and every one will have an unsubscribe link.

We don’t sell your personal data or “share” it for cross-context behavioral advertising, we don’t show ads, and we don’t use your data to train AI models. We don’t make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. AI providers you choose

When you use an AI feature, the relevant parts of your profile and the job description are sent to the provider you picked (Anthropic, Google Gemini, or OpenAI), using your own API key and under your own account and agreement with that provider. That provider’s privacy policy and data-retention rules apply to what it receives. Under their standard API terms, these providers say they don’t train their models on API data, but check your provider’s terms, especially for free tiers, which may differ (for example, Google’s free Gemini tier).

5. Who else handles your data

We use these service providers to run Compass. They process data on our behalf and only for that purpose:

Supabase: database and sign-in (United States).
Google Cloud: hosts the app on Cloud Run (us-central1, United States).
Cloudflare: DNS, network protection, and receiving forwarded job-alert emails.
Resend: delivers sign-in emails.
Stripe: payments, subscriptions, invoices, and sales-tax calculation, if you subscribe. Stripe is also an independent controller for some payment data (for example, fraud prevention); see Stripe’s privacy policy.

Other parties that receive data when you use certain features:

The AI provider you choose (section 4).
Job sources: we fetch public listings from job boards and company career sites; those requests don’t include your personal data. If you add a JSearch key, the job titles and locations you search for are sent to JSearch (via RapidAPI or OpenWebNinja).
Google’s favicon service: to show company logos, your browser requests them from Google using the company’s web address. Like any web request, Google receives your IP address with it.
Sign in with Google: if you choose it, Google handles the sign-in.
Legal and safety: we may disclose data if the law requires it, or to protect the rights, safety, or property of users or others.
A successor: if Compass is transferred (for example, to a company we form to run it), your data would move with it, under this policy.

6. Google user data

If you sign in with Google, we receive only your email address, name, and profile picture, and use them only to create and identify your account. We don’t request access to Gmail, Drive, Calendar, or any other Google data, and we don’t transfer Google user data to anyone else except as needed to provide the service, for security, or to comply with the law. Compass’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Cookies

We use only cookies that are needed for the service to work: sign-in cookies from Supabase that keep you logged in, and, if you arrive through an invite link, a cookie that remembers the invite code for 24 hours so it can be applied when you sign up. We don’t use analytics, advertising, or tracking cookies, and we don’t load third-party analytics scripts. The Chrome extension stores only the address of your Compass app in Chrome’s local storage.

8. The Compass Apply Chrome extension

It reads a page only when you open its side panel on that page and ask it to, and only on sites you’ve granted it access to. It reads the form’s questions, choices, and fields, and sends them only to your own Compass account.
It fills the form with answers from your Compass data. It never submits a form, and it doesn’t read your browsing history or pages you haven’t asked it to read.
Data from the extension is used only to provide this form-filling feature. We don’t sell it, use it for advertising, use it to assess creditworthiness or for lending, or let people read it except with your permission, for security, or to comply with the law. Our use of this data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

9. How long we keep data

Account data and content: while your account is open. When you ask us to delete your account, we delete it and the data linked to it within 30 days. Copies in our database provider’s backups are overwritten within about 30 more days.
AI results: we keep only the most recent results for each feature, up to a fixed number, and older ones are replaced automatically.
Waitlist emails: until the plan launches and we’ve told you, or until you ask us to remove you.
Billing records: invoices and payment records are kept by Stripe and by us for as long as tax and accounting laws require (usually up to 7 years), even after you close your account.
Request logs: kept by our hosting and network providers for a limited period, typically about 30 days.

10. Your rights and choices

You can view and edit most of your data in the app, delete individual items, and remove API keys at any time. You can also email support@compass-os.dev to:

get a copy of your data, including in a portable, machine-readable format;
correct data that’s wrong;
delete your data or your account;
object to or ask us to restrict certain processing, or withdraw consent you’ve given (this doesn’t affect processing before you withdrew it);
ask what personal data we hold about you, where it came from, and who we’ve disclosed it to.

We’ll confirm we received your request and respond within 30 days (45 days for California residents), or tell you if we need more time as the law allows. We may need to verify that the request comes from you, usually by replying from the email on your account. You can use an authorized agent where your law allows it. We won’t treat you differently for exercising your rights.

EU and UK residents have the rights above under the GDPR and UK GDPR, and can complain to their local data protection authority (in the UK, the ICO).
California residents have the right to know, delete, and correct personal information, and to limit the use of sensitive personal information. We collect the categories described in section 2 (identifiers, professional and employment information, commercial information about your plan, internet activity on our service, and sensitive information you choose to enter, such as immigration status), from you and from the services you connect, for the purposes in section 3. We disclose them only to the service providers and parties in sections 4 and 5. We don’t sell or share personal information, and we use sensitive information only to provide the service you asked for, so there’s nothing to opt out of; we treat Global Privacy Control signals as an opt-out anyway.
Residents of other US states and Canada have similar rights under their laws; email us and we’ll honor them.

11. International transfers

Compass is run from the United States, and your data is stored and processed there and wherever our service providers operate. If you’re outside the US, your data is transferred to the US, which may have different data protection laws than your country. Where European or UK law requires it, we rely on safeguards such as our providers’ Standard Contractual Clauses (and the UK Addendum) or their certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

12. Security

Data is sent over HTTPS. Our database enforces row-level security so each account can only reach its own records, and API keys are encrypted at rest with AES-256-GCM. No system is perfectly secure. If a breach affecting your personal data happens, we’ll notify you and the relevant authorities as the law requires.

13. Children

Compass is for adults managing their own job search. It isn’t meant for anyone under 18, and we don’t knowingly collect data from children under 16. If you believe a child has given us personal data, email us and we’ll delete it.

14. Changes to this policy

The effective date at the top shows when this policy last changed. If we make a change that materially affects how we use your data, we’ll tell you by email or in the app before it takes effect, and ask for your consent where the law requires it.

15. Contact

Questions or requests about your data: support@compass-os.dev.