Privacy Policy

• Account information: email address, account identifier, and your name for email sign-up. If you choose Google sign-in, Google also provides basic profile information such as your name, email address, and profile image for authentication. We also store the version and time of your 18+ confirmation in account security metadata; we do not collect your date of birth.
• Career and application information: profile and resume content, work and project details, skills, job descriptions and links, role analyses, learning plans and evidence, application details, and documents you choose to save or generate. This content may include contact details such as a phone number, email, location, and professional links if you include them.
• Profile autofill details: when you request form autofill through the Career Vault extension, YCC may extract information already present in your saved profile or resume, such as contact details, address, work authorization, gender, veteran status, or disability status, to return to the extension for that request. These details are not required to create an account.
• Files and messages: files you submit for an import or analysis, messages you send through feedback, and the optional name, email address, and message in a privacy request.
• Service activity: technical request information, such as the route used and security or failure events, to keep the service secure and working. Abuse-prevention records use a one-way IP hash. If you opt in to beta analytics, we also record the app area visited, a limited feature event, and active time. We do not use this analytics feature to record the text in your profile or documents.
• Information stored on your device: authentication and session data, plus browser storage used for drafts, in-progress work, and some recent activity. This can include career text you have entered. Clear the browser's site data on a shared device after signing out.

• Account and saved workspace: Supabase Auth manages sign-in. Saved profile, job, learning, and application records are stored in the YCC Supabase database and are associated with your account.
• Hosting and requests: Vercel hosts YCC and processes website requests and service activity. Its privacy notice describes collection of information such as IP address, browser and device details, pages visited, timestamps, logs, and diagnostics.
• Privacy requests: details you enter in the public privacy contact form are stored in the private YCC database and can be viewed by the YCC admin to respond to you.
• Files: saved resume PDFs and optional screenshots or audio attached to feedback are stored in private Supabase Storage buckets. They are not public file links.
• Your browser: some drafts and recent activity are kept in browser storage so the workspace can restore them. Browser storage is available to this site on that device and is not the same as your cloud account storage.
• Feature providers: when a feature needs external AI or search, the content needed for that request is sent to that provider. Cover-letter PDFs are compiled on the application server and are not sent to a separate compiler. See “When information is shared” for other examples.

We apply account-level access controls to saved workspace data. Service-provider backups and operational records may be retained under those providers’ terms. Browser-stored drafts remain on the device and may be accessible to someone using the same browser profile.

YCC does not currently ask for a separate account phone number or send WhatsApp notifications. A phone number you include in a resume or career profile is handled as part of that content for the career features you request; it is not used as permission to contact you. You do not need to provide a phone number to create an account.

If we add WhatsApp alerts, they will be optional, with a separate opt-in describing the message category and frequency, and a way to stop them. Choosing not to provide a number will not block the core career workspace.

• Sign you in, protect your account, and provide the features you request.
• Save and display your career profile, job analyses, learning progress, and application materials.
• Generate AI-assisted summaries, comparisons, suggestions, and drafts based on information you provide.
• Find learning resources, import public GitHub repository content you request, and compile cover letters into PDFs on the application server.
• Respond to feedback and privacy requests, administer beta access, prevent abuse, and maintain service reliability.

We do not sell your personal information or use career content to serve advertising.

If you choose Google sign-in, YCC uses Google’s authentication flow to verify your identity and create or access your YCC account. We use the basic account details Google provides, such as your name and email address, for account identity and sign-in. YCC does not request access to Gmail, Drive, Calendar, or contacts. We do not use Google user data for advertising, sell it, or use it to build or improve general-purpose AI models. Google handles sign-in under its own privacy policy.

We share information with service providers only when needed to operate a feature, as described below. Cover-letter source is compiled on the application server. We do not give providers permission to use your information for their independent marketing through YCC.

When you ask YCC to fetch a job posting or import a public repository, the requested website or repository is contacted to retrieve its public content. Search results and generated content may include links to third-party sites, which have their own privacy practices.

AI features process the content necessary to answer your request. This can include resume or profile text, a job posting, skills, and details for a resume or cover letter. Do not submit information you do not want processed by YCC and its AI providers. AI results can be incomplete or inaccurate and should be reviewed before you rely on them.

YCC sends model requests through OpenRouter with per-request limits that require zero-retention model-provider endpoints, deny providers marked as collecting request data, and disable model-provider fallback. This does not prevent OpenRouter from receiving and routing each request, using its separately operated web-search tool for a learning-resource fallback, or processing operational information under its own terms. Provider rules and processing locations can change. We do not claim that OpenRouter itself retains no information.

Saved account content is kept while your account is active, until you remove it using the available data controls, or until you request account deletion. Some records may remain for a limited time in provider backups or where needed to address security, legal, or service issues.

• Opt-in beta product analytics events are pruned after 30 days.
• AI feature usage records used for rate limits are pruned after 30 days.
• Public-service abuse-prevention records use a one-way IP hash and are pruned after 14 days.
• The learning activity feed keeps up to 10 active events per account. A separate history of action types and timestamps keeps calendar totals and streaks accurate; it does not retain the feed’s descriptions. It is included in your account export and cleared when you reset learning data or delete your account. Learning evidence, plans, resumes, and analyses are stored separately and are not covered by the activity-feed limit.
• Feedback messages, privacy requests, and optional feedback attachments are retained until they are removed or no longer needed. We do not currently publish a fixed deletion schedule for them.

Third-party providers may keep information under their own retention policies. See their policies for details about their systems.

• Use Settings → Data & Privacy to export your saved career information, reset selected data categories, or permanently delete your account and YCC cloud records and files. Browser drafts may remain on devices and need to be cleared there separately.
• Beta analytics are optional. You can review or change your choice using the app’s Data preferences control; turning analytics off also removes the associated product events.
• If you cannot access your account or need to make another privacy request, use the contact form below. You do not need to sign in.
• You can also manage or remove information held by Google or other third-party services through those services. Provider backups and operational records may expire later under their own retention terms.

We use access controls and service-provider safeguards to protect information. No internet service can guarantee perfect security. YCC is for adults aged 18 and over and is not designed for children. Before using the workspace, users must confirm that they are at least 18. This is a self-attestation; we do not collect a date of birth or independently verify age. We store the confirmation version and time with the account. The privacy contact form below is available for privacy and child-safety reports.

YCC is currently operated by its founder as an individual and is not yet incorporated. Use the form below to ask about how your information is handled or to make a privacy request. Enter an email address where we can reach you; a personal name is optional. The form is available without signing in. We may update this policy as the service changes; the date at the top shows when it was last revised.