Privacy Policy

1. Scope

This policy describes how Finch processes information in the applyfinch.com web app and Finch browser extension. Finch finds internships and new-grad roles for your major, and, if you choose, helps you prepare application materials. You can sign up with Google or with your email address, and adding a resume is optional.

2. Before you create an account

To sign up, you pick your major and graduation year, then continue with Google or with your email address. If you continue with Google without a resume, your browser keeps your major and graduation year on your device until Google signs you in, and we save them with your agreement to this policy and our Terms when your account is created. If you sign up with your email address or add a resume, we start a temporary signup draft and collect your email address if you gave one, your agreement to this policy and our Terms (including its version and time), and, if you upload a resume, its filename, size, converted PDF, and extracted text. We use an essential, secure, HttpOnly signup cookie to connect your browser to this temporary draft. We also use request information, such as IP address, to limit abuse.

We convert DOC, DOCX, and single-file LaTeX resumes to PDF in a restricted process. We extract text locally and use OCR only when a PDF has no usable text. If you add a resume and select “Continue,” we may send resume text to an AI inference provider through OpenRouter to identify education, experience, projects, leadership, volunteering, skills, and contact details while you check your details and finish with a password or Google. This can happen before your account exists. You can instead sign up without a resume.

3. After you create an account

• Supabase handles your account identity, password or Google sign-in, and session.
• We keep the basic details you confirm: name, U.S. city and state, campus, degree, major, and graduation month and year. We keep profile details supported by your resume, such as roles, projects, skills, and original bullet points, so you can review and edit them.
• If you answer yes to the visa sponsorship question, we save “needs sponsorship” on your profile. If you answer no, we clear the work authorization saved on your profile. If you’d rather not say, we don’t change it. Your browser keeps its own copy of your answer, and we record the answer in our product event records.
• We keep your canonical resume PDF and extracted text for profile editing, tailoring, and downloads until you remove the resume or delete your account.
• If you provide LinkedIn or GitHub profile links, we keep the links and may use them only after you finish the basic profile. GitHub and, where enabled, LinkedIn details can add supported profile information. We keep source-job status, derived profile information, limited source identifiers needed by features, and a history of profile changes so those changes can be reviewed or reversed. LinkedIn enrichment may be unavailable while we review the provider path.
• We keep application, generated document, search, and extension activity records needed for the features you use.
• If you have an account, we may email you job matches and Finch updates, and each of those emails has an unsubscribe link. Emails you ask for, like a password reset, are sent only when you ask.

4. Why we use this information

We use it to create and secure your account, build and correct your profile, find and rank relevant roles, tailor resumes and cover letters, fill application forms when you request it, show your dashboard and application history, provide support, detect misuse, measure service performance, and meet applicable legal obligations. AI-generated profile suggestions are checked against source evidence and are editable by you; review them before relying on them.

5. Services that process information

• Supabase provides authentication and the private database. AWS S3 stores resume PDFs and generated documents. Cloudflare routes web requests, and the backend runs on Azure Container Apps.
• AI requests may be routed through OpenRouter to the selected model provider; other Finch features may use OpenAI or Anthropic. We send the text and context needed for the requested feature. Provider handling and retention follow the applicable service terms. We do not promise that providers never use data for model training without verified agreements and settings.
• Google signs you in when you choose Google, and shares your Google account's name, email address, and profile picture.
• GitHub supplies public repository and profile information when you provide a GitHub link. LinkedIn enrichment, if enabled after provider and legal review, may use Apify and HarvestAPI to collect profile information associated with the link you provide.
• If configured, PostHog receives page views and product events, and Sentry receives error and performance data. Sentry may receive masked error-session replays; text and media are masked. We do not use automatic form-interaction capture for product analytics.

Core account data is configured in U.S. regional services. Edge routing and some providers can process data in other locations. Contact us if you need details about a particular transfer or provider.

6. Retention and deletion

• Unclaimed signup drafts, including extracted text, are scheduled for deletion after 24 hours. Temporary S3 resume objects are deleted on replacement or claim and by cleanup; a 48-hour S3 lifecycle rule is the backstop once configured.
• After claim, your canonical resume PDF and extracted text remain until you remove that resume or delete the account. Replaced PDFs are deleted and failed object deletions are retried.
• New LinkedIn and GitHub source responses are used for refinement and then discarded rather than stored as full raw payloads. Failed raw payloads from the earlier enrichment flow are limited to a seven-day retry window. Supported derived profile facts, source status, and profile revision history remain until account deletion.
• Anonymous onboarding timing measurements are kept for 30 days. Other account records remain while your account is active or until you delete the relevant item, subject to legal requirements and provider backup schedules.

Account deletion attempts to remove your database records and files. If a database or storage deletion fails, we report that deletion is incomplete and keep sign-in available so you can retry or contact us. We do not report full deletion while known cleanup failures remain.

7. Browser extension and local storage

When you use Finch on an application page, the extension reads the fields needed to fill that form, the application URL, ATS, job title, and fields-filled count. It can send a submit record and requested tailoring information to Finch so your dashboard and generated documents work. The extension can cache your profile and resume in chrome.storage.local on your device. The web app uses local storage for the signed-in session and, if PostHog is configured, analytics identifiers in local storage and cookies. The temporary signup cookie is essential to signing up with an email address or a resume.

8. Your choices and rights

You can correct profile details, omit optional social links, remove your resume, and request account deletion. To request access, correction, export, deletion, or information about applicable privacy rights, email privacy@applyfinch.com from your account email. We may need to verify your identity before fulfilling a request. Available rights and exceptions depend on where you live.

9. Updates and contact

We may update this policy as the product changes and will show the current date here. For privacy questions, contact privacy@applyfinch.com. For legal notices, contact legal@applyfinch.com.