Privacy Policy

Understudy helps you find jobs and apply to them. To do that we store the information you give us and use it only to run your job search.

What we collect

• Account details: email, name, and profile photo if you sign in with Google.
• Your resume (the PDF and the text we extract from it) and the profile you fill in: contact details, work authorization, preferences, optional self-identification answers, and answers you save.
• Applications you prepare or send through Understudy: tailored resumes, cover letters, form answers, statuses and receipts.
• Basic usage and cost logs (for example, how many AI calls your account made).

How we use it

• To match you with jobs, tailor documents, fill application forms, and submit applications you approve (or that you allow Autopilot to send).
• Job descriptions, your resume and your profile are sent to AI model providers (via OpenRouter) to score matches and draft documents. We don't allow them to train on your data where that option exists, and we never sell your data.
• When you apply, your information is sent to the employer's application system (for example Greenhouse, Lever, Ashby or Workday) — that's the point.

Browser extension

The Understudy extension fills and submits the applications you approved, in a background tab in your own browser. It runs only on job application sites (Greenhouse, Lever, Ashby, Workday and similar), on Understudy itself, on Work at a Startup (to read YC's job board through your own signed-in session) and on Gmail. It sends Understudy the result of each application and the form fields it could not answer. It does not collect your browsing history, and it does not run on any other site.

Gmail

If you connect Gmail (in Settings, or through the extension while you're signed in to Gmail in the same browser), Understudy reads your mail for three things only, all tied to applications you sent through it:

• security codes an employer's application system emails before it accepts an application (for example Greenhouse);
• account verification and password-reset links from employer application systems (for example Workday), for accounts Understudy created for you;
• confirmation and rejection emails, so your tracker shows what really happened.

From a matching email we keep only the sender, the date and a short excerpt of its subject line or preview (at most 200 characters), stored on that application as evidence. Codes and links are used once and not stored. No other mail is read, stored, forwarded, shown to people, used for advertising, or used to train AI models. Understudy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Gmail in Settings or remove the extension at any time.

Employer accounts

Some application systems (for example Workday) require an account per employer. If Understudy creates one for you, its password is stored encrypted and used only to sign in and send your applications there. You can see these accounts in Settings.

Your control

• Nothing is submitted in Review mode until you approve it.
• You can edit or delete any saved answer, and delete your account at any time in Settings — this permanently removes your profile, resume and applications from our database.

Security

Data is stored in a managed Postgres database with encryption at rest and in transit. Access tokens for the extension and MCP server are stored hashed and can be revoked any time.

Contact

Questions: keugenelee11@gmail.com