Privacy Policy

• Account. Your name, email address and profile photo from Google sign-in or the email you sign in with.
• Resume and profile. The resume PDF you upload, the text we extract from it, the proof points, headline, school and links we derive, and anything you edit.
• Voice samples. Emails you paste so messages read like you. We keep the samples and a short description of your writing style.
• Gmail and Calendar data, only with your permission. Access through Composio so we can send mail as you, the messages Endothermis sends from your account, replies in those threads, and free/busy times from your calendar when drafting a reply. We also read the job related mail your applications generate and keep, for each one, the sender, subject, date and a one line summary in your application tracker; we do not store those message bodies. See Your Gmail.
• Campaign data. The goals you type, the campaign specs, companies, job postings, the people found for you, messages, replies, stages and notes.
• Chat. What you type into the Endothermis box and what it answers.
• Usage. Server logs with IP address, browser and timestamps, kept for security and debugging.

• To run your campaigns: watch job boards, score roles against your spec, find the recruiter or hiring manager, write messages in your voice, send them from your Gmail when you approve, read replies in those threads, and draft responses.
• To show you why a message says what it says, with the research behind every person.
• To keep your accounts safe: daily caps, send windows, bounce tracking and suppression lists.
• To send you a daily digest, if you keep it on.
• To improve the product with aggregate, anonymized numbers such as reply rates per play.

Ted uses language models to read your resume, plan campaigns, research people, write drafts and chat with you. Each request carries only what that task needs.

• Provider. All AI features run on Anthropic Claude. Your data is sent only to Anthropic’s API.
• Training. Anthropic does not train on data sent through its API.

• We do not sell your data, and we never share candidate data with employers or recruiters.
• We do not train models of our own on your resume, voice samples, messages or threads, and we never show them to another user. Our AI provider (Anthropic) does not train on API data either; see AI models.
• We do not send mail from our own domain on your behalf, and we do not add tracking pixels or link shorteners to your messages.
• We do not look at mail that is not about your job search, we never use your mail for advertising, and we never use it to train AI models, ours or anyone else’s.
• We do not send mail from your Gmail without your approval. Replies to mail in your own inbox go to your Drafts folder, and you decide whether to send them.

Besides sending the messages you approve and reading replies to them, Ted uses Gmail for three things:

• Keeping your tracker current. Ted reads the confirmations, recruiter replies, interview invitations, rejections and offers your applications generate and moves each application to the right stage, so you do not file every message by hand.
• Verification codes. Some employers email a code in the middle of an application. Ted reads that code when the application asks for it, so it can be entered for you. Codes are read when needed and never stored.
• Reply drafts. When a recruiter writes to you, Ted drafts a reply and saves it to your own Gmail Drafts folder, where you read, edit and send it yourself. Ted never sends these drafts.

Ted only looks for messages related to your job search. Gmail filters by sender and wording before anything reaches us, and anything that turns out not to be about an application is dropped without being kept. The text of job related messages is sent to our language model provider to classify the message or draft a reply, and is not kept by us afterward. We never use your mail for advertising and never use it to train AI models.

You can disconnect Gmail at any time in Settings, under Integrations. Disconnecting deletes our connection to your Google account on the spot, so Ted’s access ends immediately; your tracker stays until you delete your account.

Endothermis’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google access goes through Composio, which holds the Google tokens; Endothermis keeps only an account id. We use Gmail to send the messages you approve, read replies in those threads, read job related mail and create drafts in your Drafts folder, and Calendar only to read availability. We do not transfer the data except to the providers listed below as needed to run these features, do not use it for advertising, and do not use it to train AI models. You can disconnect in Settings, or revoke access at any time at myaccount.google.com/permissions; revoking stops all sending.

Some data is shared across all users because it is public and makes the product better for everyone: the registry of company job boards, public job postings, and professional contact records (name, title, work email, public profile URL) for recruiters and hiring managers. Reply outcomes feed back only as anonymized aggregates per play and company. One user’s message text is never shown to another.

Every message carries your real name and comes from your real address, so recipients can reply or ask you to stop directly. If a recipient replies “no” or asks not to be contacted, Endothermis suppresses them for all users. Recipients may also email [email protected] to be removed from the shared contact records.

Each provider receives only what it needs to run its part of the product. We will disclose data if the law requires it.

• Supabase: database, sign-in, and file storage (your resume and application screenshots).
• Vercel: hosting the web app.
• Amazon Web Services (S3): file storage for resumes and uploaded documents.
• Anthropic (Claude): the AI model behind all of Ted's features, including reading your Gmail (job mail and replies).
• Google: sign-in, Gmail, and Calendar through your own Google account.
• Composio: holds the Google connection and sends and reads mail on your behalf.
• Hunter: finding and verifying professional work email addresses.
• Proxy providers: carry the sign-in and application traffic for your LinkedIn account.
• Sendblue: texting you over iMessage.
• Resend: transactional email for magic sign-in links.
• Photon: geocoding for address search during onboarding.
• Stripe: payments.

We keep your data while your account is active. Delete your account in Settings and we remove your profile, resume, voice samples, campaigns, the people found for you, drafts, messages, replies, applications, your application tracker and every connection right away. Emails already sent remain in your Gmail. Shared public records (job boards, postings, professional contact data) are not tied to your account and remain.

Data is encrypted in transit and at rest. Gmail tokens are held by our connection provider (Composio). If you connect LinkedIn or Handshake, we store your sign-in, your Duo device and your session encrypted, use them only to act for you, and delete them when you disconnect. Access is scoped per user with row-level security. See Data and account safety for the sending limits that protect your accounts.

You can access, correct, export or delete your data from Settings or by emailing us. If you are in the EU or UK, our basis for processing your data is the contract with you, and for contacting recipients it is legitimate interest in one-to-one professional contact; we keep a record of source and purpose per contact so requests can be answered. You can complain to your local data protection authority.

Endothermis is for people 16 and older.

We will post changes here and update the date. Material changes get an email.