Legal

Privacy Policy

On the market doesn’t mean on display. This is the full account of what we hold, who ever sees it, and how to take it back.

Effective September 1, 2026

  1. 01The short version

    TheyApply is a talent market, not a résumé database. There is no directory for employers to browse. An employer sees you only when a role they have given us matches the profile you built, and only as much of you as they need to decide whether to invite you to interview.

    If you upload a résumé when you join, we read it once to fill the form in for you. You check the result before anything is saved, and the file itself is never handed to an employer.

    You can pause, edit, or withdraw at any moment from your dashboard, and withdrawal removes you from every shortlist going forward. We do not sell your information, and we do not share it with advertisers.

  2. 02Who we are

    TheyApply operates theyapply.co and is the controller of the information described here. You can reach us about anything on this page at privacy@theyapply.co.

  3. 03What candidates give us

    Everything in this list comes from you, through the onboarding form or your dashboard. Nothing here is inferred, purchased, or scraped from elsewhere.

    • Identity and contact: your full name, email address, city, and LinkedIn URL if you add one.
    • Background: school, degree, graduation year, current employer and title, years of experience, and your skills.
    • Your résumé: the file itself, and its original filename so it stays recognisable to you. If you upload one during onboarding we read it to fill the form in for you, which is described in full under “Automated processing” below.
    • What you want: desired roles, industries and locations, remote preference, minimum base and target total compensation, preferred company sizes, when you could start, and your work authorization.
    • Anything you write in the free-text notes about the opportunity you are looking for.
    • The employers you have asked us to hide you from, which we keep so that we can enforce it.

  4. 04What employers give us

    When a company asks us to build a shortlist we collect the name and work email of the person asking, their company, the role, its location and compensation range where given, and the full text of the job description. We read the description with an automated parser so the requirements can be matched against the market.

  5. 05What we collect automatically

    We use privacy-friendly product analytics to count page views and funnel steps: how many people reached onboarding, how many finished. These events are not tied to your name or email.

    If you arrived from an advertisement, our advertising partners' measurement tags may record that the visit resulted in a signup, so that we can tell which campaigns work. We deliberately do not send your profile identifier, name, email, or any profile content to those partners, and the tags do not run on your dashboard.

  6. 06How we use it

    We use what you gave us to do the thing you came here for, and nothing else:

    • To read a résumé you upload, so that your profile is filled in for you rather than typed out. You review and correct the result before anything is saved.
    • To match you against the roles employers bring us, and to rank and explain the shortlist we hand them.
    • To show you your own profile, your market status, and what has happened to it.
    • To email you a link back to your profile when you ask to recover it.
    • To keep the service working, diagnose failures, and prevent abuse.

    We do not use your résumé or profile to train machine-learning models, and we do not permit our vendors to do so.

  7. 07What employers actually see

    When we present you on a shortlist, the employer sees your first name and last initial, your school, degree and graduation year, your skills and experience as you entered them, and the roles, locations and compensation you asked for.

    • They do not see how to contact you: not your full name, your email, your phone number, or your LinkedIn. We hold that so that we can reach you, and it stays with us until you accept an interview.
    • They do not receive your résumé file. It is stored for you and for us, not handed on. The shortlist is built from the profile, not the document.
    • They never see you at all if they are on your hide list, or if you have paused or withdrawn.
    • They cannot browse or search candidates. A shortlist exists only in response to a specific role.

  8. 08Automated processing

    We use a language model from Anthropic in three places. They are worth keeping apart, because each one receives something different, and only the first ever sees your résumé.

    • Reading your résumé, to build your profile. If you upload a résumé when you join, its contents go to Anthropic once so that the form can be filled in for you. A PDF is sent as the pages of the file; a Word document is converted to plain text on our own server and only that text is sent. Either way it is sent for that single request and nothing else. We do not keep a copy of your résumé there, and it is not added to any model. Your name and email are usually printed on a résumé, so this one step does see them. What comes back is a draft: you see every field, correct anything wrong, and nothing is saved until you finish onboarding. Skip the upload and none of this happens.
    • Reading job descriptions, to build a role. The text an employer gives us is read the same way, so that a description written for humans becomes requirements the matching can use. This step involves no candidate information at all.
    • Reviewing a shortlist, to explain it. Once a role's hard requirements have filtered the market, a model reviews the candidates who remain, writes a plain-language reason each is worth interviewing, and may adjust a score slightly. It receives your title, employer, school, graduation year, years of experience, skills, desired roles, city and notes, under an internal identifier. It does not receive your name, your email, or your résumé.

    Matching itself is deterministic before any of that: a role's hard requirements filter the market first, and the ranking that results explains itself in terms of the facts you gave us.

    Nothing you upload or write is used to train a model, ours or anyone else's, and our vendors are not permitted to do so.

    No hiring decision is made by us or by a model. We produce a shortlist; people decide.

  9. 09Who we share it with

    We do not sell personal information, and we have not done so in the preceding twelve months. We share it only with the employers described above and with the service providers that run the product:

    • Supabase: the database and the private storage bucket that holds résumés.
    • Vercel: hosting and product analytics.
    • Anthropic: reading a résumé you upload, reading job descriptions, and reviewing shortlists, as described above. Content is sent for the request that needs it and is not stored there.
    • Resend: sending profile recovery email.
    • Our advertising partners, which receive conversion counts only, never profile data.

  10. 10How it is protected

    • Résumés live in a private bucket. They are never publicly addressable; reading one requires a link our server signs on demand, which expires two minutes later.
    • Every database table has row-level security enabled with no public policies, so nothing is readable with a public key. All access runs server-side.
    • Recovery links are stored only as hashes, are single-use, and expire. A link in an old email cannot be replayed.

    Your dashboard is reachable by an unguessable link rather than a password. Anyone holding that link can see and edit your profile, so treat it as you would a password: do not post it or forward it. If you lose it, request a fresh one by email; if you think someone else has it, write to us and we will retire it.

  11. 11How long we keep it

    Your profile stays as long as you are on the market, because that is the point of it: you enter once rather than reapplying. If you withdraw, you stop appearing on shortlists immediately.

    To have your profile and résumé deleted outright rather than withdrawn, write to privacy@theyapply.co from the address on the profile and we will erase it within 30 days. Employer leads and job descriptions are kept for as long as we are working the role, and for a reasonable period afterwards for our records.

  12. 12Your choices and rights

    • See and correct: your dashboard shows everything we hold about you and lets you edit it.
    • Pause: stop appearing on new shortlists without losing your profile.
    • Withdraw: leave the market entirely.
    • Hide from specific employers: add a company and we will never present you to it.
    • Delete: ask us and we will erase your profile and résumé.

    Depending on where you live, you may also have the right to a copy of your information in a portable form, to object to or restrict certain processing, and to complain to your local data protection authority. Ask us and we will help; we will not charge you or treat you differently for exercising any of these.

  13. 13Children

    TheyApply is for people entering or already in the workforce and is not directed to anyone under 16. We do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.

  14. 14Where your information is held

    Our providers process and store data in the United States. If you are elsewhere, using TheyApply involves transferring your information there, under the standard contractual protections our providers offer.

  15. 15Changes

    If we change this policy in a way that materially affects you, we will update the effective date above and email candidates on the market before it takes effect.

  16. 16Contact

    Questions, requests, and complaints all go to privacy@theyapply.co, and a person reads them.