LEGAL
Privacy Policy
How ApplyFlow handles account data, Gmail connection, sensitive Google user data, and outreach content.
LAST UPDATED · Jul 22, 2026
What we collect
Account details from Google sign-in (name and email), and the templates, subjects, signatures, positions, contacts, and application records you create. We also store email content you send through ApplyFlow and replies synced from your connected Gmail inbox so you can track conversations in one place.
Google sign-in and Gmail credentials
Google OAuth is used only to sign you in: we request your email address and basic profile name to create and identify your account, and we do not request Gmail API scopes or store Google access tokens. Sending and reply-sync use a Gmail app password you provide in Profile. ApplyFlow logs in to Gmail over SMTP to send messages you compose and over IMAP to detect replies to outreach you started. We do not use this access to read unrelated personal mail for advertising, profiling, or resale.
How we use it
We use your data only to operate ApplyFlow: authenticate you, send outreach from your connected Gmail account, store conversation history, sync replies into your Inbox, and keep the product working reliably. We do not sell your personal data. We do not use Google user data for advertising, credit scoring, or unrelated AI/ML training.
Data protection mechanisms
Your Gmail app password is encrypted at rest using AES-256-GCM before storage in our database. Data in transit between your browser, our servers, and Gmail is protected with TLS (HTTPS, SMTP with STARTTLS, and IMAP over SSL). Encryption keys are kept in server environment configuration, separate from application code. Google sign-in requests only identity scopes (least privilege), and credentials are never logged in plaintext.
Google Limited Use
ApplyFlow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data (your email address and profile name from sign-in) is used only to provide the sign-in feature. We do not transfer Google user data to third parties except as necessary to provide that feature, for security/compliance, or as required by law — and not for serving advertisements.
Access controls
Your encrypted Gmail app password is stored only on your user account and is used only for your sends and reply-sync. You can disconnect Gmail at any time from Profile; disconnecting removes the stored app password from our systems so ApplyFlow can no longer send mail or sync replies until you add a new one. You can also revoke the app password itself from your Google Account at any time.
Sharing
Outbound email is sent through your connected Gmail account via Google. We do not share your account or Gmail content with third parties for advertising. Hosting and database providers may process data only as needed to operate the service, under contractual obligations to protect it.
Retention and deletion
We keep your account data while your account is active. You may delete contacts, templates, applications, and related records in the app. Disconnecting Gmail stops further access and removes the stored app password. To close your account and request deletion of remaining stored data, email us at the contact address below and we will process the request.
Your choices
You control what you store and send. You can update your profile, disconnect Gmail, remove masters and contacts, and stop reply syncing by disconnecting your Gmail account. You may also revoke the app password from your Google Account security settings at any time.
Contact
Questions about privacy or data deletion: email rajan@crictourn.space or use our Contact page.