Privacy Policy

Last updated: September 29, 2026

work-fast ("the app", "we") tailors your resume to job descriptions and emails it to recruiters from your own email account. This policy explains what data we collect, how we use it, and your choices.

Data we collect

• Account details: your name, email address, and a securely hashed password.
• Your content: your resume, profile details, prompts, employer contacts, the job descriptions you submit, and the resumes and emails generated for them.
• Email connection: if you choose "Connect with Google", an encrypted Google authorization token and your Gmail address. If you use an app password instead, it is stored in your private workspace.
• Billing: your subscription plan and status. Payments are handled by Stripe; we never see or store your card number.

How we use Google user data

When you connect your Google account, the app requests the gmail.send permission and your email address. We use this permission only to send the application emails you queue, from your Gmail account, to the recipients you enter. The app cannot read, search, modify, or delete the email in your mailbox.

work-fast's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• use Google user data for advertising or sell it to anyone;
• transfer it to third parties except as needed to provide the features you use, to comply with the law, or with your consent;
• use it to train artificial-intelligence or machine-learning models;
• allow humans to read it, except with your consent, for security purposes, or to comply with the law.

Services we share data with

• AI model provider (via OpenRouter): your resume and each job description are sent to generate the tailored resume and email. No Google user data is sent.
• Google (Gmail API): to send the emails you request.
• Stripe: to process subscription payments.

We do not sell your personal data.

Security and retention

Google tokens are encrypted at rest, passwords are hashed, and all traffic uses HTTPS. We keep your data while your account is active. You can disconnect Google at any time in Settings, which deletes the stored token and revokes it with Google. You can also remove the app's access from your Google Account permissions. To delete your account and all associated data, email us and we will do so within 30 days.

Contact

Questions or requests: skmudassir.it@gmail.com