Privacy

Summary

Klaro stores your job-search materials and outreach history so you can generate drafts in your voice. We don't sell your data. AI runs on our server with a shared key — you never paste one. Gmail drafts live in your Gmail; Klaro never sends mail for you.

Who this covers

This policy applies to visitors and signed-in users of Klaro at localhost:3000. We process personal information to run the product: voice profiles, cold-outreach drafts, Gmail Drafts saving, the outreach tracker, authentication, security, and (when enabled) billing.

We do not currently appoint a Data Protection Officer. Privacy questions and rights requests go to klaro.outreach@gmail.com.

What we collect

Depending on how you use Klaro, we may process:

• Account — name, email, and profile image from Google sign-in.
• Job-search materials — resume, writing samples, LinkedIn text, job descriptions, hooks, and generated draft content you create in Klaro.
• Gmail connection— a draft id after you save so edits can update the same draft; a refresh token in an httpOnly cookie on your device (not stored in Klaro's database). Access tokens stay on the server and are never sent to your browser.
• Usage & security — approximate IP / request metadata, device or browser signals used for rate limits and abuse prevention, and short-lived operational logs.
• Payments — billing email, payment method, and purchase history via Stripe only if you buy credits or enable metering.
• Optional analytics — page-view stats if you opt in (Plausible when configured).

How we use it

• Authenticate you and keep the service secure.
• Build a voice profile, generate email drafts, save them to Gmail Drafts, and power your tracker.
• Process transactions and enforce fair-use limits when billing or metering is enabled.
• Comply with law and respond to valid legal requests.
• Improve the product using aggregated or optional analytics signals you allow.

Klaro does not send email on your behalf. You review and send from your own Gmail.

How long we keep it

• Profile & tracker data — kept while your account is active. Deleted when you request account deletion (see below).
• Sign-in session — until you sign out or the session expires (Auth.js session cookies).
• Gmail connection cookie — up to 180 days on your device, or until you disconnect Gmail in Klaro or revoke access in your Google account.
• Daily AI usage & rate limits — rolling counters (per day or per hour) used to enforce fair use; not kept as a long-term history.
• Server & security logs — short-lived operational logs (e.g. sign-in events, rate-limit hits). No resume text, prompts, or tokens. Retention follows our hosting provider (typically up to ~30 days).
• Gmail drafts— stay in your Gmail account under Google's retention; Klaro does not delete them when you delete your Klaro account.

Storage and protection

Application and database data are hosted with reputable providers (see subprocessors). Primary processing and storage are in the United States. Access to personal information is limited to people and systems that need it to operate Klaro. We review permissions and monitor for unusual activity as part of normal operations.

Subprocessors

We use the services below to run Klaro. Each receives only what it needs for its role. Where required, we use contractual terms (such as data processing terms) so they handle data under applicable privacy laws. We don't sell personal data to them or anyone else.

• Google

  Sign-in (OAuth), Gmail Drafts API

  Account name, email, profile image; draft content you save to Gmail

• Google Gemini (AI)

  Voice profiles and email generation

  Prompts that include your pasted materials and job context (processed to return drafts; not used to train models per Google’s API terms)

• Hosting provider (Vercel)

  App hosting and serverless functions

  Request metadata, security logs (no resume text or API keys in logs)

• Database provider (Appwrite)

  Account and app data storage

  Profile, outreach tracker, usage counters, rate-limit buckets

• Plausible Analytics

  Optional, privacy-friendly page stats

  Page views only if you opt in via cookie settings; no cross-site tracking

• Stripe

  Payments (when billing is enabled)

  Billing email, payment method, purchase history — only if you buy credits or enable metering

International transfers

If you use Klaro from outside the United States, your information may be processed in the U.S. and other countries where our providers operate. Those countries may have different data-protection rules than yours. We rely on appropriate safeguards required by applicable law (for example contractual protections with providers) when transferring personal information internationally.

Deleting your data

You can limit or remove data in several ways:

1. Clear materials in the app — edit or empty resume, writing samples, and voice rules on Profile anytime. Delete individual tracker rows from Tracker.
2. Disconnect Gmail— use Reconnect Gmail → revoke in Google, or remove Klaro's access under your Google Account → Security → Third-party access. This clears the httpOnly refresh cookie on your next disconnect.
3. Delete your Klaro account — email klaro.outreach@gmail.com from the address on your Google account. We verify ownership, then delete your user record and cascaded data (profile, outreach entries, usage counters). Self-serve delete in the app is coming; email works today.
4. Optional analytics — turn off anytime via Cookie settings in the footer.

Account deletion does not remove drafts already saved in Gmail. Remove those in Gmail if you want them gone.

Your rights

Depending on where you live (including under the GDPR and similar laws), you may have rights over your personal information. Klaro supports these requests:

• Access (GDPR reference) — Ask what personal information we hold about you and how we process it.
• Rectification (GDPR reference) — Ask us to correct inaccurate or incomplete information.
• Erasure (GDPR reference) — Ask us to delete personal information when it is no longer needed, among other limited cases.
• Restriction (GDPR reference) — Ask us to limit how we process your information in certain situations.
• Portability (GDPR reference) — Receive personal information you provided in a structured, commonly used format where applicable.
• Objection (GDPR reference) — Object to certain processing, including processing for direct marketing where it applies.
• Withdraw consent (GDPR reference) — Where we rely on consent (for example optional analytics), you can withdraw it at any time.
• Complaint (GDPR reference) — Lodge a complaint with a supervisory authority if you believe our processing violates applicable law.

To exercise a right, email klaro.outreach@gmail.com. We may need to verify your identity (for example confirming the Google account email on your Klaro account) before responding. We will reply within the timeframes required by applicable law.

United States privacy rights

If you are a U.S. resident in a state with consumer privacy laws (including California's CCPA/CPRA), you may have rights to know what we collect, delete it, correct it, and not be discriminated against for exercising those rights. Klaro does not sell or share personal information as those terms are commonly defined for targeted advertising.

Submit requests by emailing klaro.outreach@gmail.com. If we deny a request, you may appeal within 60 days by emailing again with your original request, our response date, and why you believe the decision was wrong.

Product communications

We may email you about your account, security, billing, or important product changes. If we send optional marketing or product updates, we will include an unsubscribe option and honor opt-outs. Transactional messages needed to run your account may still be sent.

Children's privacy

Klaro is for job seekers and is not directed at children under 13 (or the higher age required in your country). We do not knowingly collect personal information from children under that age. If you believe a child provided us information, contact klaro.outreach@gmail.com and we will delete it.

Policy updates

We may update this policy as the product, providers, or legal requirements change. The “Last updated” date at the top will change when we do. For material changes that affect your rights, we will provide additional notice where appropriate (for example on the site or by email). Continued use after an update means you accept the revised policy, except where law requires opt-in consent for a specific change.

Privacy questions

Data requests, subprocessors, deletion, or other privacy questions: klaro.outreach@gmail.com.