Privacy policy.

MatchKo is a job application assistant operated by Chimney Studios, based in Oshawa, Ontario, Canada. Throughout this policy, "we," "us," and "MatchKo" refer to the service at matchko.com and any subdomains. For privacy-specific questions, email privacy@matchko.com. For general support, use hello@matchko.com.

This policy covers how we handle personal information when you visit our website, create an account, upload resumes, generate documents, or connect third-party integrations like Gmail.

We only collect what we need to run the service. Here is the full list:

• Account info — email, full name, and a password hash managed by Supabase Auth. We never see your raw password.
• Resume content — uploaded files (PDF, DOCX), extracted text, and structured data we parse from those files (work history, skills, dates, metrics).
• Application data — job descriptions or URLs you submit, the generated resume and cover letter drafts, application status, notes, and contact info you add.
• Usage data — which features you use, how many generations you run per month, error logs tied to your account, and basic product analytics.
• Payment info — handled entirely by Stripe. We store only a Stripe customer ID and subscription status. Card numbers never touch our servers.
• OAuth tokens — if you connect Google or Gmail, we store encrypted access and refresh tokens with only the scopes you grant. You can revoke access at any time.
• Cookies and technical data — IP address, user agent, session cookies required for login, and a few preference keys stored in localStorage (theme, view settings).

We use your data for these specific purposes:

• Generate tailored resumes, cover letters, and application emails based on the job descriptions you provide.
• Run and maintain the service — authentication, billing, storage, and delivery of the documents you create.
• Respond to support requests and troubleshoot issues you report.
• Improve the product using anonymized, aggregated patterns only. We never train on identifiable resume content.
• Send essential service emails — account confirmations, password resets, billing receipts, and security alerts.
• Detect and prevent fraud, abuse, and security incidents.

This list matters as much as the one above. MatchKo will never:

• Sell, rent, or monetize your personal data in any form.
• Use your resumes, cover letters, or generated documents to train AI models — ours or anyone else's.
• Share your information with advertisers or data brokers.
• Scan your Gmail inbox. We only use the Gmail scopes required to create drafts in your drafts folder, and only when you initiate it.
• Read or send emails on your behalf without your explicit, per-action confirmation.

We rely on a small set of vetted subprocessors to run the product. Each one has its own privacy policy and security posture:

• Supabase — Postgres database, Auth, and file storage. Hosted in US or EU regions depending on project.
• Vercel — application hosting and CDN.
• Stripe — payment processing, PCI DSS Level 1 compliant. Handles all card data.
• Anthropic (Claude) — AI model used to generate tailored documents. Resume content sent for generation is not used to train Anthropic models under our commercial terms.
• Google Cloud (Gmail API) — only when you connect your Google account. Access is scoped to drafts and compose. We never use restricted scopes.
• Upstash Redis — rate limiting cache, stores short-lived IP and user identifiers only.
• Firecrawl — scrapes job URLs you submit so we can read the posting. We send only the URL, not your resume.

• Account data is kept for as long as your account is active.
• Generated documents stay in your account indefinitely until you delete them or your account.
• Encrypted backups are retained for 30 days and then rotated out.
• Soft-deleted items (including closed accounts) are hard-deleted within 24 hours, except where we are legally required to retain records (for example, billing records for tax purposes).

Depending on where you live, you have specific legal rights over your data.

Under GDPR (EU, UK, EEA)

• Right to access — get a copy of the data we hold on you.
• Right to rectification — correct inaccurate data.
• Right to erasure — delete your account and associated data.
• Right to data portability — export your data in a portable format.
• Right to restriction — ask us to pause processing.
• Right to object — object to processing in specific circumstances.
• Right to lodge a complaint with your local data protection authority.

Under CCPA / CPRA (California)

• Right to know what personal information we collect and how we use it.
• Right to delete personal information we hold about you.
• Right to opt out of the sale or sharing of personal information — we do not sell or share personal information, so there is nothing to opt out of.
• Right to non-discrimination for exercising any of these rights.

Most rights can be exercised directly inside MatchKo. Go to Settings > Account to:

• Export all your data as a single JSON archive.
• Delete your account permanently — we hard-delete within 24 hours.
• Update or correct your profile information.
• Disconnect any third-party integrations.

If you prefer, email privacy@matchko.com and we will action your request within 30 days.

• TLS 1.3 for all data in transit.
• AES-256 encryption at rest for database and storage (managed by Supabase).
• Row-Level Security (RLS) on every table — your data is only accessible by your own authenticated session.
• Signed, time-limited URLs for file access. Raw file URLs are never public.
• OAuth tokens encrypted before storage. Never exposed to the client.
• HTTPS-only with HSTS preload and strict Content Security Policy.
• Regular security reviews and dependency audits.

Full details live on our security page.

MatchKo is operated from Canada. If you use the service from outside North America, your data may be processed in the United States (via Vercel and some Supabase regions). Where data is transferred out of the EU/UK, we rely on Standard Contractual Clauses or equivalent safeguards approved under GDPR.

MatchKo is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child has created an account, email privacy@matchko.com and we will delete it.

If we make material changes to how we handle your data, we will notify you by email and show an in-app banner at least 30 days before the change takes effect. The effective date at the top of this page is always the source of truth.

Questions, corrections, or requests? We read every email.