Privacy Policy

What is stored, and why

InternTrackAI is a portfolio project that tracks an internship search. It stores only what you give it, each item for the feature it belongs to:

Your account: email address and a hashed password, to sign you in.
Your profile: name, photo, field, skills, target roles, time zone and GitHub username, so the AI tools can write for your field rather than a generic one.
Resumes: the files you upload and the text extracted from them, used for match scores, cover letters, interview prep and follow-up drafts. An AI reading of a resume is kept as a draft (at most three) until you review it; nothing reaches your profile unless you confirm it.
Applications: the postings, notes, dates and statuses you enter, plus generated cover letters.
Practice answers: interview questions, the answers you type with their scores and feedback, and up to three earlier attempts at each question.
Gmail, only if you connect it: read-only access to find messages from the companies you have applied to. For a message that matches, the app keeps its subject, sender, date and a one-line summary as a status suggestion. Message bodies are never stored. Access tokens are encrypted at rest.

Nothing is sold, shared for advertising or used to profile you. There is no analytics or tracking script on this site.

Who else sees it

OpenAI processes text when you use an AI feature: resume text, job postings, your notes and cover letters for an application, your profile's field and skills, your practice answers, and the subject, sender and text of a matched email. Requests go through OpenAI's API (model gpt-4o-mini) and are governed by OpenAI's API data policy.
Google provides Gmail access when you connect it. The app requests the single gmail.readonly scope, the narrowest that allows searching your inbox and reading a matched message's text; it cannot send, delete or change mail. InternTrackAI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Separately, the site's font (Inter) loads from Google Fonts, which means your browser sends your IP address to Google when a page loads.
Resend delivers password-reset emails and receives only your email address and the reset link.
Railway hosts the app, its database and uploaded files, in its EU West region.
GitHub is asked for your public repositories only if you enter a GitHub username.

Cookies

Only functional ones: the sign-in cookie, form-security tokens, a short-lived cookie during the Gmail connection, and a preference for list or board view. Your theme, the guided tour's state and unsent practice-answer drafts are kept in your browser's local storage and never leave your device.

How long it is kept

Until you delete it. There is no automatic expiry, apart from resume-analysis drafts, which are pruned to your three most recent. Deleting an application deletes its notes, cover letters and practice questions. Disconnecting Gmail revokes the app's access with Google and deletes the connection and any pending suggestions. Server logs record account IDs and events, not the contents of your resumes, answers or emails.

Deleting your data

Delete your account (also under Profile → Your data) and everything above goes at once: every row and every uploaded file. If Gmail is connected, the app's access is revoked with Google as part of the deletion. You can also remove the app's Gmail access yourself at any time from your Google account's third-party access page.

The shared demo account cannot be deleted. It is public: its profile and practice data are reset at the start of every session, everything is reseeded nightly, and it should never hold real personal data. See the terms.

Contact