Applyloop by AntarimOpen workspace

The short version

  • Your CV file stays in your browser. It is read on your device and only leaves it as the attachment on an email you send.
  • Our server stores nothing. To write a draft, your CV profile (without contact details) and the job post pass through our server to an AI model and are discarded once the draft is returned.
  • Sign-in is optional. You can open any draft in your own email app without signing in. If you choose to send directly with Gmail, we ask Google only for permission to send email as you; we cannot read, search or delete anything in your mailbox.
  • We don't sell or share Google user data with third parties. It goes to Google itself and, only for the few seconds of signing in, our own server. It never reaches our AI writing provider. See section 4 for the full detail.
  • No tracking. No analytics, advertising or tracking cookies.

1. Who we are

Applyloop is a web tool that turns a job posting and your CV into an application email, which you review and send yourself. Applyloop is built and operated by Antarim ("we", "us"), which is the data controller for this processing.

2. What we process and where it lives

Your CV and CV profile

When you choose a CV (PDF or DOCX), your browser extracts its text on your device and splits it into an editable profile (name, contact, summary, experience, skills and so on). The file, its text and the profile are saved in your browser's local storage (IndexedDB) so you don't need to upload it every visit. They stay there until you click Remove or clear your browser data. Each time you ask for a draft, the profile is sent to our server (see below), except its contact section, which never leaves your device.

Job details

The job description you paste, or the screenshot you add, plus any notes, are sent to our server when you ask for a draft. Screenshots are read in memory using text recognition and may be passed to our AI provider to extract the role, company, requirements and contact address. Until then, the screenshot and text are kept in your tab's session storage, which your browser clears when the tab closes.

Drafts and your send log

Drafts, your chosen tone and the list of emails sent in this session are kept only in your tab's session storage. Your preferred email app is remembered in your browser's local storage. We never receive the final text you edit or send.

3. How your email gets sent

You choose one of two ways, each time you send.

Opening the draft in your email app (no sign-in)

When you pick Gmail, Outlook, Yahoo, Proton, Zoho or your device's mail app, your browser opens a link to that provider with the recipient, subject and body filled in. Those details go straight from your browser to the provider you picked, under its own privacy policy; they don't pass through our server. You attach your CV and press send there, and we can't see whether you did.

Sending directly with Gmail (optional Google sign-in)

If you choose Continue with Google, Google asks you to allow these scopes: openid, email, profile (your name and email address) and gmail.send (send email on your behalf). Our server exchanges the one-time sign-in code with Google and hands the resulting access token straight to your browser; it does not keep it. We do not request a refresh token, so access ends when the token expires, usually after one hour. The token is kept in your tab's session storage and used only by your browser, to send the email you reviewed to the Gmail API, with your CV attached, at the moment you press send.

4. How we use, share, transfer and disclose Google user data

If you sign in with Google, we use your name and email address to fill in the sender fields of your drafts, and the gmail.send permission only to send the email you have reviewed, when you press send. No person at Applyloop reads your Google user data, and we never sell it or use it for advertising.

Who we share it with. We share or disclose Google user data (your name, email address, and the access token that lets your browser send on your behalf) only in these ways:

  • With Google itself, to complete sign-in and to send your email through the Gmail API. This is Google handling data it already holds about you, not a third party we've given it to.
  • Momentarily with our own server, during sign-in only. Google returns the access token and your name and email to our server as part of completing the sign-in exchange; our server immediately forwards them to your browser in the redirect and does not store, log or share them further. After that, the token lives only in your browser and is never sent back to our server.

Never with our AI model provider, or anyone else. The AI model that writes your draft (see Service providers below) only ever receives your CV profile, the job details and your chosen tone; it never receives your name, email address or access token, even if your CV profile has no name of its own. That data comes from Google's APIs and is kept out of that request entirely. We do not retain Google user data on our servers at all, for any length of time, and it is never used, in any form, to develop, improve or train any generalised AI and/or machine learning model, ours or anyone else's. We do not otherwise share, transfer, disclose, rent or sell Google user data to any other party, for advertising or any other purpose. Applyloop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Service providers

  • Our AI model provider receives your CV profile (without contact details), the job details and your chosen tone to write each draft, and screenshots when text recognition alone isn't enough. It never receives anything from your Google sign-in, and processes what it does receive under its own terms and data policies.
  • Google provides the optional sign-in and delivers email through the Gmail API when you send that way, under Google's own privacy policy.
  • The email provider you choose receives the draft when you open it there.
  • Our hosting provider runs the website and API, and may keep standard network logs such as IP addresses.
  • Google Fonts serves the typefaces and icons, which means your browser contacts Google's font servers.

6. What our server records

Our server keeps operational logs (time, type of request, errors) so we can keep the service running. These logs never contain your CV, job details, drafts or tokens. Because drafting needs no account, the server limits abuse by counting draft requests per IP address, in memory, for up to 24 hours. These counters are never written to disk.

7. Cookies and storage

We set no cookies unless you sign in with Google. In that case one short-lived, strictly necessary cookie (oauth_state, 10 minutes) protects the sign-in against forgery. Everything else lives in your browser: local storage for your CV, profile and preferred email app, and session storage for the sign-in, job details, drafts and send log. We don't use analytics or advertising cookies.

8. Retention

We don't retain your content. Data in your browser stays under your control: Remove deletes your CV and profile, Clear session wipes the session and signs you out, and closing the tab clears session storage. Emails you send stay in your email account's Sent folder like any other message.

9. Your choices and rights

  • Send without signing in at all, by opening drafts in your own email app.
  • Remove your CV or clear the session at any time from the workspace.
  • If you signed in, revoke Applyloop's access to your Google account at myaccount.google.com/permissions. Clearing the session also asks Google to revoke the token.
  • Depending on where you live, you may have rights to access, correct, delete or object to the processing of your personal data. Because we don't store your content, most of these requests are fulfilled by the controls above, but you can contact us about any of them.

10. Security

All traffic is encrypted in transit (HTTPS). The optional Google sign-in uses the authorization code flow with PKCE and a signed state cookie, and the resulting token never reaches our server again after sign-in. Because your data sits in your browser, anyone with access to your unlocked device and browser profile could see your saved CV. Use Remove on shared computers.

11. Children

Applyloop is not intended for anyone under 16, and we don't knowingly process their data.

12. Changes

If we change how we handle data, we'll update this page and the date at the top. Significant changes will be highlighted in the app before they take effect.

13. Contact

Questions or requests about privacy can be sent to the contact address published by the operator of this site. See also our Terms of Service.