Overview
PrepCard ("we", "our", or "the app") is an AI-powered interview preparation tool. This policy describes what data we collect, why we collect it, and how we protect it. We take your privacy seriously and will never sell your personal data.
Data We Collect
- Account information — email address and display name, collected at sign-up.
- Calendar data — when you connect a calendar, we read upcoming events to detect interviews. We do not store your full calendar; only detected interview events are saved.
- Gmail data — when you connect Google, we read message subject lines, sender addresses, and snippets from mail matching job-search terms, in order to detect applications, interview invitations, and rejections. Access is read-only. We never read message bodies or attachments, and we never send, modify, or delete mail. We store only the detected company, role, and signal type, along with the subject line and snippet of matched messages.
- Resume content — files you upload are stored securely and used only to personalize your prep cards and generate cover letters.
- Interview notes — notes you take during calls are stored in your account and never shared.
- Usage data — basic analytics to understand how the product is used (page views, feature usage). No behavioral profiling.
How We Use Your Data
- To generate AI prep cards, cover letters, and follow-up emails on your behalf.
- To send you notifications about upcoming interviews (push or email, per your settings).
- To sync your calendar and detect scheduled interviews automatically.
- To improve the product based on aggregate usage patterns.
We do not use your data to train AI models, sell to third parties, or serve advertising.
Third-Party Services
- Supabase — database and authentication (EU/US data centers).
- Anthropic— AI model provider. Your interview context is sent to Anthropic APIs to generate prep cards. Anthropic's privacy policy applies.
- Google — Calendar and Gmail access via OAuth. Tokens are held in our Supabase database, encrypted at rest, and are used only to make read-only requests on your behalf.
- Resend — transactional email delivery.
- Vercel — hosting and edge functions.
Google API Services — Limited Use
PrepCard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google Calendar and Gmail data only to provide and improve the interview tracking features you explicitly enable.
- We do not transfer this data to others except as necessary to provide those features, comply with applicable law, or as part of a merger or acquisition.
- We do not use this data for advertising purposes.
- We do not allow humans to read this data unless we have your explicit consent, it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymized.
- You can revoke our access at any time from Settings, or from your Google Account permissions page.
Data Retention
Your data is retained as long as your account is active. You can delete your account and all associated data at any time from Settings. Upon deletion, your data is permanently removed within 30 days.
Your Rights
You have the right to access, export, correct, or delete your data at any time. To exercise these rights, email us at hi@prepcard.app.
Security
All data is encrypted in transit (TLS) and at rest. Authentication is handled by Supabase Auth with row-level security enforced on all database tables. We do not store plain-text passwords.