Privacy Policy
JOMS is a job search CRM. With your permission, it finds job-related emails and interview events in your Google account and builds an application pipeline for you automatically. This policy explains exactly what we access, what we store, who can see it, and how you can delete it. We keep it plain on purpose.
01. What we access from your Google account
When you sign in with Google and approve access, JOMS asks for these permissions:
• Your basic profile (openid, email, profile): your email address and name, to identify your account.
• Gmail, read-only (gmail.readonly): JOMS searches your mailbox for messages that look job-related (for example subjects containing "application", "interview" or "next steps", or senders such as Greenhouse, Lever or Workday) from the last 180 days. For those messages it reads only the sender, subject, date and the short preview snippet Gmail provides. It does not read full message bodies or attachments, and it does not read emails unrelated to your job search.
• Google Calendar, read-only (calendar.readonly): JOMS reads events from 90 days ago to 30 days ahead and keeps only those that look like job interviews or recruiter calls. It reads an event's description only to decide whether it is job-related, and uses the title, time, meeting link, location and the names and email addresses of attendees to show your interviews next to the right company.
JOMS cannot send, modify, move or delete any email or calendar event. Messages and follow-ups it drafts are shown on screen for you to copy and send yourself.
02. How we use it
We use Google data only to provide the features you see in JOMS: building your pipeline, sorting each company into a stage (applied, phone screen, interview, offer, rejected), flagging companies that have gone quiet, and showing upcoming interviews. Outreach and follow-up drafts are generated from your resume and the details you type in; that processing happens in your browser.
We do not sell your data, use it for advertising, or use it to build profiles for any other purpose. We do not use your Google data to train artificial intelligence or machine learning models. Our staff do not read your emails or calendar. The only exceptions are your explicit request for support, investigating abuse or a security problem, or a legal requirement.
03. Google API Services User Data Policy
JOMS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
04. What we store, and where
On our servers (database hosted by Supabase): your email address and name, whether you have been granted early access, whether Gmail is connected, your plan (free, Pro or Lifetime), your Stripe customer ID if you paid, timestamps such as your last visit, and the Google sign-in tokens (an access token and a refresh token) that let you stay connected without signing in again. These tokens can only be read by our server code; the database is not reachable from your browser.
Cookies: JOMS sets two first-party, HttpOnly cookies that are strictly necessary. One proves you entered a valid early-access code; the other proves which Google account you signed in with, so that only you can restore your own session. Neither is used for tracking or advertising.
Email details and calendar events fetched for your dashboard are processed in memory when you load or refresh your dashboard. We do not save them in our database.
In your browser (local storage on your device): a copy of your session, your resume text, display name, notes you write on companies, LinkedIn data you choose to import, and usage counters. Your resume is read inside your browser and is never uploaded to our servers.
Waitlist sign-ups: if you join the waitlist we store the email address you give us.
05. Payments
Payments are handled by Stripe. We never see or store your card number. We keep only your Stripe customer ID and your plan so we can unlock the features you paid for.
06. Who we share data with
Only the service providers needed to run JOMS: Vercel (hosting), Supabase (database), Stripe (payments) and Google (the APIs you authorize, and Google Fonts, from which your browser loads the site's typefaces and which therefore sees your IP address). They process data on our behalf and only to provide their service. We do not use advertising networks, analytics trackers or third-party cookies. We may disclose information if required by law.
07. Security
All traffic uses HTTPS. Google sign-in tokens are stored on the server and are never exposed to other users. The database accepts requests only from our server code, never directly from browsers. We request read-only Google permissions so that JOMS cannot change anything in your account.
08. Retention, deletion and revoking access
You are in control:
• Disconnect: use the disconnect button in the dashboard sidebar. It revokes JOMS's access at Google, deletes the Google tokens we store, and signs you out on this browser.
• Revoke Google access: visit myaccount.google.com/permissions and remove JOMS. Google then invalidates our tokens immediately.
• Delete your data: email privacy@joms.io from the address on your account and we will delete your account record and stored Google tokens within 7 days and confirm by email. Copies may remain in provider backups for a short period before they are overwritten.
• Switch account or sign out: the "Not you? Sign out" link on the sign-in screens ends the session and removes your resume, notes and name from the browser.
• Browser data: clear this site's data in your browser, or uninstall the Chrome extension, to remove everything stored on your device.
We keep data only while your account is active or until you ask us to delete it.
09. Chrome extension
If you install the optional JOMS Chrome extension, the LinkedIn messages you send are saved in your browser's local extension storage so they appear in your dashboard. They are not sent to our servers. Uninstalling the extension removes them.
10. Children
JOMS is not directed to children under 16 and we do not knowingly collect their information.
11. Changes to this policy
If we change what we collect or how we use it, we will update this page and the date above, and ask for your consent again where Google requires it.
12. Contact
Questions or deletion requests: privacy@joms.io. We reply within 48 hours.