Privacy policy

In effect from 14 November 2026

The short version

• Nothing is sent to an employer until you tap Apply.
• Your data is stored in Cloudflare's EU jurisdiction.
• Your CV is used only to find, score and write for you. It never appears in anyone else's results.
• Gmail access is optional. With it, Vishwa's creates drafts and spots replies from employers you applied to. It never sends email.
• No ads, no selling of data. The only cookies are the two that keep you signed in. Usage numbers store nothing on your device, and you can turn them off in Settings.
• You can download your data or delete your account in Settings at any time.

Who is responsible

Vishwa's is run by Sriharsh Amur ("Sri"), who is the controller of your personal data under the GDPR. For anything about your data, write to privacy@sriharsh.com.

What we keep and why

Your invitation

Vishwa's is invite-only. Before you have an account we keep the email address you were invited at and, if the person who invited you wrote one, their short note to you. We use them to send the invitation and to let that address sign in. Legal basis: our legitimate interest in deciding who can use the service.

Your account

When you sign in with Google we receive your name, email address and profile picture. We use them to create your account and recognise you. We also keep a record of which version of this privacy notice you accepted and when, and the date you last used Vishwa's, which is how we know when an account has gone unused. Legal basis: performing our agreement with you (the service you asked for).

Your profile and CV

The CV you upload and the details you check or add: contact details, education, work history, projects, skills and languages. Also your search settings (keywords, places, lowest fit score, how many jobs a day) and your visa details (type of permit, its last day, whether you need a sponsor). We use these only to find jobs for you, score them and write your documents. Legal basis: performing our agreement with you.

Your job search

The jobs found for you and their fit scores and reasons; the CVs, letters and interview prep packs written for you, with every version and the PDFs; what you chose (apply, skip, rewrite); your applications, including ones you record yourself, with notes and follow-up dates; and the companies and jobs you follow or add. Legal basis: performing our agreement with you.

Telegram, if you link it

Your Telegram chat number, so the bot can send you job cards and PDFs and receive your taps. Legal basis: your consent, which you withdraw by blocking the bot in Telegram. To have the stored chat number removed too, write to privacy@sriharsh.com.

Gmail, if you connect it

The Google access tokens for the two Gmail permissions below, and for each employer reply we recognise: the message's Gmail number, its subject and whether it was an interview invitation or a rejection. Legal basis: your consent, which you withdraw with Disconnect Gmail in Settings, Email: Google cancels the access and the stored tokens are deleted. Removing Vishwa's on your Google account's permissions page also stops all access.

Running the service safely

Error logs that may contain your account number, kept by Cloudflare for a short time to find and fix faults. Error reports also go to Sentry: what went wrong and where, your browser and device, the page, and your account number. Before a report leaves, we remove what you typed or sent, cookies, email addresses and any longer text, so no CV, letter or message is in it. Legal basis: our legitimate interest in a working, secure service.

What it costs and how it is used

For each request to the AI model, each PDF drawn, each email and each notification we keep a row of numbers: your account number, what it was for, how big it was and what it cost. Never the text. We also note the days you used Vishwa's, under a code instead of your account number, to count active users. Legal basis: our legitimate interest in running and paying for the service. The people who run Vishwa's see what each account costs, not what is in it.

Usage numbers: which pages you open and what kind of device, browser and theme you use, under the same code; and in PostHog, the pages you open and a few steps of your job search (documents ready, application sent), as numbers and categories under your account number. Before you sign in, PostHog counts the public pages you open without knowing who you are. Never what you type, your CV, your letters or your messages. Nothing is stored on your device for this. Legal basis: our legitimate interest in learning which parts of Vishwa's help people, so we can improve it. You can turn usage numbers off at any time in Settings, under Privacy and account; from then on none of this is counted for you.

Email codes and requests to join

When you ask for a sign-in code, we send one email through Cloudflare Email Sending. The code expires after five minutes and is stored as a hash. If you ask to join, we keep your name, email, optional message and request date so admins can review your request and invite you. Admins receive a notification through Telegram and their devices. This is to take steps at your request before providing the service. Requests are removed after six months at our monthly cleanup. You can ask us to delete your request by contacting us. We use temporary hashed address and IP counters to prevent abuse. Gmail features still require a separate Google connection.

Google user data and Gmail

Signing in with Google (the openid, email and profile permissions) gives Vishwa's only your name, email address and profile picture. Vishwa's does not ask for access to Google Drive, Calendar, Contacts or anything else. Gmail access is asked for separately, later, and only if you choose to connect it. It covers two permissions:

• Create drafts (gmail.compose). When you tap Apply on a job that takes applications by email, Vishwa's puts the email in your Gmail drafts, addressed to the employer, with your CV and letter attached as PDFs. You read it and send it yourself. Vishwa's never sends email from your account.
• Read mail (gmail.readonly). Twice a day, and only while you have applications waiting for an answer, Vishwa's lists mail you received in the last two days (not your sent mail or drafts). For each message it reads only the sender, the subject and Gmail's short preview, and compares them with the companies you applied to. A message that doesn't match one of those companies is skipped: nothing about it is stored or passed on. For a message that does match, the sender, subject and preview go to Anthropic's Claude model to tell an interview invitation from a rejection, and the job's status is updated. Vishwa's never opens attachments or the full message.

Vishwa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data from your Google account:

• is used only to provide the features described above, which you can see and control in the app;
• is never used for advertising, never sold, and never used to build a profile of you for anyone else;
• is never used to train AI or machine-learning models;
• is passed to others only as this page describes, to provide those features, or where the law requires it;
• is not read by any person, unless you ask us to (for example to help with a problem), it is needed for security, or the law requires it.

Google user data at a glance

• Accessed: your name, email address and profile picture (sign-in); if you connect Gmail, the ability to create drafts (gmail.compose) and the sender, subject and preview of mail received in the last two days (gmail.readonly).
• Used: only to create your account, to put your application emails in your Gmail drafts, and to update a job's status when an employer you applied to replies.
• Stored: your name, email address and picture with your account; the Google access tokens; and for each recognised employer reply, its Gmail number, subject and whether it was an interview invitation or a rejection. All of it in Cloudflare's EU jurisdiction, encrypted at rest. The content of other mail is never stored.
• Shared: the sender, subject and preview of a likely employer reply go to Anthropic's Claude model, only to tell an interview invitation from a rejection. Nothing from Google is shared with anyone else, sold or used for ads.
• Kept: tokens until you delete your account or ask us to delete them (removing Vishwa's in your Google account makes them useless at once); reply records with your job's activity history, at most 24 months.
• Deleted: Disconnect Gmail in Settings, Email cancels the access and deletes the stored tokens; removing Vishwa's on your Google account's permissions page stops all access at once, and delete your account in Settings to delete everything, Google tokens included. Or write to privacy@sriharsh.com.

Who else handles your data

We use these services to run Vishwa's. Each handles your data only on our instructions and under a data processing agreement.

• Cloudflare hosts the website and runs the search. Your profile, documents and job search are stored in its D1 database and R2 file storage, both in the EU jurisdiction. It also turns your documents into PDFs in its browser service, and reads some employers' careers pages there. Its Workers AI service turns a short description of what you look for (your job titles, search words, skill names, past job titles and degrees, never your CV text, name or contact details) into a list of numbers, so we can tell quickly which jobs are close to it. Cloudflare doesn't keep that text or the numbers after it answers, and doesn't train on them; the numbers are stored with your profile in the EU. Where the browser and Workers AI run isn't guaranteed to be in the EU.
• Google provides sign-in and, if you connect it, Gmail.
• Anthropic provides the Claude model. Your profile and the text of each job are sent to it to score the fit, write and check your documents, and recognise employer replies. Anthropic is in the United States; the transfer is covered by the EU-US Data Privacy Framework and the EU's standard contractual clauses. Under its commercial terms, Anthropic does not train its models on what we send.
• Telegram delivers job cards and PDFs to you, if you link it.
• Sentry (EU, Frankfurt) receives error reports, cleaned as described above.
• PostHog (EU, Frankfurt) receives usage numbers, unless you turned them off. Neither receives your IP address from us: reports go through our own site first.

Job ads come from public sources: Adzuna, LinkedIn's public job search, and employers' own job feeds and careers pages. We only read their public job ads. They receive search words, never your name or your CV. Claude also searches the web for job ads on any site for you: for that it receives only your job titles, search words and places, never your name or your CV.

When you tap Apply on a job where the employer's careers site accepts applications directly, your name, email address, phone number, CV and letter go to that employer. That happens only after your yes, for that one job.

Who can see your data

Only you. Nothing about one person ever reaches another person's results, prompts, pages or messages. The people who run Vishwa's can invite people and see who has an account, but cannot see your CVs, letters or applications in the app.

How we protect it

• All traffic to and from Vishwa's is encrypted (HTTPS), and Cloudflare encrypts the stored data at rest, in its EU jurisdiction.
• Sign-in is through Google or a one-time email code, and Vishwa's is invite-only. Every request for your data is checked against your account, so nobody else can open your profile, documents or applications.
• Your Google tokens are used only by Vishwa's own server, for the Gmail features above, and are never shown in the app or sent to anyone else.
• The keys to the services we use are kept as encrypted secrets, never in our code. Your CV and documents never go into logs.
• If a breach puts your data at risk, we tell you and the Dutch data protection authority as the GDPR requires.

We never sell your data, and we never share it except as this page describes.

How long we keep it

• Your account and profile: until you delete your account.
• Jobs that have closed: 12 months after a job closes it is deleted, together with your fit score, documents and application for it.
• The activity history of your jobs (found, applied, replied): removed after 24 months.
• Cost and active-day numbers: 24 months. Usage numbers in our own records: 90 days, after which only daily totals without any person remain. In PostHog: as long as PostHog keeps events for our plan; write to privacy@sriharsh.com to have yours deleted sooner. Error reports in Sentry: at most 90 days.
• If your access is taken away: your data is kept and your job search is paused, until you are invited again or you delete your account. To have it deleted while you can't sign in, write to privacy@sriharsh.com.
• Accounts nobody has signed in to for 24 months: deleted, 30 days after a notice. The notice comes by email only if you turned on "Email me about my account" in Settings, otherwise on Telegram if you linked it. With neither, the account is deleted after the same 30 days without a notice.
• When you delete your account, your profile, documents, PDFs, applications and Google tokens are deleted at once. Copies in Cloudflare's database recovery history expire within 30 days.

Your rights

Under the GDPR you can:

• get a copy of your data, with Download my data in Settings;
• correct it, by editing your profile in Settings;
• have it erased, with Delete my account in Settings;
• object to or ask us to restrict how we use it (usage numbers you can turn off yourself in Settings), and withdraw consent for Gmail or Telegram at any time;
• complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

For anything you can't do in the app, write to privacy@sriharsh.com. We answer within a month.

Scores and documents are made automatically, but they decide nothing on their own: every application waits for your yes.

Cookies

Vishwa's sets two sign-in cookies: one holds your session, and the other is a copy of it that is kept for five minutes so pages load faster. There are no advertising or tracking cookies, and no scripts from other sites. Usage numbers store nothing on your device: PostHog keeps its id only in the open page's memory, so it is gone when you close or reload the page. If you turn usage numbers off, your browser remembers that choice until you sign out, so the public pages follow it too.

So that Today opens without a connection, your browser keeps a copy of your Today page (your name, email address and the jobs ready for you) on your device for up to three days. It never leaves your device, and signing out deletes it.

Children

Vishwa's is for people aged 16 and over.

Changes

If this policy changes in a way that matters, we'll tell you by email or in the app before the change takes effect. The date at the top shows the current version. See also the terms.