Privacy

What you upload

• Sign-in: your email and password.
• Setup: a resume PDF and an unofficial transcript PDF (or a typed list of your courses instead of a transcript), your major, grad term, work authorization, role types, target term, one-sentence goal, dream tier and any skills you type in.

What we extract and store

Gemini reads your resume and transcript PDFs in memory to pull out your courses, skills and work experience. What gets saved to our database is that structured result, plus the facts you typed in setup, tied to your account: major, grad term, work authorization, goal, target term, role types, dream tier, and your parsed courses, skills and experiences. Your ranked feed, roadmap and any applications you log are stored the same way, tied to your account.

What we never store

• The resume or transcript PDF file itself, once it has been read.
• Your raw IP address (only a salted hash, see Feedback below).
• Your password in plain text.

Services we rely on

• Gemini (Google) reads your PDFs and does the agent reasoning.
• Databricks Lakebase (Postgres) stores every app table.
• Vercel hosts the app.
• Supabase Auth handles sign-in only. It never sees your resume or transcript.

The shared job feed

The internship, co-op, new-grad, full-time and research listings every signed-in user sees are public listing data from employers' own applicant-tracking systems, not personal data about you. New postings are scanned every 30 minutes.

Feedback

Feedback you submit keeps your message, an optional email address, the page you were on, your browser's user-agent, and a salted hash of your IP address, kept only to limit repeat submissions. The raw IP is never stored.

Cookies

Sign-in cookies only, to keep you signed in between visits.

Deleting your data

Ask through the feedback box in the app. Everything tied to your account is deleted.

Children

Prospect isn't for anyone under 16.

Changes

If this policy changes, the update is posted on this page.