Privacy policy
Last updated: October 25, 2026
Reqline ("the service", "we") helps you search for jobs through your own AI assistant and keep track of the ones you apply to. What you are looking for, and the jobs you save, say a lot about you. This policy explains exactly what we hold, who touches it, how long it lasts, and how to get it back or destroy it.
- We collect what you tell us you are looking for, the jobs you save, and any documents you choose to store.
- We use it to do the one job you asked for: help you find and track your own applications.
- We have never sold or shared your personal information, and we never run advertising against it.
- You can export everything, correct anything, and delete your account yourself. Deletion is real and it is permanent.
Who we are
Reqline is an independently operated service, run from the United States by its sole developer, who is the data controller for the personal data described here. There is no company behind it, no sales team, and no investor with a claim on your data. You can reach the controller directly at privacy@reqline.app.
What we collect
- Account information. When you sign in with Google we receive your name, email address, and profile picture. We never receive your Google password, and we ask for no other Google data.
- Access requests. When you first sign in, the time you asked for access, and once an admin decides, the decision and when it was made.
- Search criteria. What you tell us you are looking for: target roles, where you are based and whether you would move, pay, contract work, company size and stage, office days, travel, level, the industries and companies you skip, and the lowest employer rating you will consider.
- Job tracker entries. What you or your assistant put on your tracker: company, role title, location, work mode, employment type, the job posting link and its text, salary range, facts about the employer such as its size and rating, application status and dates, and your own free text notes.
- Documents you store. If your account stores a resume: its structured content, every edit you make, the job descriptions you send with it, the files the service generates from it, short instructions you save about how your documents are written, and a record of each file generated: when, for which job title and company, the scores it produced, and whether it succeeded. An account holds up to three resume documents; when you save a fourth, the oldest one that is not your active one is removed to make room.
- Connector credential. If you set up the connector, we store your personal connector token so the setup page can show you the full URL again later. You can rotate or revoke it at any time.
- Usage counters. Per day usage counts, to enforce fair use limits on a free service.
- Technical logs and traces. Standard server logs from our hosting provider, and a trace of each request in our monitoring service: request times, status codes, which feature ran, model latency, token counts and cost, and error traces, tagged with your account ID. We do not write your criteria, your documents, or your prompts into either.
We do not collect payment information, because the service is free. We do not run analytics, tracking pixels, session recording, or fingerprinting. We do not buy personal information about you from data brokers, and we do not enrich your profile from third party sources.
Why we use it, and our legal basis
If you are in the UK, the EEA, or Switzerland, the GDPR requires us to name a lawful basis for each purpose. Here they are.
| What we do | Legal basis |
|---|---|
| Store your search criteria and job tracker entries and show them back to you | Performance of our contract with you (Art. 6(1)(b)) |
| Check new job postings against your criteria and show employer ratings | Performance of our contract with you (Art. 6(1)(b)) |
| Store documents you choose to keep, and generate files from them at your request | Performance of our contract with you (Art. 6(1)(b)) |
| Show you your own history and account information | Performance of our contract with you (Art. 6(1)(b)) |
| Review your request for access and tell you the decision | Our legitimate interest in deciding who uses a service in beta (Art. 6(1)(f)) |
| Keep the service running, debug failures, enforce usage limits, and prevent abuse | Our legitimate interest in a secure and available service (Art. 6(1)(f)) |
| Answer your emails and handle your privacy requests | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
Your data is used only to serve you. It is never used to train models, never used for marketing, and never surfaced to another user.
AI processing
If you use the connector, you are also using your assistant directly: Claude, from Anthropic, or ChatGPT, from OpenAI. Your conversation there is governed by that company's privacy policy and your own settings with it, not by this one. If you let your assistant read your email to update your tracker, it does that with the access you gave it; Reqline itself never reads your email.
Scores and automated decisions
The service ranks jobs against your criteria, shows employer ratings drawn from public employee reviews, and, for an account that stores a resume, estimates how well a document matches a posting. These are estimates for you about jobs and documents you control. They are not decisions about you, they are not shared with any employer, and they are not used to rank, profile, or evaluate you as a person. Whether to open an account is decided by a person, not by software. We do not carry out automated decision making that produces legal or similarly significant effects, and we do not use automated decision making technology to make decisions about you.
Cookies
We set only the cookies needed to keep you signed in. These are the session and refresh token cookies issued by our authentication provider, and they are strictly necessary, so we do not show a cookie banner asking permission for them. We set no advertising cookies, no analytics cookies, and no third party tracking cookies. Signing out clears them.
Who else processes your data
These are every processor that touches your personal data, and the only thing each one does with it:
| Provider | Role | Location |
|---|---|---|
| Google Cloud (Cloud Run) | Hosts the web app and the service behind the connector | us-central1 |
| Supabase | Database, authentication, and private file storage | us-east-2 |
| Sign in with your Google account | United States | |
| Langfuse | Request monitoring: the traces described under technical logs, with your account ID and no criteria, documents, or prompts | United States |
| Resend | Sends the service's email: your name and address to the administrator when you ask for access, and the approval to you | United States |
| Cloudflare | DNS for reqline.app. Records are DNS only, so traffic and content do not pass through it | Global |
Each provider processes only what its role needs. We do not disclose your personal information to anyone else, and we have no other recipients to name.
Google account data
Reqline's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only your basic profile and email address, we use them only to create and identify your account, we do not transfer them to third parties except as needed to run the service, we never use them for advertising, and no human reads them except as required for support you asked for, security, or the law.
Where your data is stored
All of it is stored and processed in the United States. If you use the service from the UK, the EEA, or Switzerland, your personal data is transferred to the United States and handled there. For those transfers we rely on the safeguards our providers put in place, which include standard contractual clauses and, where a provider is certified, the EU-US Data Privacy Framework. You can ask us for details on any specific provider.
How long we keep it
| Data | Retention |
|---|---|
| Account profile (name, email, picture) | Until you delete your account |
| Access request and decision | Until you delete your account |
| Search criteria | Until you change them or delete your account |
| Job tracker entries, with any posting text saved on them | Until you delete them or your account |
| Resume documents | Until you delete them or your account. Capped at three per account; saving a new one evicts the oldest that is not your active one |
| Generated files | The 100 most recent. Older files are deleted automatically after each new one |
| History of generated files | Kept as a record after the file itself is gone, and deleted with your account |
| Writing instructions you save | Until you delete them or your account |
| Job descriptions sent with a document | Kept only for the session that uses them, unless saved on a tracked job, except the job title and company recorded on a generated file |
| Connector token | Until you rotate or revoke it, or delete your account |
| Server logs | Short operational retention at our hosting provider, typically 30 days |
| Request traces | Held by Langfuse, and we can read back the last 30 days. They carry your account ID but no content, and once your account is deleted that ID no longer leads back to you |
| Emails we send | Kept by Resend in its delivery logs for a limited period under its own retention |
When you delete your account, the deletion runs immediately: your connector token is revoked, your stored files are deleted, and your login is destroyed, which cascades every row listed above. Residual copies can persist in encrypted provider backups for a short period before rotating out, and in no case longer than 30 days.
Your rights
Most of these you can exercise yourself, immediately, without asking us:
- Access and portability. Your criteria, your tracked jobs, and any documents you store are visible and editable in the app, and generated files download as PDFs. Email us for a machine readable copy of everything we hold.
- Correction. Edit your criteria, any tracked job, or any stored document in the app at any time.
- Deletion. Delete individual items in the app, or delete your whole account from account settings. Account deletion is immediate and unrecoverable.
- Revocation. Rotate or revoke your connector token whenever you want, which cuts off connector access without touching the rest of your account.
Depending on where you live, you also have the right to restrict or object to processing, to withdraw consent where we rely on it, to know the categories of personal information we collect and why, to limit the use of sensitive personal information, and to be free from discrimination for exercising any of these rights. We charge nothing for a request and we do not degrade the service for anyone who makes one. You may use an authorized agent, in which case we will need proof of their authority.
To exercise anything on this list, email privacy@reqline.app from the address on your account. We respond within 30 days, and within 45 days for requests under US state privacy laws.
If you are in the UK, the EEA, or Switzerland and you think we have handled your data badly, we would like the chance to fix it, but you have the right to complain to your local data protection authority without going through us first.
Selling, sharing, and advertising
We do not sell your personal information, and we never have. We do not share it for cross context behavioral advertising. We do not disclose it to third parties for their own purposes. Because none of that happens, there is no opt out to offer you, and a Global Privacy Control signal from your browser changes nothing about how we treat you: you already have the outcome it asks for.
Sensitive information
Nothing in the service needs your government identification number, date of birth, photograph, health information, religion, race, union membership, or sexual orientation, and we ask that you keep those out of what you store. We do not request sensitive personal information, we do not use or disclose it to infer characteristics about you, and if it reaches us inside something you stored, it is treated like the rest of that item and deleted with it.
Security
- Every table is protected by row level security enforced in the database, so your account can read and write only its own rows. Storage buckets are private, and file paths are scoped to your user ID.
- Traffic is encrypted in transit with TLS, and data is encrypted at rest by our database and storage provider.
- To be straight with you about administrator access: the service administrator can read account records, access requests, your search criteria other than pay, the history of generated files, and stored documents, in order to operate and support the service. Your job tracker entries are not readable by the administrator. Your data is never visible to another user.
- Connector access is scoped to your own account. You can rotate or revoke it at any moment, and removing the connector in your assistant ends its access there and then.
- Reqline is a free service built by one developer. It has not been through SOC 2, ISO 27001, or any third party audit, and we would rather tell you that than imply a certification we do not hold.
If something goes wrong
If a breach affects your personal data, we will notify you by email without undue delay, and we will notify the relevant supervisory authority within 72 hours where the law requires it. We will tell you what happened and what data was involved, rather than issuing a statement that avoids saying.
Legal and government requests
We will not hand your data to anyone, including law enforcement, unless we are compelled by valid legal process such as a warrant, subpoena, or court order. If we receive one, we will notify you before disclosing anything, unless we are legally prohibited from telling you.
Children
The service is not directed to children under 16, we do not knowingly collect their data, and we delete any account we discover belongs to one.
Changes to this policy
If this policy changes in a meaningful way, we will update this page and the date above, and we will notify signed-in users by email or in the app before the change takes effect. We will not quietly broaden what we do with data you already gave us.
Contact
Privacy questions, data requests, and complaints all go to the same person: privacy@reqline.app