Privacy Policy

Effective September 17, 2026. Last updated October 27, 2026.

OfferFlow is an iPhone application that helps a college student write, send, and follow up on professional networking emails from the student's own Gmail account, and schedule the calls that result. OfferFlow is operated by OfferFlow LLC, a Missouri limited liability company based in Kirkwood, Missouri, United States ("OfferFlow", "we", "us"). This policy explains what we collect, why, how long we keep it, who else sees it, and how you delete it.

This policy covers the OfferFlow iPhone app and the website at joinofferflow.com. If you do not agree with it, do not connect your Google account and do not use OfferFlow.

1. Data from your Google account

OfferFlow works inside your own Gmail and Google Calendar rather than sending mail from a different address. To do that, we ask you to authorize specific Google permissions. Before each authorization request, the app shows you a screen naming the permission, what it allows, and what OfferFlow does with it. You must tap to continue. Navigating away or closing the screen is not consent, and no data is collected until you have granted the permission.

These are the exact permissions we request and the only purposes we use them for.

Google data we store, and for how long

OfferFlow stores the minimum it needs for the features you can see in the app:

• The messages you send through OfferFlow. The recipient, subject, body, send time, and Gmail message and thread identifiers, so the app can show you your own outreach history and know which thread to check for a reply. Kept until you delete the contact or your account.
• Replies in those threads. OfferFlow reads each reply when it arrives and stores only: that a reply arrived and when, its Gmail message identifier, the kind of reply OfferFlow determined (proposes a time, asks for your availability, says to try again later, points you to someone else, declines, or something else), the scheduling details it found (proposed dates and times, the part of the day they asked for, a call length, a time zone, the day they said to try again), and the name of a school the contact mentioned, which is shown to you to confirm. Introductions from replies. When a reply points you to someone else, OfferFlow also keeps that person's name, and their title, company and email address if the reply gives them, so it can offer to add them to your contacts, introduced by the person who replied. They are added only if you tap to add them, and nothing is sent to them until you send it. Their first name is used to write your thank-you. Kept until you delete the contact or your account. On the contact, it saves a phone number from their signature and a time zone when the contact has none, a call length they proposed, and the address they replied from when the contact had no address. A reply that declines archives the contact with the date it arrived. The words of a reply, its subject, and Gmail's preview of it are not stored: when you open the contact, the app reads the reply from Gmail at that moment to show it to you. For an automatic reply, such as an out-of-office message, OfferFlow stores only that one arrived, when, and its Gmail message identifier; when an out-of-office reply says when the person is back, OfferFlow reads that date in memory and keeps only the date on the contact, so your follow-up waits until after it. For a delivery failure notice, it stores the address that failed and the error code. A message you wrote in Gmail in one of those threads is recorded by its time and Gmail message identifier only. Kept until you delete the contact or your account.
• Calls you booked. The contact, date, time, duration, title, and location (the contact's phone number or a Google Meet link) of events OfferFlow created, the event's identifier, whether the contact accepted, declined, said maybe or proposed a new time, with the time they proposed, and whether the call was moved or cancelled in your calendar. When they answer by email, OfferFlow reads only the answer and that time from Google's calendar reply. While one is coming up, the identifier and secret of the Google notification channel for your calendar, deleted when no booked call is left. Kept until you delete the contact or your account; the event itself stays in your Google Calendar.
• Free or busy blocks. Used at the moment the app drafts the times you offer and not stored. The times you choose to offer become part of the email you send, which is kept like any other email you send.
• Your Google access and refresh tokens. Encrypted at rest, used only to call the Gmail and Calendar APIs on your behalf, and deleted when you disconnect Google or delete your account.

We do not copy, mirror, index, or maintain a permanent archive of your Gmail mailbox, and we do not retain Google data beyond what is described above.

2. Limited Use of Google user data

3. How artificial intelligence is used

OfferFlow uses Anthropic's Claude API to draft your emails, to classify replies, to read your resume, to turn what you tell it into resume lines, to write a short answer to "tell me about yourself" for your call preparation, if you ask for one, to work out a company's email domain from its name (and, when it is finding one person's address, that person's title and city), and to answer your questions about your own data inside the app. To do this, the following is sent to Anthropic: the draft or reply text being worked on; the contact's name, title, company, and city; the text of your resume; the writing sample, school, major, hometown, and preferences you gave OfferFlow; if you have not given OfferFlow emails of your own, up to three first emails you rewrote and sent, as described under Learning how you write; anything you wrote about that contact, such as a personal note, who introduced you, or your notes from a call; the kind of a reply and the day it named, and the first name of someone a reply pointed you to, when your answer to it is written; the next step and what you learned from your record of a call, when a reminder email is written; and, for a question you ask in the app, the records of yours it needs to answer it.

Replies you receive. When a contact replies, the text of that reply (without the earlier messages quoted under it), its subject, the contact's name, your name, when it arrived, and your and the contact's time zones are sent to Anthropic, which returns the kind of reply and the details in it, including the days and times they asked you to offer. OfferFlow stores that result, not the reply. When you answer a reply with your availability, the same reply text is sent once more so that one sentence of your answer can thank the contact for anything they offered or advised (and, for a reply that arrived before September 28, 2026, so the days and times it asks for can be read); that sentence becomes part of your draft, and the reply itself is still not stored. Delivery failure notices, automatic replies, and replies you write yourself are not sent.

Learning how you write. When OfferFlow writes a draft, it keeps a copy of the version it wrote with that draft. If you change the draft before you send it, the version it wrote and the version you sent are kept together as a pair. At most once a day, the text of your most recent pairs (up to 30) is sent to Anthropic, which returns short notes on how you like to write. Before the text is sent, our code takes out the names of the people you wrote to, your own name, and the email addresses, phone numbers and web links it recognizes; something it does not recognize, such as the name of another person you mention, can remain. Those notes are used only to write your own drafts; they are never shown to or used for anyone else. No model is trained or fine-tuned on your data and nothing is combined across students: the notes are plain sentences kept with your account. If you have not given OfferFlow emails of your own to write like, and you have rewritten and sent at least three first emails to at least two different people, up to three of those emails as you sent them are also sent to Anthropic each time OfferFlow writes a new first email for you, as examples of how you write. Before they are sent, our code takes out the names of the people you wrote to and of anyone who introduced you, their companies, schools and past employers, and the email addresses, phone numbers and web links it recognizes; your own name, school, employers and hometown stay in, because they are yours. Something it does not recognize, such as the name of another person you mention, can remain. To have one email written OfferFlow's way instead, tap Write it OfferFlow's way under it. Turning off Learn from my edits stops this for every new email; an email already written stays as it was written. The pairs and the kept copies are deleted after 365 days, or sooner when you delete the contact or your account, and the notes are deleted with your account. In the pilot version of the app, this is part of using Claude: the Claude screen described below says so, and choosing OK there turns it on, unless you had already said no to it or turned it off. Otherwise, and for an account that answered the Claude screen before it said so, the app asks you once, with Turn it on and Not now. Pairs are kept and sent to Anthropic only while you use Claude (you chose OK on the Claude screen described below, or your account is older than that screen and you have not answered it yet). You can turn it off at any time with Learn from my edits, in Preferences › Privacy (in the pilot version, Settings › How your emails are written); from then on no new pairs are kept and nothing is sent to Anthropic for learning. In the pilot version, after you send an email you changed, the app can ask on your phone whether to do the same in every email (for example your greeting, or where the sentence about your experience ends). To ask, it compares what it wrote with what you sent: the greeting and sign-off it used and, while Learn from my edits is on, the kept copy described above. Nothing about that comparison is sent to Anthropic. The question is kept with your account, with the words it asks about (at most eight words of the email you sent), until you answer it or it no longer applies. Only Yes saves a preference; Just this one saves only a count. You can undo a saved preference with Back to how the app writes them.

Your 30-second story. If you ask OfferFlow to write your answer to "tell me about yourself", your first name, school, major, graduation year, the focus you picked in setup, whether you asked your emails to be more casual or more formal, and, for your three most recent experiences, the role, the employer and up to three of its resume lines are sent to Anthropic, which returns a short paragraph. Nothing about the people you contact is sent. OfferFlow keeps that paragraph with your account, shows it only to you on your call preparation sheets, and deletes it when you delete your account. You can edit it or write your own instead, and nothing is sent when you do.

Your choice. Before anything of yours is sent to Anthropic, the app asks you on a screen titled "Your emails are written by Claude". If you choose Not now, nothing of yours is sent to Anthropic: your drafts are written from your field's standard template, replies you receive are still matched to the person and shown in the app without being read by Claude, your resume is read only by our own code for its dates and roles, and resume lines, Ask FlowAI and sorting your imported connections' companies are off. You can change your answer at any time in Preferences › Privacy (in the pilot version, Settings › Privacy and Claude). Accounts created before September 29, 2026 keep using Claude until they answer, and are asked the next time they open the app.

Anthropic acts as our service provider. Under our commercial terms with Anthropic, your content is not used to train Anthropic's models. Anthropic processes the text, returns a result, and deletes it from its systems within 30 days, unless it is flagged under Anthropic's usage policy.

Gmail data sent to Anthropic. Gmail data is sent to Anthropic only to provide the OfferFlow features described in this section, such as sorting a reply and drafting your answer to it. It is never used to train any AI model, by us or by Anthropic. No person at OfferFlow or at Anthropic reads it, except as the Limited Use requirements in section 2 allow: at Anthropic, that means a small set of approved reviewers only when Anthropic's automated safety systems flag the content for possible abuse.

We do not use your Gmail content, your Calendar content, or your drafts to train any model of our own, and we do not build a shared model or shared dataset out of them.

Text inside an email you received comes from someone else and may contain instructions intended to manipulate an automated system. OfferFlow treats it as untrusted data: it strips hidden characters and anything that imitates its own instructions, marks the text as data the model must not follow, limits the model to a fixed set of answers, and checks every answer in code before using it. The most a reply can do is mark the contact as replied or as a no, fill in a meeting time, call length, time zone, or phone number, set a reminder for a day they named, or suggest a colleague for you to add. Nothing an incoming email says can cause OfferFlow to send a message, create an event, or change your settings. Only your tap can.

4. Data we collect that does not come from Google

Account and profile

Your name, email address, and the Google, Apple or Microsoft account identifier you signed in with. Your school, graduation year, major, hometown, time zone, the programs and employers you list, target industries, target cities, and target companies, if you enter them. Your resume files and their text, the writing sample you provide, your email signature with the phone number, LinkedIn link and portfolio link you choose to put in it, and your app settings. If you connect your own Apollo account, we keep your Apollo login email and user id and Apollo's tokens, encrypted, only to run the searches you ask for; they are deleted when you disconnect Apollo or delete your account. If you sign in with Apple, we also keep a token Apple gives us, encrypted, only so that deleting your OfferFlow account also removes OfferFlow's access from your Apple ID; it is deleted with your account.

Contacts and companies

The people and companies you add to OfferFlow: name, job title, employer, city, seniority, public professional profile link, business email address, and the notes, tags, and status you assign. Some of this comes from you, some from Apollo.io, a business contact database, when you run a search or look someone up, and some from Hunter (described below) when you search a company or, in setup, pick a field and a city. This is business contact information about other people, not data from your Gmail. If you import your own LinkedIn data export, OfferFlow keeps your connections (name, company, title, the date you connected, profile link, and email address when the connection shared it with you), your invitations with their messages, and the companies you follow, until you import again or delete your account.

Drafts, applications and the assistant

OfferFlow keeps the current draft for each contact, with your changes, and an email you schedule as you approved it (subject, text, time and time zone), until you delete the contact or your account. The job applications you track (company, role, stage, dates, notes, link and deadline) are kept until you delete them or your account. Your conversation with the in-app assistant, and the changes it made for you, are kept until you delete your account. If you tell the assistant how you want your emails to sound (for example shorter, more casual, or one short line in your own words), or answer Yes to a question the app asks after you send an email you changed, OfferFlow keeps that with your account and uses it each time it writes a draft for you: the way your emails should sound goes to Anthropic with each draft request, and the assistant is told a one-line description of what you saved. You can clear it in Preferences (in the pilot version, Settings › How your emails are written) or by deleting your account.

Reminders you set

You can set a reminder on anyone you have written to: a day, and if you like, one short line in your own words about what it is for (up to 120 characters). OfferFlow keeps the day and your line for you only: to show the reminder on that person's page and in your list of what is coming up, to bring it to Today and your morning brief on that day, and to write a short check-in email (written with Claude, as section 3 describes) for you to read and send. Your line is kept while the reminder waits and is deleted when you mark it done, remove it, or send the check-in, or when you delete the contact or your account. It is never shown to the contact or to another student; it reaches an email only through the check-in you read and send yourself.

Your calls

After a call you can keep notes and a short record of how it went: a rating from 1 to 5, the best thing you learned, whether they offered to introduce you to someone and to whom, the questions you asked, a next step with a date, what would help you next time, and whether they told you the firm is not hiring. This is your own record, shown only to you, and kept until you delete the contact or your account. OfferFlow uses it only for you: to write your thank-you and later emails, to remind you of a next step on the date you gave with a draft ready, to show you what earlier calls at the same firm taught you before your next one, and, after a low rating, to ask whether to keep in touch or put the contact away. Nothing you record about a call is shown to the contact, added to their record, or shown to another student.

For a call you meet in person (Outlook accounts), the place you type is kept with the call, put on the calendar invitation, and named in your confirmation email to the person.

Finding a business email address

When OfferFlow needs to work out a business email address for a contact, it first uses what it already knows about how that company writes addresses. When it knows nothing about the company, it asks Hunter (hunter.io), a service that indexes business email addresses published on the public web: OfferFlow sends the company's website domain, and for one named person the person's name (or, when it has no full name, the handle from their public LinkedIn link) and that domain, and Hunter returns the address pattern it has seen or the address it has found, with the public page it came from. Hunter does not receive your Gmail content, your mailbox, your drafts, or anything that identifies you. OfferFlow does not check an address with an outside service before sending. It sends to the address it has; if the message bounces, it learns from that, does not send to that address again, and offers you the next address to try where there is one.

People from Hunter on Find. When you name up to three companies on Find, OfferFlow also asks Hunter for people it found at those companies on the public web. It sends each company's web domain, how many people to return, and the level (junior, senior or executive) and kind of work you chose on Find; nothing that identifies you. For each person Hunter returns a name, job title, business email address, a LinkedIn link when it has one, a confidence score, and the public pages the address came from. OfferFlow keeps what your search returned with your account for 30 days, then deletes it; it is shown only to you, never to another student, and is deleted with your account. Otherwise a person becomes your contact only when you add them or open them.

Your first people, in setup (the pilot version of the app only). When you pick a field and a city in setup, OfferFlow asks Hunter the same way for people at well-known companies in that field. It sends each company's web domain, how many people to return, the junior level for most companies and, for most fields, the kind of work, and the city you picked with its state (and, if fewer than three people turn up there, the state alone for the remaining companies), and it asks only for people whose address Hunter has checked; nothing that identifies you. Hunter returns the same details as on Find. OfferFlow keeps the ones it shows you with your account for 30 days, then deletes them, and keeps the field and city you picked, which addresses it found and whether each lists your city or only your state, and how many times it ran this step (at most twice) (those addresses are cleared after 30 days; the rest is deleted with your account). It turns up to three of these people into contacts so it can write your first email (written with Claude, as section 3 describes); if you skip, those contacts and the email written to them are removed (what Hunter returned still goes after 30 days, as above).

Your Outlook account (the pilot version of the app only)

In the pilot version of the app, a student can connect a personal Microsoft account (Outlook.com, Hotmail or Live) as the mailbox OfferFlow sends from for people they have not written to yet. A conversation started in Gmail stays in Gmail while Gmail remains connected. OfferFlow shows what it will do before Microsoft's own consent screen, and asks Microsoft for these permissions only: sign in and your email address (openid, email), your name too when you sign in with Microsoft (profile), staying connected (offline_access), sending email as you (Mail.Send), reading your email (Mail.Read), and reading and writing your calendar (Calendars.ReadWrite).

In the pilot version of the app, you can also sign in with a personal Microsoft account. That one Microsoft screen asks for the same permissions listed above. When Microsoft is the only way your account signs in and no Gmail is connected, signing in also connects Outlook (if it cannot, Setup offers Connect Outlook). If your account already signs in another way or has Gmail connected, we keep nothing from that screen and your emails keep going out from the mailbox you already use; Setup still offers Connect Outlook. From the sign-in we receive your name and email address, as we do from Google or Apple.

With them, OfferFlow sends each email you approve, one at a time, either right away when you tap Send or at the time you chose when you tapped Schedule, from your Outlook account. Each of those emails carries a hidden header holding a random number, used only to find the sent copy in your Sent Items and learn its message and conversation identifiers; it does not report when anyone opens the email. OfferFlow reads only the conversations an OfferFlow email started, to see when the person replies (including automatic replies, delivery-failure notices, answers to a call invitation, and replies you wrote yourself in Outlook in those conversations). It reads the list of your calendars (only each one's identifier, whether you can edit it and whether it is your main calendar, never its name), then the start and end of the events on your main calendar and on each other calendar you can edit, and whether each one shows you as busy, to suggest times you are free; a calendar shared with you to view only, or one you subscribe to, is not read. When you book a call, it adds the call to your calendar as an invitation to the person (with the call's title, the time, where it happens: their number, your meeting link, your number if they call you, or the place you meet, and their title and company in the notes) and sends your short confirmation email to the person; it keeps the person's answer to the invitation, and a call moved or deleted in Outlook is moved or cancelled in the app. When you move or cancel that call in the app, it changes or cancels that one invitation, with any note you type, and Microsoft tells the person. It never opens the words of any other email and reads no other calendar detail. It is not used to search, index, browse, back up or export the rest of your mailbox or calendar.

We store: your Outlook address; a refresh token, encrypted with a key held in Supabase Vault, separate from Google's, so OfferFlow stays connected, with the permissions you granted, when it was last renewed, and the last connection error; the identifiers of the emails OfferFlow sent, of the replies in those conversations, and of the calendar invitation OfferFlow created (with its link, so you can open it in Outlook); the meeting link you save for video calls, if you save one; an identifier and a secret for the notification subscription that tells OfferFlow a new message arrived in your Inbox (Microsoft's message says only that a message arrived, with its identifier, never its content; OfferFlow does not keep it and then checks only its own conversations); and the same records described in section 1 for replies in Gmail threads, not the reply's words. OfferFlow reads each reply when it arrives, in memory, to sort it, and reads it again when you open it; its words are not stored. To classify a reply and to write one sentence of your answer, its text goes to Anthropic exactly as section 3 describes for Gmail.

Microsoft's data is used only to provide these features to you. It is never sold, never used for advertising, never used to train AI, and never shown to other students. The only things derived from it are that an email got a reply, which counts in the reply-rate totals described in "What is shared with other OfferFlow students" below, and a school a contact mentioned in a reply, only after you confirm it. Nothing about how a company writes addresses is learned from your Outlook mail itself (the address check before an email goes works as described above for every student). Disconnecting Outlook deletes the token and the notification subscription; the identifiers of your emails, replies and invitations stay with those records until you delete the contact or your account. Deleting your account deletes all of it (section 7).

Notifications

If you allow notifications on your iPhone, OfferFlow stores a push token (a code that identifies your phone to the notification service) and your notification settings, and uses your time zone. These kinds of notification are on unless you turn them off:

• Reply alerts. When a contact writes back or picks a time. There is no alert for a reply that says no, or for a reply the app first sees more than a day after it arrived.
• Invite answers. When a contact accepts, declines, says maybe or proposes a new time for a call invite OfferFlow created for you.
• Morning brief. Only on days something needs you, at the time you choose (8 AM unless you change it): how many replies are waiting, follow-ups are due and calls are that day, and whether applications are open in your field.

Newer versions of the app add more alerts, also on unless you turn them off: a reminder 30 minutes before a call (their first name, their firm and a link to your prep sheet), a note when a call has ended that your thank-you is ready to write, a note when a follow-up comes due, a note when an automatic out-of-office reply says when they are back, a note when an email bounces, and a note when an email you scheduled could not be sent. Each kind has its own switch, and one switch turns them all off. Between 10 PM and 7 AM your time, an alert waits and comes with your morning brief, or on its own after 7 AM if the brief is off; a call reminder, a declined invite and a proposed new time come on time.

A notification can show a contact's first name and firm, a time they proposed or the time of your call, the day they are back from an out-of-office reply, your first name, and those counts, and it can appear on your lock screen. Notifications are delivered through Expo's push service and Apple's Push Notification service, which receive your push token, the notification's title and text, and the link to the screen it opens in the app, and nothing else. We keep a record of each notification (its title, its text, and whether it was sent) so the same one is never sent twice; it is deleted when you delete the contact it is about, or your account. To turn a kind of notification off, tap the profile circle in the app and open Notifications (in earlier versions, Preferences, then Notifications). You can also turn off all OfferFlow notifications in your iPhone's Settings. Your push token is deleted when you delete your account.

Usage and diagnostics

Basic operational records: sign-in events, which features you used, counts of emails sent and replies received, error and crash information, device type, and app version. We use these to keep the app working, to show you your own statistics, and to detect abuse.

The weekly summary. If you are in our pilot, once a week the founder receives an email with your first name, how many emails you sent, replies you received and calls you booked in the past week and in total, whether your Gmail connection needs fixing, and when you last opened the app, so we can help when something is stuck. It never includes a contact's name or anything you or they wrote.

Report a problem. When you tap Report a problem and then Send, the app sends us a screenshot of the screen you were on, the name of that screen, a short record of what you did in the app in the minutes before (the screens you opened and any errors), your app version and device type, and the note you type. The screenshot shows whatever was on that screen, which can include a contact's name or an email you were writing. We use reports only to find and fix the problem, and we delete each one within 90 days. Nothing is sent until you tap Send.

Feedback you give us. A few days after your first email, OfferFlow asks once how it is going, with a rating from 1 to 5 and room for a comment. If you answer, we store the rating, the comment you type, if any, and when you answered, and we never ask again. If you tap Not now, we store only that we asked and when; we ask again no sooner than a week later, and never more than three times in all. Only the developer reads your answers, and we use them only to improve OfferFlow. Nothing is sent until you tap Send. We keep your answers until you delete your account.

OfferFlow does not track whether a recipient opened your email. There are no tracking pixels, no read receipts, and no link tracking in messages you send.

The early access list

If you ask for early access on joinofferflow.com, we store the name, email address and school you type, the time you asked, and which version of the page you used. To stop automated sign-ups, we also keep a scrambled, one-way form of your IP address (a keyed hash, not the address itself) and delete it within two days. We use the list only to invite you to the OfferFlow pilot and to tell you when OfferFlow opens. It is stored in our database (Supabase), and the only person who sees it is the founder, Matt Finlay: on an owner-only page in the app, and in a daily email of new sign-ups (each person's name, school and email address) sent to him through Resend, our email provider. We do not share the list with anyone else or use it for advertising. We keep your entry until you ask us to remove it, or until we have invited you and OfferFlow is open to you, whichever comes first. To be removed, email support@joinofferflow.com and we will delete your entry within 30 days. This list is separate from an OfferFlow account: joining it does not create an account or connect anything to your Google account.

What is shared with other OfferFlow students

Almost everything you put into OfferFlow is visible only to you. The exceptions are listed here. None of them shows another student your name, your contacts, your emails, or your notes.

How companies write email addresses. When an email sent through OfferFlow is delivered, bounces, or gets a reply, when an address check comes back valid, or when Hunter finds a company's pattern, OfferFlow learns how that company writes addresses, for example first.last. That pattern is shared, so the next student writing to that company starts from a better guess and does not repeat a guess that bounced. Other students get only the company's pattern. They never see the person it was learned from, that person's address, or you.

Reply rates. OfferFlow shows how often emails got a reply at a firm and for each kind of reason to write, such as a shared hometown or school, as totals across OfferFlow users. A rate appears only once it covers at least five emails. It is a number and a sample size, never a list of who wrote or who replied.

School marks. OfferFlow can show that a professional went to a particular school, so that students from that school can find alumni. None of the services we use supplies anyone's education, so these marks come only from students. You add one when you answer "Did they go to [your school]?" on a contact (Yes records your school; No, with the school they did attend picked from a list of US colleges, records that school; Not sure records nothing), when you mark someone as Same school, when you choose Same school as your reason for writing, or when a contact says in a reply where they went to school and you confirm it. We store the school, the contact's public professional profile link or business email address so the mark attaches to the right person, how the mark was made, and which students reported it. Students whose own school matches see the mark on that person with "reported by N OfferFlow users". They never see who reported it. Nothing else from your contact record or from the reply is shared, only the school. If you tap Not right? on a mark, we record that you disputed it. The mark stops showing to you, and a mark disputed by more students than reported it stops showing to anyone. You can remove your own report on the contact at any time. Deleting the contact or your account removes your reports, and a mark no one else reported is deleted.

Application dates. When you add when applications open at a company (for example after a call), OfferFlow keeps the company, the program, the type of job, the year, the office if you name one, and the date, with how many students gave that date, and shows them to other students, never with your name or anything from your call (from two reports on, as "reported by N students"). Your own report is kept with your account so you can change or withdraw it, and it is removed when you delete your account. A shared date stays while another student's report of it stands, and is deleted when no report is left. A date more than 60 days past stops showing but is kept. When OfferFlow asks whether you applied to a company, it keeps the company, your answer (applied, not yet, or not applying), when to ask again and how many times it has asked, with your account, so it does not ask twice. Not applying also stops the reminders when applications open at that company.

5. Who we share data with

We do not sell your personal information, and we do not share it with advertisers or data brokers. Apart from what is shared with other OfferFlow students, described at the end of section 4, we share data only with the service providers below, only to the extent they need it to run OfferFlow, and only under contracts that require them to protect it and use it for nothing else.

We may also disclose information if we are legally required to, to enforce our terms, to investigate fraud or abuse, or to protect someone's safety. If OfferFlow is ever acquired or its assets are sold, Google user data will only transfer with your explicit prior consent, and we will tell you before that happens.

6. Security

• All data is encrypted in transit using HTTPS and TLS.
• All data is encrypted at rest using industry-standard encryption.
• Google access and refresh tokens are encrypted at rest with keys held in a managed key service, separate from the database, readable only by our server functions, and never written to logs. The token passes through the app once, at the moment you connect, and is not kept on your phone.
• An Outlook refresh token is encrypted in the same way, with its own key, and is readable only by our server functions. When you sign in with Microsoft, the token passes through your phone once and is not kept there.
• Database access is restricted per user by row-level security, so your records are only readable by your own authenticated session.
• Access to production systems is limited to the developer, protected by multi-factor authentication, and logged.
• We keep dependencies patched and follow the OWASP Top 10 in how the app and its server functions are built.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you and the relevant authorities as required by law, and we will notify Google.

7. Deleting your data

You are in control of all of it, and you do not have to email us to get rid of it.

• Disconnect Google. In the app, tap the profile circle, open Setup, then Connections, and tap Disconnect under Gmail and Calendar. This revokes OfferFlow's access, deletes your stored tokens, and stops all reading and sending immediately.
• Disconnect Outlook. In the app, tap the profile circle, open Setup, then Connections, and tap Disconnect under Outlook. This deletes your stored Outlook token and its notification subscription, stops all reading and sending through Outlook at once, and returns your sending to Gmail (connect Gmail in Setup to keep sending). You can also remove OfferFlow's access at account.live.com/consent/Manage.
• Delete one thing. Deleting a contact deletes the messages, reply records, notification records, notes, and records of calls attached to it, and any school mark you reported about that person.
• Delete your account. In the app, tap the profile circle, open Account, and tap Delete account. This permanently deletes your profile, contacts, messages, reply records, notification records, call records, feedback you gave us, school reports, resumes, writing sample, settings, push token, and tokens. A school mark that only you reported is deleted; one that other students also reported stays, without your report. It takes effect immediately in the app and is fully removed from our systems, including encrypted backups, within 30 days. It cannot be undone. If you signed in with Microsoft or connected Outlook, you can also remove OfferFlow's access at account.live.com/consent/Manage.
• Revoke from Google directly. You can remove OfferFlow's access at any time at myaccount.google.com/permissions, independently of us.

Deleting your OfferFlow account does not delete the emails themselves from your Gmail, or the events from your Google Calendar. Those are yours and stay in your Google account. You can also email support@joinofferflow.com to request deletion, or to request a copy of your data, and we will respond within 30 days.

We keep a minimal record of billing transactions where we are required to for tax and accounting purposes. That record contains no Google data.

8. Your rights

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, to limit how we use it, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. To exercise any right, use the in-app controls above or email us. We will not charge you and we will not ask you to give up anything in return.

9. People you contact

OfferFlow stores business contact information about the professionals you reach out to, because you need it to write to them and to keep track of your own correspondence. If one of those people asks us to delete what we hold about them, email support@joinofferflow.com and we will remove them from our systems. This includes any school mark students reported about them, which we remove for every student. You remain responsible for what you choose to send and to whom, as described in our Terms of Service.

10. Children

OfferFlow is built for college students and is not directed to children. You must be at least 18 years old to use it. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. A parent or guardian who believes we hold information about someone under 18 should email support@joinofferflow.com.

11. Where data is processed

OfferFlow is operated from the United States and your data is stored and processed in the United States. If you use OfferFlow from outside the United States, you are sending your information to the United States for processing.

12. Changes to this policy

If we change how we use your data, we will update this page, change the date at the top, and tell you in the app before the change takes effect. Where a change means we would use Google data for something new, we will ask for your consent again rather than assume it. We will never use data we already collected in a way that this policy did not permit at the time we collected it.

13. Contact

OfferFlow LLC
Email: support@joinofferflow.com
Web: joinofferflow.com

We answer privacy and deletion requests within 30 days.