Privacy Policy
Last updated 23 September 2026
Who we are
Thuolo is operated by Davis Oduor, based in California, United States (“we”, “us”). We are the data controller for the personal data described here. You can reach us at doduor@sfsu.edu.
What we collect, and why
Account
| What | Why |
|---|---|
| Email address | To sign you in, verify the address, reset a password, and send the alerts and reminders you ask for. |
| Password | Stored only as a bcrypt hash. We cannot read it. |
| First and last name (optional) | Shown on the resumes the Resume Studio builds for you. Nowhere else. |
| Google account identifier | Only if you sign in with Google: the identifier Google returns, so we can recognise you next time. |
| A generated pseudonym | Used in place of your name in Jothuolo community threads. You do not choose it and it is not linked to your name anywhere a reader can see. |
| Time zone (optional) | So alerts are not sent to you between 10pm and 7am. |
| School email address (optional) | Only if you ask for student pricing. We store the address you claim, the part after the @, and whether the link we sent to it was followed - so the discount can be checked and re-checked once a year. It is never used to email you anything else, and never shown to anyone. |
| Plan and credit history | Which plan the account is on, and one row per AI action recording the feature, the credits it cost and how many tokens the model used. It is how the allowance on your Billing page is calculated and how we know what the service costs to run. It records that an action happened, never what you wrote in it. |
Profile
| What | Why |
|---|---|
| Headline, experience level, skills, target cities | The inputs to the match score and to search filters. |
| Resume text | Pasted by you, or extracted from a PDF you upload. The PDF itself is not stored; only the text we extract from it is. It is the basis for the match score, the Resume Studio and the interview coach. |
| LinkedIn profile text (optional) | Only what you paste in. We have no connection to LinkedIn and never fetch anything from it. |
| A numeric embedding of your profile | A list of numbers derived from the text above, used to rank jobs by similarity. It cannot be turned back into your resume. |
Activity
| What | Why |
|---|---|
| Jobs you save, their stage, your notes and checklist items, and when each stage changed | This is your pipeline. The timestamps produce your reply rate and “going cold” reminders. |
| Saved searches and alert settings, and a record of which alerts were sent | To send each alert once and never twice. |
| Posts, comments and votes in Jothuolo | Shown to other signed-in users under your pseudonym. A post can carry a badge saying which stage of that company’s process you reached, taken from your own pipeline. Nothing else about you is shown. |
| Messages you send to the copilot and the interview coach | Sent to the AI provider to generate a reply. The copilot’s job searches are run against our own database. Conversations are not stored after the session ends. |
| Feedback you submit | Read by us to improve the product. Feedback can be sent anonymously. |
| Reports of posts or comments | To moderate the community. |
Gmail (optional, off by default)
If you connect Gmail, we ask Google for read-only access and store the refresh token Google gives us, encrypted at rest. A few times a day we search your recent mail for messages that look like interview scheduling (a keyword filter such as “interview” or “phone screen”, restricted to the last three days) and send only those candidates to the AI provider to classify. When one matches a company in your pipeline, that application is moved to Interviewing and a one-line note is added. We do not read, store or index anything else in your mailbox. Disconnect at any time from the Profile page; this deletes the token immediately.
Thuolo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Technical
Our hosting providers keep standard server logs (IP address, browser type, the pages requested and when) for security and debugging. We rate-limit requests by IP address to protect the service; those counters expire within an hour. We do not use analytics scripts, advertising pixels or fingerprinting.
Cookies and local storage
Thuolo sets no tracking cookies. Your sign-in session is a token kept in your browser’s local storage, along with small conveniences such as which matches you have already seen. Signing out removes the token. Google Sign-In, if you use it, sets its own cookies under Google’s policy.
Who else sees your data
We share data only with the providers needed to run the service, each bound by its own terms:
- Anthropic (United States): receives resume text, LinkedIn text, job descriptions and your messages to power resume parsing, the Resume Studio, the LinkedIn Analyzer, the copilot, the interview coach and the classification of interview emails.
- Voyage AI (United States): receives profile text to produce the embedding used for matching.
- Google: only if you sign in with Google or connect Gmail.
- Resend: delivers our emails (verification, password reset, alerts, reminders).
- Railway (United States): hosts the API and the database.
- Cloudflare and Vercel: host and serve the web app.
We do not sell personal data and we do not share it for cross-context behavioural advertising. We will disclose data if the law requires it, and we will tell you when we are allowed to.
Job listings
The jobs on Thuolo come from employers’ public applicant-tracking boards (Greenhouse, Lever, Ashby) and from public aggregator feeds (RemoteOK, Arbeitnow, Jobicy). Company logos are fetched once and stored by us so that browsing the board does not tell a third party which employers you look at. Applying always happens on the employer’s own site, under their privacy policy.
How long we keep it
- Account and profile data: until you delete your account.
- Pipeline, alerts, posts and comments: until you delete them or your account.
- Gmail token: until you disconnect Gmail or delete your account.
- Feedback: kept after account deletion, with the link to your account removed.
- Backups: our database backups roll off on a normal rotation of at most 30 days.
Your rights and controls
You can do all of the following yourself, without asking:
- Edit or clear any profile field, including your resume text, on the Profile page.
- Disconnect Gmail on the Profile page.
- Turn off or delete any alert on the Profile page, or use the one-click link in any alert email.
- Delete your account on the Profile page. Your profile, pipeline, alerts and Gmail token are deleted immediately; posts and comments are removed from view.
You can also email us to ask for a copy of the data we hold about you, to correct it, or to have it deleted. We answer within 30 days and will not ask you why. If you are in California, these are your rights under the CCPA/CPRA; if you are in the European Economic Area or United Kingdom, they are your rights under the GDPR, and our legal basis for processing is the contract with you (running the service you signed up for) and, for Gmail, your consent. You also have the right to complain to your local data protection authority.
Where the data lives
Our servers and providers are in the United States. If you use Thuolo from elsewhere, your data is transferred to and processed in the United States.
Security
Passwords are hashed with bcrypt. Gmail tokens are encrypted at rest. All traffic is over HTTPS. Access to production systems is limited to the operator. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly.
Age
Thuolo is for people looking for work and is not directed at children. You must be at least 16 to use it. We do not knowingly collect data from anyone under 16; if you believe we have, email us and we will delete it.
AI features
Match scores, resume drafts, LinkedIn suggestions, interview feedback and copilot replies are generated by AI models. They can be wrong. They are a starting point for your judgement, not a decision about you, and no automated decision on Thuolo has a legal or similarly significant effect on you.
Changes
When this policy changes, the date at the top changes with it. If a change affects what we collect or who we share it with, we will email you before it takes effect.