You're trusting us with your inbox. Here's how we treat it.
JobPluck sends email as you, so the bar is high. This page lists what we access, how it's stored and how to switch any of it off. Everything here describes how the product works today.
Principles
- 01Least access
Only the Gmail permissions needed to send, read replies and label.
- 02Yours alone
Every record is tied to your account and filtered by it.
- 03Encrypted
Mailbox tokens with AES-256-GCM; passwords hashed with Argon2.
- 04Reversible
Disconnect, pause, unsubscribe or delete whenever you want.
Mailbox tokens are encrypted at rest.
The tokens that let JobPluck send on your behalf are encrypted with AES-256-GCM before they are saved. The key is kept in the server's secrets, separate from the database. If a token stops working, automation pauses and you're asked to reconnect.
Your data answers only to your session.
Every resume, match, application, message and setting carries your user id, and every query is filtered by the id from your signed-in session. Asking for someone else's record returns “Not found”.
Your resume is private storage, not a public link.
Resumes are kept in private object storage under a random 128-bit name. They are never served from a public URL: the API streams the file to you after checking it's yours. Deleting a resume removes the file too.
The basics, done properly.
Passwords are hashed with Argon2. New accounts verify their email with a 6-digit code. Sessions use short-lived access tokens with rotating refresh tokens, and login and code requests are rate-limited.
Every automated step has a name on it.
Each status change on an application is recorded with who or what made it: you, the sender, or a specific reply rule. The conversation view shows it, so an automatic email is never a mystery.
Everyone in the loop can say stop.
Recruiters who ask not to be contacted are never emailed from your account again. Bounced addresses are blocked for everyone. You can turn off any email type in one click, and people who posted a job can ask for it to be removed.
Security & privacy, answered
Can JobPluck read all my email?
Gmail's permission is account-wide, but JobPluck only fetches and stores messages on the threads it started for your applications. Nothing else from your inbox is saved.
Who can see my resume?
Only you, through your account. When you apply, it's attached to the email you send to that recruiter. It is never published or shared anywhere else.
How do I delete my data?
Delete your resume from your profile at any time, and disconnect your mailbox from Settings. To delete your whole account, write to info@jobpluck.com from your account email and we'll remove it.
Is JobPluck affiliated with LinkedIn?
No. JobPluck isn't affiliated with or endorsed by LinkedIn. Every job links back to the public post it came from. If you posted a job and want it removed, write to info@jobpluck.com.
How do I report a security issue?
Email info@jobpluck.com with the details. Please don't test against other people's accounts; we'll reply and keep you updated until it's fixed.
Start with full control.
Both automation switches start off. Connect your mailbox, look at a few drafts, and decide how much JobPluck should do for you.