What NightApply keeps, and why

What we store

• Your account: email address, name, sign-in sessions, and, if you sign in with Google, the Google account id and profile picture Google returns.
• Your questionnaire and profile: the answers you give about your work status, preferences, location, work authorisation, salary floor and target roles, plus the profile text extracted from your resume.
• Your resumes: the PDF files you upload and the text read from them.
• Your answer library: the answers to application questions you write or approve, reused on later forms.
• Postings and applications: the job postings matched to you, the match assessment, every cover letter and form answer prepared, and a screenshot of each form as it was submitted, so you can see exactly what went out in your name.
• Mail: if you create a job-search address at kamelamail.com, the messages sent to it (sender, subject, body, attachments), the replies you send from it, and the label we attach (interview, rejection, confirmation). If you connect Gmail, the app password you enter (encrypted at rest) and the messages it reads, read-only, from the last few days.
• Activity: a log of what the service did on your behalf (postings found, matches made, applications sent, errors), your notifications, and your credit balance and its history.
• Payment: if you buy a plan, the plan, its Stripe customer and subscription ids and its renewal date. Never your card number; Stripe holds that.

Why

To do the job you signed up for: find roles that fit you, write applications from your real record, submit them where you allow it, and sort the replies. Nothing is used for advertising, sold, or shared with anyone but the company you are applying to and the processors below, who work only on our instructions.

Who else sees it

The companies you apply to receive the application: your details, the cover letter, the answers and the resume, through their own form. Beyond them, these companies process data for NightApply:

• Vercel serves the website and the sign-in; Frankfurt, Germany (EU).
• Neon holds the database: your account, profile, answers, postings, applications and mail; Frankfurt, Germany (EU).
• Fly.io runs the background worker that finds postings, writes and submits applications and sorts mail; Frankfurt, Germany (EU).
• Tigris stores files: resumes, form screenshots, mail attachments and the nightly database backup, encrypted at rest; object storage on Fly.io.
• Anthropic processes the text of postings, your profile, your resume and your answers to score matches and write letters and form answers; under its API terms this data is not used to train its models; United States.
• Hyperbrowser runs the browser in which the worker fills a company's form; during that session it handles the form, your answers and the resume being attached; Europe.
• Resend delivers mail to and from your job-search address, and the emails NightApply sends you; European Union region.
• Sentry receives error reports: what failed, on which page or step, and the account id; never form contents, resumes or mail; European Union region.
• Stripe handles payment when you buy a plan; NightApply never sees your card number; Stripe's own infrastructure; only if you buy a plan.
• Google sign-in with Google, or reading your Gmail if you connect it; Google's own infrastructure; only if you choose it.

Anthropic is in the United States, so the text it processes (postings, your profile and resume, your answers) leaves the European Union for that step, under Anthropic's data processing terms and the EU's standard contractual clauses. Everything else stays in the EU.

The browser extension

The NightApply Chrome extension fills an application form in your own browser with the answers your account prepared, attaches the resume you chose, and reports the outcome back to your account. It runs on the listed job-board domains and on nightapply.com, reads only the form on the tab you asked it to fill, and talks only to nightapply.com using the sign-in you already have there. It never submits a form; you click Submit. It stores nothing outside your browser except what it sends to your own account.

Where and how long

The website, the database and the worker run in Frankfurt; files are stored encrypted at rest. Data is kept for as long as your account exists. Sign-in sessions expire after ninety days; one-time sign-in links after fifteen minutes. A questionnaire started and abandoned without an email address is deleted after three days. A nightly backup of the database is kept for a month and then overwritten.

Your choices and rights

• Export: Account → Export gives you everything we hold about you as one file (profile, answers, resumes, applications with their letters and answers, postings, mail), or the jobs and mail as spreadsheets.
• Delete: Account → Danger zone deletes your account, files, screenshots and mail. Your job-search address is retired and not given to anyone else.
• Notifications: every email category can be switched off under Account → Notifications; check-in emails carry a one-click unsubscribe link.
• Questions or requests about your data: privacy@kamelamail.com. You can ask us to correct, hand over or erase what we hold about you, and you can complain to the data protection authority where you live; for Slovenia that is the Information Commissioner (Informacijski pooblaščenec).

Cookies

One cookie keeps you signed in. Two short-lived cookies carry the state of a Google sign-in for ten minutes. There are no advertising trackers and no cookie banner, because none is needed. Page views are counted by NightApply itself, without a cookie: the page address, the site you came from, and a hash of your address and browser that changes every day, kept for 180 days.