Privacy Policy

What this covers

How Y.EAA handles information about you: what it collects, what it does with it, who else touches it, and how long any of it stays. It covers the Y.EAA web application and the opportunity-search service behind it. The manual extension and application-linked contacts/drafts have a supplemental notice at https://yeaa.app/legal/extension-privacy, including browser-local copies and connected website saves.

Your resume and your answers are core job-search inputs, so most of what follows exists to keep them yours. Optional manual contact notes and outreach drafts are additional inputs described in the extension notice.

What we collect

Account and identity: your email address, and an internal identifier we generate for you. If you sign in through an identity provider we record that the provider vouched for you — never their credentials, and never ongoing access to that account. Signing in with Google gives Y.EAA no access to your Google account.

Your resume: the file you upload, and the structured profile extracted from it — contact details, work history, education, skills.

What you are looking for: saved roles, salary and location preferences, and your answers about authorisation to work.

Reusable answers: the answers you write once and reuse across applications, kept separately from any answer already submitted.

Your activity: the searches you ran, the opportunities found for you, why each was ranked as it was, and the applications you tracked.

Operational records: request identifiers, timings, error reports, and sign-in events, kept so a failure can be diagnosed.

What we do with it

Run the product for you — search, rank, explain, prepare, and track.

Keep your account secure and your sessions revocable.

Find and fix failures, and keep the service running.

Process purchases, record credits, reconcile transactions and handle support requests.

Nothing else. We do not build an advertising profile of you and we do not use what we hold to market other products at you.

What we never do

We do not sell your personal information, and we do not share it for advertising of any kind.

We run no analytics, advertising, or session-recording trackers. There are none in the product to turn off.

We do not use your resume, your answers, or your applications to train our own models.

We do not fetch a document from a web address you hand us. A resume reaches us because you uploaded the file, which is a narrower and safer capability than following a link.

We do not put resume text, your answers, or application content into operational logs. An error report carries a one-way digest of your account identifier, the route that failed, and which release it failed on — never content.

Artificial intelligence, and what leaves our systems

Reading a resume, and drafting an answer for you, are done by a large-language-model provider we send the relevant text to. That provider is currently DeepSeek.

Only what a task needs is sent so the result can be returned to us. The provider handles information under its applicable terms and settings; we do not promise that provider-held copies are erased immediately when website data is deleted.

Anything a model produces about you is a draft attributed to the model, never a fact about you. Where the product shows a claim as coming from your resume, it can point at the passage it came from.

Who else handles it

Listed by the job they do, because that is what determines what they see: a hosting and database provider; private object storage for the files you upload; an email service that delivers sign-in codes; whichever identity provider you choose to sign in with; the AI provider named above; an error-reporting endpoint; and Stripe for payment processing.

These providers handle information to provide their services. Their privacy notices and contractual terms describe their processing and retention. Payment processing can also involve the processor's fraud-prevention and legal obligations.

We will also disclose information where the law requires it, and we will tell you when we are permitted to tell you.

Where it is stored

In managed services we contract for, in the regions those services run in. Some of the providers above operate outside your country, so your information may be processed elsewhere. Where the law requires a safeguard for that transfer, we put one in place.

How long we keep it

Your resume, profile, saved roles, answers, search and application history, and saved manual workspaces stay while your account is open unless you remove them or request deletion. Email ye.xinnan@yeaa.app for account closure or personal-information deletion. Support verifies identity and the scope, explains the result and any applicable limitation. There is no immediate automatic account-erasure feature.

A payment or credit record does not automatically exclude all your personal information from deletion. Particular records may need limited retention to resolve a transaction, meet legal obligations, protect security or address a legal claim. We explain what is retained and why; this is not a reason to keep unrelated job-search materials indefinitely.

Operational records are kept only as long as they are useful for diagnosing faults, then discarded. Limited request and response records are retained where required by applicable law; this does not justify keeping unrelated resumes.

Database records, uploaded files, service-provider copies and backups have different cleanup processes. We do not report a requested scope as fully erased before its applicable checks finish. Backups and provider-held copies may follow separate retention or deletion processes. Website deletion does not clear browser-local extension data or copies you supplied to employers or other third parties.

Your choices

You can see what we hold, correct it, take a copy of it, and have it deleted. Most of it you can reach and change inside the product; for the rest, ask us.

Email ye.xinnan@yeaa.app to request deletion, a copy or correction. We verify identity before acting, and arrange an appropriate secure delivery method for copies. Authorized representatives may contact us on your behalf; we may check authorization and identity as permitted by applicable law.

Depending on where you live you may have further rights — to object, to restrict how we process something, or to complain to a regulator. Using any of them costs nothing and we will not treat you differently for it.

Automated decisions

Y.EAA ranks opportunities against your profile and judges whether an application is one it could fill. Those automated decisions shape what you are shown; they produce no legal or similarly significant effect on you, and no employer's decision is made by us.

An action with consequences — one that reaches an employer or spends your money — is never taken automatically on the strength of an account-level setting. It requires a confirmation from you for that action, checked on our servers at the moment it runs.

Keeping it safe

Traffic is encrypted in transit. Uploaded files are held in private storage, are checked against a size limit and confirmed to be the file type they claim to be, and the links that reach them are short-lived.

Every record is read through a query already narrowed to your account, so another customer's row is never loaded and then filtered out — it is never loaded.

Sessions are records in our own database rather than self-contained tokens, which is what makes signing out a revocation that takes effect on the next request.

Children

Y.EAA is for adults looking for work. It is not intended for anyone under 16, and we do not knowingly collect information from them.

Changes to this policy

This policy is versioned. This is version 2026-10-11T23:17:00+09:00. This update describes payment processing, manual privacy requests, retention limits and provider-held copies. It does not authorize unrelated data uses or change configured prices, credit amounts or validity periods. It does not require account-wide re-acceptance.

When we publish a new version we state whether it requires your agreement again, and where it does, the actions that depend on it pause until you give it while the rest of your account carries on working.

Contact

Questions, or a request about your information: ye.xinnan@yeaa.app.