Privacy Policy

This policy applies to the hosted version of Carpetless operated by the developer reachable at degenhardt.adam@gmail.com.

Carpetless can also be self-hosted. If you are using an installation that somebody else runs, that operator controls the database and is responsible for the data in it, not us.

Carpetless holds only the following, all tied to your account:

• Your account — name, email address, and a bcrypt hash of your password. Plain passwords are never stored.
• Connected sending accounts — for Gmail, the address and a refresh token; for SMTP, the host, port, username, and password. Tokens and SMTP passwords are encrypted with AES-256-GCM under a key held outside the database.
• Resumes — the files you upload, stored as bytes in the database, with their filename, type, and size.
• Templates — the subject and body text you write.
• Campaigns — the company domain and role you entered, a snapshot of the subject and body actually used, and a record of each recipient address with its delivery status.

Sessions are a signed token in an httpOnly cookie that expires after 30 days. It exists to keep you signed in; it is not used for tracking, and there are no third-party cookies.

Connecting Gmail is optional — Carpetless works with any SMTP account instead. If you do connect it, Carpetless requests exactly two permissions:

• gmail.send — to send the messages you have reviewed and approved. This scope grants sending only. It carries no ability to read, list, search, modify, or delete anything in your mailbox, and Carpetless never requests such access.
• userinfo.email — to show which Google address is connected, so you can tell your accounts apart and know what recipients will see.

The authorization step happens on Google's own domain. Carpetless receives a refresh token and never handles your Google password or two-factor codes. That token is encrypted at rest and used only to obtain short-lived access tokens when you send a campaign or a test message.

Carpetless's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the sending feature you asked for; it is not transferred to others except as needed for that purpose or where required by law; it is not used for advertising; and it is not used to develop or train generalized machine-learning models. No human reads your Google user data except with your explicit permission, to resolve a support issue you have raised, or where required for security or legal reasons.

Carpetless works out likely addresses from a company domain and any names you enter, so a campaign contains personal information about people who did not sign up for this service. We store those names, the generated addresses, and whether delivery succeeded, so that you can see what was sent and avoid repeating it.

That information is used for nothing else. It is not aggregated across users, shared, sold, or compiled into any list or directory. You are the sender of these messages and are responsible for sending them lawfully and sparingly, including under any anti-spam or data protection rules that apply where you and the recipient are.

No advertisers, data brokers, or analytics companies. Data is handled only by the services needed to run the app:

• the hosting provider that serves the site, and the managed PostgreSQL provider that stores the database;
• Google, when a message is sent through Gmail, or your SMTP provider when you use one — the message and its attachment necessarily pass through whichever you chose.

We may also disclose data if legally compelled, and will say so unless prohibited from doing so.

Traffic is served over HTTPS. Passwords are hashed with bcrypt. Gmail refresh tokens and SMTP passwords are encrypted with AES-256-GCM under a key stored in the deployment environment rather than in the database, so a copy of the database alone does not yield usable credentials. Access to the database is limited to the application.

No system is perfectly secure. If you find a vulnerability, please report it to degenhardt.adam@gmail.com rather than disclosing it publicly.

Data is kept until you delete it. Resumes, templates, campaigns, and connected accounts can each be removed from within the app, and deleting an item removes it from the database rather than hiding it. Note that removing a connected sending account also removes the campaigns that were sent from it.

Disconnecting a Gmail account deletes the stored refresh token. You can independently revoke Carpetless's access at myaccount.google.com/permissions, which invalidates the token whether or not you delete it here.

To delete your whole account and everything attached to it, email degenhardt.adam@gmail.com from your account address and it will be erased within 30 days. You can also ask for a copy of your data, or for a correction, at the same address.

Carpetless is a job-application tool for adults. It is not directed at children under 13, and we do not knowingly collect their information.

If this policy changes in a way that materially affects how your data is handled, the date at the top will change and, where the change is significant, we will email registered users. Continuing to use Carpetless after a change means the updated policy applies.

Questions about this policy or your data: degenhardt.adam@gmail.com.