Privacy Policy

TalentForge (https://talentforge.dev) is a workspace for job-search teams to manage candidate profiles, tailored resumes, job applications, and the email and calendar accounts connected to those profiles. This policy explains what information TalentForge collects, how it is used, and the choices you have. Questions: support@talentforge.dev.

• Account information: your username, password (stored only as a salted hash), role, and optional profile picture.
• Profile content you enter: candidate names, contact details, resumes, cover letters, templates, job links, application records and notes.
• Usage and security data: sign-in times, IP addresses, a per-browser device identifier, and an activity log of actions taken in the app, used to secure accounts and prevent abuse.
• Connected Google or Microsoft account data, described in the next section.

A profile owner can choose to connect a Google account to a profile. With your consent, TalentForge requests these permissions:

• Your email address (openid, email), to show which account is connected.
• Gmail (gmail.readonly), to list and read messages in the connected inbox. TalentForge never changes, labels or deletes your messages.
• Sending email (gmail.send), to send the messages and replies you write in TalentForge.
• Google Calendar events (calendar.events), to show events and to create or reschedule the events you choose to create or move.

How we use it. Google user data is used only to provide the mailbox and calendar features you see in TalentForge: displaying the connected account’s email and events to the people allowed to work on that profile, and sending email or creating events when one of them asks the app to. We do not use Google user data for any other purpose.

What we store. We store the connected account’s email address and the OAuth access and refresh tokens, encrypted with AES-256-GCM. Email messages and calendar events are fetched from Google live each time you open them and are not stored. For security auditing, the activity log records when mail is sent (its recipients and subject) and when events are created (their title).

Who can see it. Inside TalentForge, a connected mailbox and calendar can be viewed only by the profile’s owner, administrators of your TalentForge workspace, and team members the owner or an administrator has assigned to that profile.

Sharing. We do not sell Google user data, do not use or transfer it for advertising, do not use it to determine credit-worthiness or for lending, and do not transfer it to third parties except as needed to provide the features above (our hosting infrastructure), to comply with law, or as part of a merger or acquisition with notice to you. Google user data is never sent to AI or machine-learning providers and is never used to develop, improve or train generalized AI or machine-learning models.

Human access. TalentForge staff do not read your Google user data unless you give us explicit permission for a specific message (for example, for support), it is necessary for security purposes such as investigating abuse, or it is required by law.

Limited Use. TalentForge’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting an Outlook account works the same way: TalentForge requests permission to read and send mail and to read and manage calendar events, stores only the account address and encrypted tokens, and uses the data only for the mailbox and calendar features described above.

We use account and profile content to operate TalentForge: to sign you in, show your workspace, generate tailored resumes and cover letters, fill application forms through the browser extension, and report on application activity. To generate tailored documents and form answers, the relevant resume and job-description text is sent to our AI provider (OpenAI) for processing. Google user data is never included in those requests.

• Disconnect a mailbox at any time from the profile’s Mailbox page. This deletes the stored tokens and revokes TalentForge’s access at Google immediately.
• You can also remove TalentForge’s access from your Google Account at myaccount.google.com/connections.
• Profile content is kept until you delete it or your workspace administrator removes it. To have your account and its data deleted, email support@talentforge.dev; we complete deletion within 30 days.

All traffic to TalentForge is encrypted with HTTPS. OAuth tokens are encrypted at rest, passwords are hashed, and access to each profile’s data is restricted by role.

We use a small number of providers to run TalentForge:

• Hetzner (servers in the EU) hosts the application server and database.
• Vercel serves the website. It processes visitors’ IP addresses to deliver pages.
• OpenAI processes resume and job-description text to generate tailored documents and form answers. It never receives Google user data.
• Google and Microsoft, only when you connect a mailbox or calendar, to deliver the features described above.

TalentForge does not use advertising or analytics cookies or trackers. Your browser’s local storage keeps your sign-in session, a device identifier used for account security, and display preferences such as light or dark mode. Clearing your browser data removes them.

You can view and edit your profile content in the app, disconnect any connected account at any time, and ask us to export or delete your data by emailing support@talentforge.dev. Depending on where you live (for example under the GDPR or CCPA), you may also have the right to object to or restrict processing and to lodge a complaint with your data-protection authority.

TalentForge is a professional tool not directed to children under 16, and we do not knowingly collect their information.

We will post any changes to this policy on this page and update the effective date. If you have questions or requests about your data, contact support@talentforge.dev. See also our Terms of Service.