Privacy Policy

Effective date: September 16, 2026

This policy explains what Undrafted LLC ("Undrafted," "we," "us") collects when you use the Undrafted website at undrafted.app and the Undrafted iOS app (together, the "Service"), how we use it, and the choices you have. It's written to be read, not skimmed past. If anything is unclear, email zach@undrafted.app.

The short version

Who we are

Undrafted LLC is a Maryland limited liability company. We're the data controller for the personal information described here. Contact: zach@undrafted.app.

What we collect

Account information. When you sign in with Google, Microsoft, or Apple, we receive your name, email address, and a provider account identifier. If you use Apple's "Hide My Email," we receive the private relay address Apple generates, not your real one. We only request basic profile scopes — never access to your inbox, calendar, or contacts.

Profile and onboarding details. What you tell us during setup and in Settings: your school, major, hometown, current location, the industry you're targeting, the roles you're interested in, and your target organization. Some of this is required for the Service to work.

Your résumé. The file you upload and the structured information we extract from it (education, work experience, skills, affiliations, activities). You review the extracted version before it's used.

Outreach data. The organizations and roles you search, the contacts the Service finds for you, the drafts it generates, and anything you add yourself — edits to drafts, notes, follow-up dates, contact stages, and people you add manually to your network board.

Preferences. Tone and length settings for drafts, your email signature, your preferred email client, and notification preferences.

Usage and device information. Product events (sign-up, résumé upload, searches started and completed, draft opened in your email client, app opened) so we can understand whether the Service is working and keep your streak accurate. On iOS, a random device identifier we generate on first launch (not your device's hardware ID). Your IP address, browser or OS type, and request timestamps in server logs. On the web, we use Microsoft Clarity for session replays and heatmaps to see how pages are used; Clarity masks form inputs by default.

Billing information. If you subscribe, Stripe collects and stores your payment details. We store your Stripe customer and subscription identifiers, plan, status, and trial and renewal dates — never your full card number.

Support. Anything you send us by email.

Information about other people

To find warm connections, the Service searches professional data — job titles, employers, work history, education, professional email addresses, and LinkedIn profile URLs — about people at the organizations you target. We obtain this from third-party data providers (currently Crustdata and Findymail) that compile publicly available and professional-source information. We show you a small number of matches per search and store them in your account so you can act on them.

We don't contact these people, and we don't tell them you looked. If you're someone whose information has appeared in Undrafted and you'd like it removed, email zach@undrafted.app and we'll suppress it from future results.

How we use your information

We don't sell your personal information, and we don't use your résumé or outreach data to train AI models.

Who we share it with

We share information only with service providers who process it for us, under contract, to provide the Service:

We'll also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition (in which case this policy continues to apply to your data).

Your email client

When you tap "Open in Gmail," "Open in Outlook," or compose from the iOS app, we build a link that opens a pre-filled draft in your own email app. Nothing is sent until you send it, and we can't see whether you did. We record that you opened the draft so we can show your outreach history and streak.

How long we keep it

We keep your information while your account is active. When you delete your account, we delete your account record, profile, résumé files and extracted content, contacts, drafts, notes, and sign-in tokens, and we cancel any active subscription and revoke your Apple sign-in authorization. Deletion is immediate and not reversible; if you sign up again, you start fresh.

Some data outlives deletion: billing records we're required to keep, aggregated analytics that no longer identify you, server logs on a rolling short-term basis, and encrypted backups, which cycle out on a fixed schedule.

Your choices and rights

If you're in the EU, UK, California, or another place with privacy laws that give you specific rights (access, correction, deletion, portability, objection, or restriction), you can exercise them by emailing us. We'll verify the request and respond within the time the law allows. We don't discriminate against you for exercising them.

Security

We use HTTPS everywhere, encrypt sensitive tokens at rest, limit who and what can access the database, and keep the surface area small. No system is perfectly secure; if we learn of a breach affecting your data, we'll tell you as the law requires.

Where your data lives

Our servers are in the United States. If you use the Service from outside the US, your information is transferred to and processed there, where privacy laws may differ from your own.

Age

Undrafted is for people 18 and older. We don't knowingly collect information from anyone under 18. If you believe we have, email us and we'll delete it.

Changes to this policy

We'll update this policy when our practices change. Material changes will be announced in the app or by email before they take effect, and the effective date at the top will move.

Contact

Undrafted LLC
zach@undrafted.app

undrafted.
© 2026 Undrafted. Built at Tulane. · Privacy · Terms