Privacy Policy

GYST ("Get Your Sh*t Together", "GYST", "we", "us") is an AI job-search platform that helps you find jobs, save them to a board, generate tailored CVs and cover letters, reach out for referrals, and track your applications automatically from your email. This Privacy Policy explains what we collect, why, who we share it with, and the choices you have. It applies to the GYST website at startgyst.com and the GYST application.

If you have questions about anything here, contact us at privacy@startgyst.com.

We collect the following categories of data, most of which you provide directly.

Account information. When you sign up, our authentication provider (Clerk) collects your name, email address, and login credentials. We do not store your password ourselves.

Profile and CV data. Information you enter or upload to build your profile, such as your work history, education, skills, projects, and any CV files (PDF or DOCX) you import. We parse uploaded files to extract this information.

Generated documents. The tailored CVs, cover letters, and outreach messages produced for you, along with the job details they were generated against.

Job and application data. Your job searches, saved jobs, application-board cards and their stages, and the notes and status history attached to them.

Gmail messages (read-only). If you connect Gmail, we use read-only access to your Gmail messages (the gmail.readonly scope): the sender, subject, date, and message content. We use this solely to detect job-application-related messages and update your tracker, and we store only the sender, subject, date, and a short snippet, never full message bodies or attachments. See the Google user data section below for full detail.

Payment information. Our payment processor (Stripe) collects and handles your card details to process your subscription. GYST does not store your card numbers. We retain only limited billing metadata such as your subscription status, plan, and renewal dates.

Usage data. Basic technical and usage information such as pages visited, features used, device and browser type, and IP address, used to operate and improve the service and to protect it from abuse.

We use your data to:

• Provide, maintain, and secure the GYST service and your account.
• Generate CVs and cover letters tailored to specific jobs you choose.
• Draft referral outreach messages and prepare email drafts for your review.
• Detect job-application-related emails and automatically advance the stage of the matching card on your application board.
• Process your subscription payments and manage your trial and billing.
• Respond to your requests, provide support, and communicate service updates.
• Analyze usage to improve features, fix problems, and prevent fraud and abuse.

We do not sell your personal data, and we do not use your Gmail data for advertising.

GYST uses third-party AI providers to power several features. To do this, relevant text is sent to those providers so they can return a result. Specifically:

• Your profile and the target job description are sent to AI providers to generate tailored CVs, cover letters, and outreach messages.
• Text you provide is sent to AI providers to help answer application questions.
• Gmail message content (sender, subject, and body) is sent to an AI provider to classify whether a message relates to a job application and which stage it indicates.

Our AI providers are Anthropic and OpenAI. Under our agreements with them, your data is used to provide these features and is not used to train their models. AI output can be inaccurate, so you should always review it before relying on or submitting it.

We share data with the trusted service providers below only as needed to run GYST. Each is bound by its own privacy and security obligations.

• Supabase to host our database and store files.
• Clerk for authentication and account management.
• Stripe to process payments and manage subscriptions.
• Anthropic and OpenAI for AI generation and analysis.
• Hunter.io to help find referral contact data.
• Google for Gmail access when you connect your account.
• Upstash for rate limiting and abuse protection.
• Vercel to host and serve the application.

We may also disclose data where required by law, to protect our rights and users, or as part of a merger or acquisition, in which case we will notify you.

When you choose to connect your Google account, GYST requests read-only access to your Gmail messages. This section describes exactly how we handle that data and reflects our commitment to the Google API Services User Data Policy.

What we access. Read-only access to your Gmail messages (the gmail.readonly scope): the sender, subject, date, and message content. We read message content solely to identify emails related to your job applications. We store only the sender, subject, date, and a short snippet needed to display and match the message — we do not store full message bodies or attachments, and we never send, delete, or modify your emails.

Single purpose. We use this access for one purpose only: to detect emails related to your job applications (for example interview invitations, rejections, or offers) and to update the matching card on your application tracker automatically.

What we never do. GYST does not sell this data. We do not use it for advertising or ad targeting. We do not use it for any purpose other than the user-facing application-tracking feature described above. We do not allow humans to read this data, except where necessary for security purposes, to comply with applicable law, or where you have given explicit consent.

GYST's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Gmail at any time from your GYST settings, and you can also revoke access from your Google account security settings. Once disconnected, we stop accessing new messages.

We keep your data for as long as your account is active and as needed to provide the service. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain limited records to meet legal, tax, security, or accounting obligations. Gmail data (sender, subject, date, and a short snippet) is retained only as long as needed to run the tracking feature and is removed when you disconnect Gmail or delete your account.

We use industry-standard measures to protect your data, including encryption in transit, encryption of sensitive stored credentials (such as connected outreach API keys) using AES-256-GCM, access controls, and reputable infrastructure providers. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

Depending on where you live, you have rights over your personal data. We honor these rights for all users regardless of location.

If you are in the EEA or UK (GDPR), you may request access to your data, correction of inaccurate data, deletion, a portable copy, and you may object to or restrict certain processing.

If you are in California (CCPA), you may request to know what we collect, request deletion, and opt out of the sale of your personal data. GYST does not sell personal data, so there is nothing to opt out of.

To exercise any of these rights, email us at privacy@startgyst.com. You can also access and update much of your data directly in the app, and you can delete your account at any time.

GYST and its service providers may process and store your data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses to protect your data when it is transferred internationally.

We use cookies and similar technologies that are necessary to keep you signed in, remember your preferences, and keep the service secure. We may also use limited analytics to understand how the product is used so we can improve it. You can control cookies through your browser settings, though some features may not work without the essential ones.

GYST is intended for adults. The service is not directed to, and we do not knowingly collect personal data from, anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Continued use of GYST after an update means you accept the revised policy.

For any privacy questions or requests, contact us at privacy@startgyst.com. You can also review our Terms of Service.