Legal

Privacy Policy

Last updated: November 2, 2026

Caramel ("Caramel," "we," "us," or "our") is a job-search workspace that helps you track applications, save jobs, watch your dream companies, and prep for interviews. This Privacy Policy explains what personal information we collect through oncaramel.com and the Caramel app (the "Service"), how we use it, and the choices you have.

Short version: we read your job-related emails so we can organize your job hunt for you. We don't sell your data, we don't use it for ads, and you can disconnect and delete everything at any time.

1. Information we collect

Information you give us

• Account data, such as your name, email address, and profile picture, which we get from Google when you sign in.
• Onboarding and profile data, such as the roles you're targeting, your school, and your dream companies.
• Content you add, such as applications you create or edit, saved jobs, notes, drafts, networking contacts, and interview prep activity.
• Communications, such as messages you send us for support or feedback.
• Payment data, if you start a paid plan. Payments are handled by Stripe (see section 5). We don't see or store your full card number.

Information from your Gmail account

When you connect Gmail, you give Caramel read-only access. We never send, delete, or change your emails. When you sync, we:

• Search your inbox for job-related emails (for example, application confirmations, interview invitations, and rejections).
• Read the subject, sender, date, and body of those emails.
• Use our models to figure out what kind of email it is and which company and role it's about.
• Use that to create or update applications in your tracker.

What we keep from job-related emails. We only keep emails about your job search, like application confirmations, assessments, interview invites, offers, and rejections. For each one, we store:

• the subject, sender, date, and text of the email
• its Gmail message ID
• the details we pull out of it, like company, role, status, and dates such as deadlines

That way each application in your tracker can show the emails behind it.

What we keep from everything else. Nothing from the email itself. If we check an email and it isn't job-related, we only save its Gmail message ID and a note that it isn't job-related, so we don't check it again. We never store its subject, sender, or text.

How long. We keep this data until you delete your account. To delete it, email privacy@oncaramel.com.

Information collected automatically

• Device and usage data, such as browser type, device type, IP address, general location (city or region), pages you view, and when you use the Service.
• Cookies and similar tech that keep you signed in and help the Service work.
• Analytics. On oncaramel.com, we use Vercel Web Analytics to count visits and see which pages people come from. It doesn't use cookies or track you across other sites. We don't use analytics inside the Caramel app.

We don't use advertising cookies, and we don't sell your data.

2. How we use your information

We use your information to:

• Run the Service: sign you in, sync your Gmail, keep your tracker up to date, show matching jobs, alert you about your dream companies, and build your interview prep.
• Support you: answer questions and send service messages like security alerts or account updates.
• Improve the Service: understand how features are used and fix bugs. We use aggregated or de-identified data for this where we can.
• Handle payments if you're on a paid plan.
• Keep things safe and legal: prevent fraud and abuse, enforce our Terms of Service, and comply with the law.

If we ever want to use your information for something new that isn't covered here, we'll ask you first.

3. Google user data

Caramel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, for data we get from your Gmail:

• We only use it to provide and improve the features you see in Caramel.
• We don't sell it.
• We don't use it for advertising.
• We don't use your Gmail data, or anything derived from it, to develop, improve, or train generalized AI or machine learning models.
• Humans don't read it, unless you ask us to (for example, to help with a support issue), it's needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.

4. AI and automated processing

Caramel uses machine learning models to classify job-related emails and pull out details like company and role. These models can make mistakes, so you can always edit or delete anything in your tracker.

These models run on our own systems. Our models are not trained on your Gmail data. We don't send your emails or other personal information to outside AI providers. If that ever changes, we'll update this policy and tell you before it happens.

We don't use automated processing to make decisions that have legal or similarly significant effects on you.

5. How we share your information

We don't sell your personal information or share it for advertising. We only share it with:

• Service providers that help us run Caramel, under terms that limit how they can use your data:
  • Google Firebase: sign-in and our database, where your account and Caramel data are stored.
  • Fly.io: hosts our servers, which read and process your job-related emails.
  • Vercel: hosts our website and app.
  • Stripe: payments. Stripe handles your payment details under its own privacy policy. We never see your full card number.
  • Google: Gmail access you choose to give us, and Google Sign-In.
• No AI companies. Caramel's email processing runs on our own servers. We don't send your emails to outside AI providers like OpenAI or Anthropic.
• Professional advisors, such as lawyers or accountants, when needed.
• Authorities, when we believe in good faith that the law requires it, or to protect the rights, safety, or property of you, us, or others.
• A buyer or successor, if Caramel is involved in a merger, acquisition, financing, or sale of assets. Any new owner would have to keep this policy's promises about your Gmail data.
• Anyone else you tell us to share with.

6. Where your data is stored

Caramel is based in Ontario, Canada. Our service providers may store and process your information in the United States or other countries, where privacy laws may be different from where you live. When your data is outside Canada, it may be accessible to authorities in that country under their laws.

7. How long we keep it

We keep your information while your account is active and for as long as we need it to provide the Service. If you delete your account, we delete your personal information within 3 days, except where we need to keep some of it to meet legal, tax, or accounting obligations, or to resolve disputes.

8. Your choices and rights

• Edit your data: you can update or delete applications and other content in the app.
• Disconnect Gmail: you can disconnect at any time by emailing privacy@oncaramel.com, or by removing Caramel at myaccount.google.com/permissions. We stop reading your email right away. Data we already pulled stays in your account until you delete it.
• Delete your account: email privacy@oncaramel.com from the email you signed in with. This deletes your tracker data and the stored Gmail results.
• Access, correct, or withdraw consent: you can ask for a copy of your personal information, ask us to correct it, or withdraw your consent to us processing it. Withdrawing consent may mean we can't keep providing the Service.
• Marketing emails: you can unsubscribe using the link in any marketing email. You'll still get service messages.
• Do Not Track: we don't currently respond to Do Not Track signals.

To make a request, email us at the address below. We may need to confirm your identity first.

If you're in Canada and you're not happy with how we handled a privacy concern, you can contact the Office of the Privacy Commissioner of Canada. Depending on where you live, you may have other rights under local law, and we'll honour them.

9. Security

We use reasonable technical and organizational safeguards to protect your information, including encrypted connections (HTTPS), restricted access to production data, and secure storage of Google access tokens. No system is perfectly secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll notify you as required by law.

10. Children

Caramel isn't meant for anyone under 16. We don't knowingly collect personal information from children. If you think a child has given us their information, contact us and we'll delete it.

11. Other sites

Caramel links to job postings and other sites we don't control. Their privacy practices are their own, so check their policies.

12. Changes to this policy

We may update this policy from time to time. If we make a big change, we'll let you know by email or in the app before it takes effect. The date at the top shows when it was last updated.

13. Contact us

Questions or requests? Email us at privacy@oncaramel.com.