What we read and store

Read-only access to your Gmail, via Google's gmail.readonly scope — the only Gmail permission we request. Google sign-in separately gives us your email address and basic profile to create your Sheppy account. We cannot send, delete, or modify anything in your inbox. You grant Gmail access once and can revoke it at any time.

We store your account email and basic profile. From job-related emails, we store only these extracted fields:

• Company name and website domain
• Role title and requisition ID
• Application status (Applied, Interview, Offer, Closed)
• Relevant dates (applied, last update)
• For assessment and video-interview invites, the deadline the email states (a date, or “7 days from this email”), and whether you've completed it
• Gmail message and thread IDs — references only, used to avoid double-counting the same email
• Interview practice: which questions you practiced, your scores, how it felt, and when (never what you said; see below)

We never store the body, subject, or full text of your emails.

We don't read your whole inbox. Your first scan asks Gmail to search only for likely job emails: messages from hiring systems such as Workday or Greenhouse, subjects like “application” or “interview”, and mail from companies already on your board. Sheppy opens the emails that search returns.

After that, Gmail tells Sheppy when new mail arrives. For each new email, Sheppy first looks at only who sent it and its subject line. It opens the email only when those look job-related, by the same rules as the search. Everything else is left unopened, and we keep nothing from it. A job-looking email that turns out to be unrelated is dropped without saving anything from it.

Most emails are understood by simple rules, with no AI involved. For the few the rules can't classify, we send Google's Gemini model that email's subject and up to the first 2,000 characters of its text, and nothing else from your account. That text can include what the email itself contains, such as your name or a link. Gemini returns only a status and the company and role, and we don't keep the text. AI use is capped at a few emails per person per day.

Sheppy uses Gemini on Google's paid service, under which Google doesn't use what we send to improve its products. Your Gmail data is never used to train, develop, or improve any AI or machine-learning model, ours or anyone else's.

Sheppy runs on Vercel, and Supabase stores your account, encrypted Gmail token, and application board. When our rules cannot classify an email, Google's Gemini API processes the short excerpt described above to help update your board.

To show company logos, Logo.dev may receive a company name or website domain. If Logo.dev is not configured, your browser may request a favicon from DuckDuckGo using a company domain. We do not send your email text to either logo provider.

If you turn on notifications, your browser gives us an address for that device on its push service (run by Google, Apple, Mozilla or Microsoft, depending on your browser). We store that address and send it short notices like “Acme wants to interview you”, encrypted so the push service can't read them. You can hide company names in notifications, or turn them off, in Settings.

On Sundays we email you a short recap of your own board: how many applications you sent, which companies wrote back with an interview or offer, your weekly goal, and deadlines coming up. It goes only to the email you signed in with, and is sent through our email provider, Resend. It contains no tracking image; we only count how many times you open Sheppy from its links. Turn it off in Settings or with the link in any recap.

When you answer out loud, the recording stays on your device so you can play it back. It is never uploaded.

To show your words as you speak, Sheppy uses your browser's built-in voice typing. Your browser sends the audio to its own speech service to turn it into text (Google in Chrome and Edge, Apple in Safari); Sheppy never receives the audio. If you'd rather not, switch on “Type instead of talking”.

When you finish, the text of your answer is sent to Gemini on Google's paid service to grade it. We don't keep that text.

Your account keeps only which questions you practiced, the score, how it felt, and when, so your path and streak follow you across devices, and for the daily practice reminder and the Sunday recap. Your answers and your story bank stay in your browser on that device. The daily reminder can be turned off in practice settings.

If you tap “Was this score fair?” under a grade, we keep your thumbs up or down, the reason you pick, the question and the score, to check that grading is fair. The words of your answer are kept only if you tick “Share my answer's words”; it is off unless you turn it on.

The token that lets us read your inbox is encrypted at rest, and its decryption key never leaves our server. Row-level security keeps other users from reading your board. Sheppy's server uses protected credentials to run Gmail sync and account actions.

With your permission, Google notifies us when new mail arrives so your board updates within minutes. These notifications tell us only that something changed — we then read new job-related emails the same read-only way. We never receive your inbox contents pushed to us wholesale.

Sheppy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Gmail data only to keep your own board up to date. We never sell it and never use it for ads.

We keep your account and application board while your account exists. Disconnecting Gmail stops future access but leaves your board in place. You can download your board or delete your account in Settings; deleting your account removes its stored applications, history, encrypted Gmail token, and notification devices.

• Disconnect Gmail at any time in Settings. We stop reading immediately and revoke our access at Google.
• Revoke our access directly from your Google account permissions.
• Delete your account to remove your stored applications and your encrypted token for good.