Privacy Policy · OfferAIO

OfferAIO fills in job and internship applications from your profile. To do that it has to hold the same information you would type into an application form yourself. This page says exactly what that is, what we do with it, and how you get it back or delete it. In this policy, “we” means OfferAIO, a product of Sharka Software LLC.

What we store

Your account: name and email address. If you set a password, it is stored hashed. If you sign in with Google we receive only your name and email; we never see your Google password. OfferAIO no longer offers a Gmail connection.
Your time zone: read from your browser when you are signed in on the website, so reminders, quiet hours, the morning digest, Home’s greeting and Auto Apply’s day follow your own clock. UTC, and a browser that hides its clock, are not stored.
Website checkout consent: when you buy Premium or the Season Pass on the website (or bought a Lifetime plan before the Season Pass replaced it; those purchases keep their access), we keep the offer you accepted (the price, billing period or one-time purchase, and the exact wording), the time, and the user-agent line your browser sends. We also store the IP address from that checkout and delete that IP after three years. The rest of the record is not in your export and is kept, including after you delete your account, to document what you agreed to.
Historical card trials: a one-way hash of identifiers that already used it (your email in a normalised form, a signed-in Google or Apple identity, a phone number you gave us, a card used at checkout, and a random token in this browser). We keep the hash, never the raw value, to preserve the abuse-prevention history of the former card trial. Current free access is five applications for the life of the account and does not require a card. It is not included in your export.
Your resume: the file you upload and the text we extract from it (skills, education, experience).
Application details you enter: phone number, mailing address, education (school, degree, major, graduation date, GPA if you choose to share it), links such as LinkedIn or GitHub, and your work-authorization and visa-sponsorship answers.
Optional self-identification answers (gender, ethnicity, veteran and disability status). These default to “prefer not to answer” and are used only to fill the voluntary equal-opportunity section of an application when you have chosen to answer them.
Your search settings and activity: the roles, places and terms you want, internships you save, and every application OfferAIO queues or sends, including the answers it sent and a step-by-step record of how each form was filled.
Saved answers: when a form asks something your profile does not cover and you answer it, the question and your answer are kept on your account and reused the next time a form asks the same thing. You can see and remove them in Settings.
Employer accounts we create for you (optional): with “Create employer accounts for me” switched on, the sign-in email and the strong random password of each account OfferAIO creates for you on an employer’s portal (its own careers site or the application system behind it). Passwords are encrypted in a vault on your account, shown only to you on Connectors → Employer accounts after you enter a code we email you (each code works for 30 minutes), and never sent to a language model or written to a log.
Mail sent to your private OfferAIO address: every applicant gets a private address of their own, usually during setup, and it is the email on their applications. Mail employers send to it is stored so it appears in your inbox, read by OfferAIO only to finish your applications (a verification code, a sign-in link, the status of an application), and a copy is sent on to your verified sign-in email unless you turn that off under Settings → Profile.
Gmail: no longer offered; data from an earlier connection is described under “Gmail” below.
Browser recordings: see “Browser recordings” below.

Gmail

No Gmail connection is offered: since October 20, 2026, OfferAIO does not read your Gmail, send mail from it, or ask for a Google app password, and does not ask you to forward mail from Gmail or any other email account. Employer mail comes to your private OfferAIO address. If you connected Gmail before that date, you can still disconnect it under Inboxes & accounts → Inbox, which revokes access and deletes what was imported, and deleting your account deletes it too.

Gmail in your application browser: OfferAIO no longer signs in to Gmail, or opens or reads Gmail, in the browser on our servers that fills your applications, and no longer checks Gmail there for employer mail. Employer codes and confirmations reach OfferAIO only through your private OfferAIO address. If you signed in to Gmail in that browser before, its session can remain there until it is removed: Disconnect Gmail under Inboxes & accounts → Inbox deletes it from the browser and from the browser’s encrypted backup, and deleting your account removes the browser and everything signed in to it. Details already saved from employer mail in an application’s timeline (sender, subject, date, status and a short quote) are deleted with your account.

Native Gmail read connector (retired): before October 20, 2026, a few accounts connected this separate Google gmail.readonly permission. No new connection can be made and no more mail is imported. While connected, it searched for application keywords and application-system senders, initially in the last 60 days and then since the previous sync, with a short overlap, and processed at most 150 search matches per sync. We temporarily read their headers and text to identify application correspondence and match it to your tracked applications; unrelated matches were discarded. We keep only the sender, subject, date, Gmail’s short preview and an application link when matched. Full messages and attachments are not stored, and this classifier did not use a language model. Gmail API data is never sent to a language model. This connection imported messages without changing application statuses; you update those in the tracker. Statuses previously set from Gmail remain in your own tracker and stay out of comparisons with other users until the status changes. This permission could not send, delete, label or modify mail. Human access to this API data requires your affirmative permission to view specific messages, or a necessary security, legal or permitted aggregated-data exception under Google’s policy. Disconnect under Inboxes & accounts → Inbox revokes access at Google and deletes the stored key and imported mail; you can also remove OfferAIO at myaccount.google.com/connections.

Sending with Gmail’s API: not offered. OfferAIO does not ask Google for permission to send mail from your Gmail.

OfferAIO’s use of information received from Google APIs, including data still held from an earlier connection, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail SMTP (retired): before October 20, 2026, some accounts connected Gmail’s encrypted SMTP service with a Google app password to send drafts when they pressed Send. OfferAIO no longer accepts app passwords or sends mail through Gmail. A credential saved earlier stays encrypted and bound to your OfferAIO account and mailbox, unused, until it is removed: Disconnect SMTP under Inboxes & accounts removes it, and you may also revoke the app password in Google. Deleting your OfferAIO account deletes this credential and your saved drafts and sent messages. Messages already delivered remain in the recipient’s mailbox and Gmail.

What we do with it

We score internships, co-ops and entry-level roles against your profile so you see the ones that fit.
When you press Apply, paste a posting link, or use Auto Apply to queue new matches once or on a schedule, the browser we keep for you opens the employer’s application form, types your information into it and attaches your resume. By default it sends the application when every question is answered from your profile, resume, saved answers and OfferAIO's standard answers to common screening questions; an answer you give yourself always replaces a standard one. If you choose Review before submission, or a question cannot be answered from that information, the form waits under Needs your input. Your data goes to that employer and their applicant-tracking system; their privacy policy then applies.
A language model helps fill each form and drafts free-text screening answers from your profile, resume and saved answers. Anything your information and OfferAIO's standard answers do not cover comes back to you under Needs your input, and answers OfferAIO recorded for a run are listed on the application.
With “Create employer accounts for me” switched on, we create your account on an employer’s portal using the email employers see on your applications and a password we generate, so the application can go through. That account is with the employer, and their privacy policy applies to it.
We send you email about your applications, and product updates you can switch off in Settings.

We do not sell your data or show advertising in OfferAIO, and we share your information only with the employers you apply to and the service providers needed to run OfferAIO (hosting, email delivery, the language model used for answers, OpenStreetMap for the one address lookup when you press “Use my current location” during setup, which receives your coordinates, and the analytics described below). The one exception is a choice you make yourself, described in the next paragraph.

If you turn on Meta or TikTok advertising measurement in Cookie settings, that company receives the limited measurement data described below until you turn it off. Some US state privacy laws call this sharing. We do it only after you check that company’s box, and unchecking it or turning on Global Privacy Control in your browser stops it.

Your AI permission

AI processing starts off. Before using it, you choose whether OfferAIO may send information needed for your requests to OpenAI, Anthropic, OpenRouter and xAI. This may include your resume text, profile details, saved answers including optional sensitive answers you provide, job and application details, and the application browser’s page content or screenshots. These providers help read resumes, match roles, tailor documents and fill application forms.

You can continue resume intake, manual editing and rule-based matching without AI. Starting or continuing automated applications and turning on Auto Apply require AI permission. Withdrawing it in Settings → Privacy blocks new AI requests and stops active automated browser tasks; if the browser service cannot confirm the stop, the app shows that it is pending. Your Auto Apply preference stays saved, but automatic applications pause. Data already sent to a provider cannot be recalled. Employer-account creation and Review before submission remain separate choices.

Browser recordings

Recording your application browser is part of using OfferAIO and is agreed to in the Terms of Service; it is not a separate choice in Settings, and OfferAIO does not ask again before opening the browser. The screen of your application browser and its page activity, including the pages it opens, the forms typed into and what is shown on screen, may be saved so our developers can find and fix problems. Recording may run while OfferAIO works in the browser and while you are watching or controlling it, and the viewer shows when it is recording. Recording is separate from AI processing, which remains your own choice. A recording shows what was on that screen, including an employer email OfferAIO opened from your private address to finish a step. Recordings made before OfferAIO stopped opening Gmail in that browser can also show employer mail opened in Gmail. Recordings are not shown to you or to anyone outside OfferAIO; only our developers watch them, and only to diagnose a problem. They stay on our own servers and are never used for advertising or to train AI models. When you delete your account, we also ask our browser service to remove your browser recordings and detailed browser logs, and keep retrying until it confirms. Until removal is confirmed these records can remain; email support@offeraio.com for an update. When recording ends, this section will say so.

Where it lives

OfferAIO is a small service. Your data is stored in our own database and file storage, encrypted in transit. Uploaded resumes are deleted during account cleanup. If file storage is unavailable when you delete your account, we keep a cleanup record and retry.

Analytics and advertising

We measure how people find and use the website so we can improve it and understand which campaigns bring visitors. In the United States this is on unless you turn it off. Everywhere else it starts only with your permission. None of this includes your resume, your application answers or your email.

Google Analytics and Vercel Web Analytics receive the pages you visit, with private parts of the address removed. Cloudflare Web Analytics receives only public-page visits whose full address is safe to send. These services may also receive the site that sent you, your browser and device type and your approximate location (from your IP address). Vercel and Cloudflare set no cookies.
Google Analytics also receives a few events: signing up, signing in, finishing setup, starting a checkout and completing a purchase (the plan and its price, never card details). With Analytics alone, signed-in browser events can use your random OfferAIO account number, never your name or email, so your phone and laptop count as one person. Browsers allowing Google advertising measurement omit that account number from browser events.
With Analytics on, we keep campaign labels in first-party cookies. With Google advertising measurement on as well, we also keep Google click IDs and let Google connect a public landing-page visit to a successful sign-up and the first paid subscription payment, including a payment after a free trial. We do not report later renewal payments as new-customer conversions. Google Ads can receive these events through Google Analytics. Paid measurement includes the plan, amount, currency and an opaque purchase reference, never a payment-provider transaction number. Advertising measurement does not receive your account ID, email, resume or application answers. Google advertising measurement does not enable personalized ads, and we do not send a second, direct Google Ads conversion.
Meta (Facebook and Instagram) and TikTok advertising measurement are two more separate choices. Each is off until you check its box, wherever you live. A box appears in Cookie settings only while that measurement is switched on for the site. An ad from one of these companies adds a click ID to the link you arrive on. Until you allow that company, the click ID is not stored; it only stays in the address when you follow a link to the sign-up page. If you allow a company and Analytics is on, we keep its click ID when you arrive on a public page or the sign-up page, in a first-party cookie that page scripts cannot read. That company’s tag loads on our public pages and can load on one short page shown right after you create an account. It never loads on sign-up or sign-in pages, during setup or inside your account. Where it loads, it sets that company’s cookies on offeraio.com and the company receives the public page address with its campaign labels and its own click ID, on a public page the site that sent you (its address without the page), your IP address, your browser and device details, and the fact that you visited or signed up. TikTok’s tag may also record details of that public page, such as its title and which buttons you press. Our server also reports your sign-up and the first paid payment of a subscription to that company, including a payment after a free trial: the plan, amount and currency, an opaque reference, the click ID, that company’s cookie ID and your browser and device details (the user-agent line your browser sends). Our server does not forward your IP address. Later renewals are not reported. Once you start a checkout we keep the click ID, cookie ID and those browser and device details with your account until that payment is reported or you withdraw permission, and we stop using them after 90 days. We do not send your name, email, phone number, account ID, resume, application answers or payment-provider transaction numbers, we keep these companies’ automatic matching of form details off, and we do not use these events to build advertising audiences. Meta and TikTok may use what they receive to measure our ads and improve how they are delivered, under their own privacy policies.
Session recordings of this website. With Analytics on, we record visits to our public pages while you are signed out, so we can see where the site is confusing. Nothing is recorded while you are signed in or on any page inside your account, and nothing on a page you reach from a sign-in, password-reset or live-window link. A recording is not video and not a picture of your screen: your browser sends the changes to the page you were already looking at, and we rebuild that page to play it back. It includes the public pages you moved through, your mouse movement and clicks, scrolling, the size of your window, and whether our tab was the one in front or behind another window. Everything you type is replaced with dots inside your browser before anything is sent, so what you type, such as a password or an email address, is never in a recording; password and payment fields are not recorded at all. The recording is stored in our own database, is never sent to an advertising or analytics company, is seen only by OfferAIO’s administrators, and is deleted after 30 days. Turning Analytics off in Cookie settings stops it, and it never runs when your browser sends Global Privacy Control.
When you sign up on the website we store where your first visit came from (for example a search engine, another site or an ad campaign) with your account. It is included in your export and deleted with your account.
We sometimes test two versions of a page against each other. A random ID in a cookie keeps you on the same version, and we count how many visitors to each version sign up.

In the United States, Analytics and Google advertising measurement are on when you first visit. Cookie settings, at the bottom of every page, turns them off at any time: uncheck either one and Save choices, or choose Necessary only to turn both off.

Everywhere else, both start off. On your first visit, Allow analytics turns on Analytics only, and No thanks keeps both off. In Cookie settings, check Analytics and, separately, Google advertising measurement, then Save choices.

Meta and TikTok advertising measurement start off everywhere and stay off unless you opt in through Cookie settings. If you allow Meta or TikTok advertising measurement, that company receives its cookie ID and ad click ID and may set cookies on its own sites.

Each advertising choice requires Analytics and stands alone: Analytics alone never allows advertising, and allowing one company does not allow another. Meta and TikTok measurement never start on by themselves. When you turn one off, we remove that measurement’s cookies on offeraio.com and stored click IDs linked to this browser, reload the page to stop its scripts, and stop pending server purchase reports linked to this browser. Changing your Analytics or Google choice also clears stored Meta and TikTok click IDs. We cannot remove cookies these companies keep on their own sites, and reports already sent are not recalled by this choice. Your browser’s Global Privacy Control overrides every permission, wherever you are. OfferAIO works without optional measurement.

We keep a separate first-party privacy preference identifier for up to 400 days after you change these choices, including after you sign out, so we can honor withdrawals. A platform’s permission expires after 180 days unless you explicitly choose it again. We store hashed privacy identifiers on our server and keep your account’s withdrawal record until you delete the account. These privacy identifiers are never shared with advertising companies or payment providers.

An earlier Google measurement choice covered sign-ups only. Paid-purchase measurement needs a new affirmative choice in Cookie settings. Leaving the renewed box unchecked does not grant this additional permission. A Google choice, or Google measurement being on by default, never covers Meta or TikTok. Each needs its own choice.

Your controls

Export: Settings → Advanced → Export downloads your account data as JSON. File contents, browser recordings and detailed browser logs are not included. Website checkout consent records are also excluded.
Delete: Settings → Advanced → Delete account removes your account, profile, saved answers, stored employer-account passwords, applications and mail from our database immediately. Your resume files and the browser we keep for you, including any Gmail session left from before we stopped using Gmail there, are deleted during cleanup. If file storage or the browser host is unavailable, we keep the IDs needed to retry cleanup and flag an incomplete browser wipe for review. Browser recordings and detailed browser logs follow the removal process under Recordings above. A connected read-only Gmail key is deleted from our database and we request revocation at Google. Applications already sent to employers, and accounts created with them, remain with those employers. A hashed record of a historical card trial is retained for billing and abuse-prevention history; it does not reduce your free Auto Applies. Website checkout consent records (the offer, time and browser line) are also kept, as described above. The checkout IP address is deleted after three years.
Edit: every field is editable in Settings and Profiles at any time.
Auto Apply is opt-in. New matches are selected automatically only if you are 18 or older and turn on scheduled picks or choose Queue new matches for a one-time run. You can turn scheduled picks off at any time; a one-time run does not switch them on. You can also choose a posting yourself and press Apply.
Review before submission is your choice. It is off by default, so a filled form is sent when every question is answered from your profile, resume, saved answers and OfferAIO's standard answers. Turn it on under Settings → Automation, and every filled form waits for you to press submit, including forms you started yourself.
Assistants you use: an AI assistant acting on your instruction uses your account as you, inside your own signed-in session, and only the parts of it you open to it. It cannot make the AI processing choice for you; that choice is yours under Settings → Privacy.

Cookies

Cookies are set on offeraio.com. When analytics or Google advertising measurement is on, Google receives measurement data, and Meta or TikTok only if you also allowed that company.

Signing in: one session cookie keeps you signed in, and a short-lived cookie is used during Google sign-in.
Your privacy choices: oa_consent remembers whether Analytics is on and oa_ads whether Google advertising measurement is on: for six months while on, and for 400 days after you turn one off. oa_ads_meta and oa_ads_tiktok remember the Meta and TikTok choices the same way. None identifies your account.
Finishing signup: oa_signup_return keeps your next OfferAIO page private while signup completes, and oa_signup_ads makes sure a new sign-up is reported to Meta or TikTok only once. Both last up to five minutes and are removed as you continue.
Our optional analytics: oa_vid (a random visitor ID for the page tests above, one year), oa_ft and oa_lt (where your first visit and your latest ad or campaign visit came from, one year and 90 days), and oa_ev (a few minutes, to report a sign-up or sign-in).
Session recording: no cookie. While Analytics is on, a random ID for the current tab is kept in your browser’s session storage and disappears when you close that tab. It does not identify your account.
Historical trial protection: oa_tf (a random token, two years) records whether this browser received the former card trial. It does not reduce the free Auto Applies. It is not used for advertising or analytics.
Google: _ga and _ga_* (Google Analytics, up to two years), and _gcl_* (which Google ad you arrived from, 90 days).
Meta, only if you allow it: oa_fbc (the Meta ad click you arrived from, set by us, not readable by page scripts, 90 days), and _fbp and _fbc (a browser ID and the ad click, set by Meta’s tag, up to 90 days). When Meta’s tag loads, your browser also sends Meta any cookies Meta keeps on facebook.com. Meta’s tag may also keep the site that sent you in this browser’s storage; we remove it with these cookies.
TikTok, only if you allow it: oa_ttclid (the TikTok ad click you arrived from, set by us, not readable by page scripts, 28 days), and _ttp, ttclid, ttcsid and ttcsid_* (browser, click and visit IDs set by TikTok’s tag, up to 13 months). TikTok’s tag may also set _tt_enable_cookie, and TikTok may set its own cookies on tiktok.com and pangle-ads.com when the tag loads. TikTok’s tag may also keep a visit ID in this browser’s storage; we remove it with these cookies.

Changes and contact

Changed on October 30, 2026: Clarified that OfferAIO also fills forms with its standard answers to common screening questions, that an answer you give yourself always replaces a standard one, and that applications needing you wait under Needs your input. Nothing changed in what is collected or shared.

Changed on October 29, 2026: Free access is now five Auto Applies for the life of the account instead of five a day. Nothing changed in what is collected or shared.

Changed on October 28, 2026: Recording your application browser for troubleshooting is now part of the Terms of Service for everyone who uses OfferAIO, instead of a separate optional permission. OfferAIO no longer asks before opening the browser, and Settings → Privacy no longer has a recording switch. What a recording holds, who watches it and when it is removed are unchanged; see “Browser recordings” above. AI processing remains a separate choice.

Changed on October 28, 2026: With Analytics on, we now record visits to our public pages while you are signed out, so we can see where the site is confusing. Nothing is recorded while you are signed in or on any page inside your account. A recording holds the public pages you moved through, your mouse movement and clicks, scrolling, your window size, and whether our tab was in front or behind another window. It is not video and not a picture of your screen. Everything you type is replaced with dots inside your browser before anything is sent, and password and payment fields are not recorded at all. Recordings stay in our own database, are seen only by OfferAIO’s administrators, are never sent to an advertising or analytics company, and are deleted after 30 days. Turning Analytics off in Cookie settings stops it, and it never runs when your browser sends Global Privacy Control.

Changed on October 28, 2026: Added how an AI assistant you use acts in your account, and limits on bulk use of the public catalogue.

Changed on October 23, 2026: Replaced the card trial with five free applications a day; added Premium at $20/month and Lifetime at $49 once.

Changed on October 21, 2026: when you delete your account, we also ask our browser service to remove your browser recordings and detailed browser logs, and keep retrying until it confirms. Until removal is confirmed these records can remain; email support for an update. The JSON export still contains account data, not stored file contents or browser recordings.

Changed on October 20, 2026: every applicant now uses a private OfferAIO address, and it is the only email OfferAIO puts on applications. OfferAIO no longer offers connecting Gmail to read mail, sending through Gmail, Google app passwords, or forwarding mail from another email account. Anyone who connected Gmail earlier can still disconnect, which revokes access and deletes imported data; see “Gmail” above.

Changed on October 20, 2026: AI processing and browser recording now require separate explicit choices. Both start off; Settings → Privacy lets you withdraw either permission.

Changed on October 20, 2026: the signed-in website may store your browser’s time zone so reminders, quiet hours, the morning digest, Home’s greeting and Auto Apply’s day follow your own clock. UTC and browsers that hide their clock are not stored.

Corrected on October 20, 2026: browser and account cleanup do not yet automatically remove all recordings and detailed browser logs. These records can remain after deletion; see Recordings above for the current removal process. The JSON export contains account data, not stored file contents or browser recordings.

Clarified on October 19, 2026: leftover Gmail sign-ins are removed with the application browser during account cleanup. OfferAIO no longer signs in to Gmail there. The recording-deletion statement published that day is corrected above.

Changed on October 20, 2026: website checkout consent (the offer you accepted, the time and browser line) is kept, including after you delete your account, and is not in your export. The checkout IP address is deleted after three years.

Changed on October 18, 2026: the native Gmail read connector and mail received at your OfferAIO address now leave application-stage updates to you. Messages remain available in your inbox and, when matched, the application’s history. Existing application statuses are unchanged.

Clarified on October 18, 2026: the former card trial was granted once per person. Current free access is five applications for the life of the account, with no card. Hashed identifiers that already used a trial stay after you delete your account and are not in your export. The two-year oa_tf browser token supports this check.

Changed on October 17, 2026: OfferAIO no longer signs in to Gmail, or opens or reads Gmail, in your application browser; see “Gmail” above. Sending mail through Google’s Gmail API is not offered. The optional Gmail read connector is unchanged, and this policy now also states that its data is never sent to a language model and that statuses it moves are not used in comparisons with other users. Gmail SMTP is unchanged.

Changed on October 13, 2026: in the United States, Analytics and Google advertising measurement now start on, and Cookie settings turns them off. Meta and TikTok advertising measurement are each a separate Cookie settings choice, off unless you opt in. Your browser’s Global Privacy Control overrides every permission. Before this date, Analytics and Google advertising measurement started off everywhere and waited for your permission. Outside the United States those two still start off.

If this policy changes in a way that matters, we will say so on this page and by email. Questions or requests: support@offeraio.com.