CozyJobs Privacy Policy

Effective Date: February 13, 2026
Last Updated: May 6, 2026

CozyJobs is a product of Omlist LLC ("Omlist," "CozyJobs," "we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use:

• the CozyJobs platform at cozyjobs.ai,
• the CozyApply Chrome extension,
• and all associated services, dashboards, and tools.

We are committed to being transparent about our data practices. This policy is written in plain language so you can understand what we do with your information.

1. Who We Are

2. Scope of This Policy

This policy applies to personal information we process when you:

• Register for an account and create a profile;
• Subscribe to a paid plan and complete checkout;
• Upload a resume or enter profile information;
• Use job search, filtering, matching, saved-job, hidden-jobs, or queue features;
• Use AI-powered features (resume parsing, cover letter generation, job matching);
• Use the CozyApply Chrome extension;
• Use the CozyJobs application tracker;
• Submit a paid Job Listing as an Employer;
• Submit support requests, feedback, or bug reports;
• Opt in to optional CozyJobs product or marketing emails;
• Visit our website and interact with our platform.

This policy does not apply to third-party websites, employer portals, applicant tracking systems, or job boards that you access through links on our Service. Those providers have their own privacy policies, and we encourage you to review them.

3. Information We Collect

3.1 Information You Provide Directly

Account and Profile Information:

• Name
• Email address
• Phone number (if provided)
• Social media links and portfolio URLs (if provided)
• Profile photo (if provided via Google OAuth)
• Job preferences (desired title, location, salary range, remote/on-site preference, industry)
• Skills, experience, and education
• Multiple "job profiles" (e.g., one for marketing roles, one for writing roles), if you create them

Resume and Application Content:

• Resume/CV file and text content
• Cover letters (including AI-generated versions you create through our tools)
• Work history, education, certifications, and qualifications
• Form-field answers you generate or edit through CozyApply
• Any other information contained in your resume or application materials

Application Tracker Data:

• Jobs you save, hide, queue, mark as applied, archive, or restore
• Application status and timestamps you log
• Notes you add to applications

Employer / Job Poster Information (if you post a Job Listing):

• Company name, role details, application URL or email, compensation, location
• Billing details associated with the post (processed by Stripe)

Communications:

• Support requests and messages
• Feedback, bug reports, and feature suggestions
• Survey responses
• Newsletter sign-ups and email preferences

3.2 Information Collected Automatically

Usage Data:

• Pages and features accessed; Job Listings viewed, saved, hidden, queued, and applied to
• Search queries and filter selections
• Application timestamps and status events
• Feature interaction patterns
• Application Credit usage and plan telemetry

CozyApply Extension Data: The CozyApply Chrome extension is a user-initiated drafting and autofill helper. We collect data from CozyApply only when you actively invoke a feature (e.g., clicking "Fill Application," "Generate Cover Letter," "Mark Applied," or syncing your queue). When you do, we may collect:

• The URL and page title of the Employer application page you're on;
• Detected employer name, ATS platform, and job-listing metadata;
• The time you marked a job as applied;
• A locally-detected map of form fields on the page (so we can pre-fill them) — the values you enter are not transmitted back to CozyJobs unless you explicitly save them to your profile.

We use this information to: (a) draft and pre-fill your application, (b) update your CozyJobs application tracker, and (c) improve the public CozyJobs job database when you apply to a job we don't already track. We do not passively monitor or log your browsing activity. CozyApply does not run on a page until you click an extension action there.

CozyApply's data handling complies with Google's Chrome Web Store User Data Policy and Limited Use requirements: data collected through CozyApply is used solely to provide and improve the user-facing features described here; we do not sell that data, and we do not use or transfer it for unrelated purposes (including advertising, credit-worthiness, or any purpose unrelated to CozyApply's user-facing features).

Restricted mode on Upwork: On upwork.com, CozyApply operates in a drafting-only mode. The extension helps you draft proposal text locally in your browser, but it does not transmit Upwork job URLs, job descriptions, titles, clients, or your proposal content to CozyJobs servers. It does not sync Upwork postings into our public job database, does not auto-submit proposals, and does not auto-check Upwork's agreement boxes. You remain in full control of what gets sent to Upwork.

Optional personal Upwork tracker: CozyJobs offers an optional personal application tracker for Upwork. When — and only when — you explicitly mark an Upwork job as applied through CozyApply, we store a private bookmark row containing the job URL, title, client name (if the extension captured one), the timestamp, and any notes you add. These Upwork rows are strictly private to your account: they are never shown in the public CozyJobs feed, never included in search results, recommendations, match-score training, shared analytics, or AI training, and never surfaced to any other user. We do not fetch, scrape, or otherwise server-side-access Upwork pages at any point; we only store what the extension sends.

Device and Network Data:

• IP address
• Browser type and version
• Device type and operating system
• Referring URL
• Approximate location inferred from IP address

Cookies and Similar Technologies:

• Authentication and session cookies
• Preference cookies
• Analytics cookies (see Section 7)

3.3 Information from Third-Party Services

Google OAuth: When you sign in with Google (via Supabase Auth), we receive your name, email address, and profile photo from Google. We do not receive your Google password.

Stripe (Payment Processor): When you subscribe or purchase a Job Listing post, Stripe processes your payment information. We receive limited transaction data from Stripe (subscription status, plan tier, billing cycle, invoice metadata). We do not store your full credit card number, CVV, or bank account details — Stripe handles that directly.

3.4 Sensitive Personal Information

Your resume and profile may contain information you choose to include that could be considered "sensitive personal information" under the CCPA/CPRA, GDPR, or other laws — for example, disability or veteran status, demographic information, citizenship/work authorization status, or other personal details. We recommend including only information that is relevant to your job search.

We process this information only to provide the Service you requested (e.g., displaying your resume to you, parsing it for autofill, generating cover letters). We do not use sensitive personal information to infer characteristics about you, target advertising, or for any purpose other than providing and securing the Service. Under California law, this means we are not required to provide a separate "right to limit" mechanism, because our use of sensitive personal information falls within the CCPA's "necessary to provide the service" exemption (Cal. Civ. Code § 1798.121(a) and 11 CCR § 7027). You may still delete this information at any time by editing your profile or deleting your account.

4. How We Use Your Information

We use your personal information for the following purposes:

4.1 AI and Automated Processing

CozyJobs uses large language models (LLMs) and AI tools to assist with:

• Resume parsing: Extracting structured data (skills, experience, education, contact information) from uploaded resumes
• Job listing parsing: Extracting and categorizing details from third-party job postings
• Cover letter and answer generation: Creating tailored cover letters and form-field drafts based on your profile and target job descriptions
• Job matching: Recommending relevant Job Listings based on your profile and preferences

Important disclosures about our AI processing:

• AI outputs are assistive tools — you are responsible for reviewing and verifying all AI-generated content before use or submission. CozyApply pre-fills drafts; you choose what to submit, and you click the Employer's submit button yourself.
• We use AI infrastructure providers to process your data (see Section 5). These providers act on our behalf and are contractually restricted from using your data to train their general-purpose models.
• We do not use your personal Content (resumes, profile data, application answers) to train public AI models in a way that identifies you. We may use aggregated, de-identified data and patterns to improve our own product features.
• AI-generated content may contain inaccuracies, hallucinations, or errors. We do not guarantee accuracy.

4.2 Automated Processing — Not an Automated Employment Decision Tool

CozyJobs's match scores, recommendations, and AI-drafting features are designed to help you, the job seeker, and are not used by Employers to make hiring decisions. We do not deploy, sell, or license our matching or scoring features as an "automated employment decision tool" within the meaning of New York City Local Law 144, the Illinois Artificial Intelligence Video Interview Act, the Colorado AI Act (effective February 2026), or analogous laws. Specifically:

• Job matching and recommendations help you decide which jobs to view, save, or apply to. They do not make decisions for you, and Employers cannot see your match score.
• Resume parsing extracts information into your profile, which you can review and edit at any time.
• Cover letter and answer generation produces drafts you review and submit yourself.

You retain full control over which jobs to pursue and what content to submit. If you have concerns about our automated processing, contact us at privacy@omlist.io.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 Service Providers and Processors

We use trusted third-party service providers who process data on our behalf:

We require our service providers to protect your data and use it only for the purposes we specify. A current sub-processor list is available on request from privacy@omlist.io.

5.2 Internal Access by Authorized Personnel

A small number of authorized Omlist personnel (including the founders and any contracted curators or support staff who have signed appropriate confidentiality and data-handling agreements) may access account, profile, or usage data on a need-to-know basis to: (a) operate and curate the Service, (b) respond to support requests, (c) investigate abuse or security incidents, and (d) review content quality. Curator-facing dashboards primarily display Job Listing and opportunity data; access to user resumes or application content is limited to support and abuse-response purposes.

5.3 Legal Compliance and Protection

We may disclose information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, court order, or legal process;
• Protect the rights, safety, or property of Omlist, our users, or the public;
• Detect, prevent, or address fraud, security, or technical issues;
• Enforce our Terms of Service.

5.4 Business Transfers

In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such transfer and any choices you may have regarding your information.

5.5 With Your Direction or Consent

We may share information where you explicitly request or authorize it.

5.6 What We Do Not Share

We do not share your personal information with Employers unless you submit it yourself through your application. Employers do not see your match scores, your CozyJobs profile, your resume, or your application history except for what you transmit on their site when you apply.

6. Data Retention

We retain your personal information only as long as reasonably necessary for the purposes described in this policy:

When data is no longer required, we delete, de-identify, or anonymize it. You may request deletion of your data at any time (see Section 8).

7. Cookies and Tracking Technologies

7.1 What We Use

We use cookies and similar technologies for the following purposes:

7.2 What We Don't Use

We do not use:

• Third-party advertising cookies or trackers
• Cross-site tracking pixels for ad targeting
• Fingerprinting technologies

7.3 Your Cookie Choices

You can control cookies through your browser settings. Most browsers allow you to:

• Block all cookies
• Block only third-party cookies
• Delete cookies when you close your browser
• Be notified when a cookie is set

Disabling essential cookies may prevent you from using certain features of the Service (such as staying logged in).

7.4 Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) signals. If your browser or device sends a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of personal information, as required by California law.

8. Your Privacy Rights

8.1 Rights for All Users

Regardless of where you live, you can:

• Access your personal information by viewing your profile and account settings;
• Update or correct your information through your account settings;
• Delete your account and associated data by contacting support@omlist.io or using in-app account-deletion options;
• Download your data by requesting an export from support@omlist.io;
• Withdraw consent for optional processing activities, such as marketing communications.

8.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

1. Right to Know / Access: You can request the categories and specific pieces of personal information we have collected, used, disclosed, or sold/shared about you, including information going back to January 1, 2022 (or earlier, if we maintain it).

2. Right to Delete: You can request that we delete your personal information, subject to certain legal exceptions (e.g., we may need to retain billing records for tax compliance).

3. Right to Correct: You can request correction of inaccurate personal information.

4. Right to Opt Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your personal information. Omlist does not sell personal information for monetary consideration. If any of our analytics practices are later deemed "sharing" under California law, we will provide the required opt-out mechanism.

5. Right to Limit Use of Sensitive Personal Information: As described in Section 3.4, our use of sensitive personal information falls within the "necessary to provide the service" exemption. You may still delete this information at any time.

6. Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights. You will not receive a different level of service or pricing for exercising your rights.

8.3 EEA, UK, and Swiss Residents — GDPR / UK GDPR Rights

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, and/or the Swiss Federal Act on Data Protection, including:

• Access, rectification, erasure, and portability of your personal data;
• Restriction of, and objection to, processing in certain circumstances;
• Withdrawal of consent at any time, where processing is based on consent;
• The right to lodge a complaint with your local data protection authority (e.g., your national DPA in the EEA, the UK ICO, or the FDPIC in Switzerland).

Legal bases for processing. We rely on the following GDPR legal bases:

• Contract performance (Art. 6(1)(b)): to provide the Service you signed up for, including AI parsing and drafting features tied to your account;
• Legitimate interests (Art. 6(1)(f)): to operate, secure, and improve the Service, prevent abuse, and curate the public job database (where these interests are not overridden by your rights);
• Consent (Art. 6(1)(a)): for optional processing such as marketing emails or non-essential analytics;
• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting, or other legal requirements.

International transfers. We are a U.S. company. When we transfer personal data from the EEA, UK, or Switzerland to the United States or other third countries, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable). You may request a copy of these safeguards from privacy@omlist.io.

If you are an EEA/UK/Swiss user and would like to designate an EU/UK representative contact (or have questions about cross-border transfers), email privacy@omlist.io.

8.4 How to Exercise Your Rights

Submit requests via:

• Email: privacy@omlist.io
• Mail: Omlist LLC, 2443 Fillmore Street, #288, San Francisco, CA 94115

Verification: We may need to verify your identity before fulfilling your request. We will typically verify by confirming information associated with your account (such as your email address). If we cannot verify your identity, we may deny the request and explain why.

Authorized Agents: You may designate an authorized agent to submit requests on your behalf. The agent must provide written authorization signed by you, and we may still ask you to verify your identity directly.

Response Timeline: We will respond to verifiable requests within 45 days (CCPA) or 30 days (GDPR/UK GDPR). If we need additional time, we will notify you and may take up to 90 days total.

9. Do Not Sell or Share My Personal Information

Omlist does not sell your personal information for monetary consideration. We do not share your personal information for cross-context behavioral advertising purposes.

If you are a California resident and wish to exercise your right to opt out, or if you have questions about how we handle your data, contact us at privacy@omlist.io.

We honor Global Privacy Control (GPC) signals as opt-out requests.

10. Email Communications

We send two categories of email:

• Transactional / service email — required for the Service: account confirmations, password resets, subscription receipts, renewal reminders, security alerts, and important policy updates. You cannot fully opt out of these while you have an active account, but you can close your account.
• Marketing email — optional: occasional product announcements, tips, and CozyJobs updates. These are sent only to users who opt in (or, where permitted, on an opt-out basis to existing customers consistent with CAN-SPAM and applicable law). Every marketing message contains an unsubscribe link, and you can also unsubscribe at any time at /unsubscribe or by emailing privacy@omlist.io.

We do not sell, rent, or share your email address with any third party — including affiliated companies, partner publications, or other LLCs in the Omlist family. CozyJobs accounts are separate from any other newsletter or service you may subscribe to elsewhere.

11. Children's Privacy

CozyJobs is intended for users who are at least 18 years old (or the age of majority in their jurisdiction). We do not knowingly collect personal information from anyone under 16 years of age. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information as soon as possible. If you believe we have inadvertently collected information from a child, please contact us at privacy@omlist.io.

12. Data Security

We implement administrative, technical, and organizational safeguards designed to protect your personal information, including:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL.
• Encryption at rest: Sensitive data is encrypted at rest in our databases.
• Access controls: Access to personal information is restricted to authorized personnel on a need-to-know basis.
• Authentication: We use industry-standard authentication mechanisms (Google OAuth via Supabase Auth) and do not store plaintext passwords.
• Vendor security: We evaluate the security practices of our third-party service providers and require appropriate safeguards.
• Monitoring: We monitor for unauthorized access, security incidents, and suspicious activity.

No system is perfectly secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials secure and notifying us promptly if you suspect unauthorized access.

12.1 Data Breach Notification

If we discover a security breach affecting your personal information, we will notify affected users and applicable regulators as required by law — including, where applicable, GDPR/UK GDPR's 72-hour notification window and any state breach-notification statutes. Notice will describe the nature of the breach, the categories of data involved, and steps we are taking, to the extent we are able to share that information at the time of notice.

13. International Users

CozyJobs is operated from the United States. If you access the Service from outside the United States, your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your home country. For EEA, UK, and Swiss users, the safeguards described in Section 8.3 apply.

By using the Service, you consent to the transfer of your information to the United States as described in this policy. We take steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

14. Third-Party Services

Our Service may link to or interact with third-party websites, employer portals, job boards, and applicant tracking systems. These third parties have their own privacy policies and practices, which we do not control and are not responsible for.

We respect the automation and platform policies of the sites CozyApply runs on. In particular, CozyApply operates in a restricted, drafting-only mode on Upwork and does not automate proposal submissions there. CozyApply never auto-submits applications on any platform — you always click submit yourself. You remain fully responsible for complying with the terms of service of any platform you use alongside CozyApply.

We encourage you to review the privacy policies of any third-party service before providing your personal information.

Key third-party services integrated with CozyJobs:

• Google (privacy policy) — OAuth sign-in
• Stripe (privacy policy) — Payment processing
• Supabase (privacy policy) — Infrastructure and authentication
• Vercel (privacy policy) — Web hosting
• Resend (privacy policy) — Email delivery
• Cloudflare (privacy policy) — Browser rendering and CDN
• Anthropic / OpenAI / Google AI — LLM providers (data sent for processing under contracts restricting general-model training)

15. CCPA Category Disclosure

In the preceding 12 months, we have collected and may have disclosed for business purposes the following categories of personal information (as defined by the CCPA):

Sources: Directly from users, automatically via the Service and CozyApply extension, from third-party authentication providers (Google OAuth), and from Employers who post Job Listings.

Business purposes: Providing and improving the Service, processing payments, AI-assisted job matching and content generation, security, legal compliance.

We do not sell or share personal information for cross-context behavioral advertising.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

• Material changes: We will provide notice via email and/or a prominent notice on the Service at least 30 days before material changes take effect.
• Minor changes: Non-material changes (such as formatting or clarifications) may be made without prior notice.
• The "Last Updated" date at the top of this page indicates when the most recent changes were made.

Your continued use of the Service after the effective date of an updated policy constitutes your acceptance of the changes.

17. Contact Us

For privacy questions, data requests, or concerns:

Omlist LLC
2443 Fillmore Street, #288
San Francisco, CA 94115

Privacy inquiries: privacy@omlist.io
General support: support@omlist.io
Legal inquiries: legal@omlist.io
Website: https://cozyjobs.ai
Parent company: https://www.omlist.io

We aim to respond to privacy inquiries within 10 business days and to formal CCPA requests within 45 days (extendable to 90 days with notice), or 30 days for GDPR/UK GDPR requests (extendable to 90 days with notice).