Your search is not the product.

What we collect

The minimum needed to run the product: an account (email, hashed password, handle), the workspace records you create (jobs, briefs, resumes, notes), provider configuration you connect (OAuth refresh tokens, encrypted at rest), and billing state if you upgrade.

The Chrome extension stores local connection state and preferences. After you connect your account, it may send lightweight role metadata (such as URL, title, company, and source labels) to check whether a job is already in your workspace. Full job-posting content is sent only when you choose to import or rank that role, or when you turn on auto-import for known job pages.

On Gmail, the extension can show pending recruiter and application replies already linked to your nexste jobs. It uses only the visible account, thread, and composer state needed to open the matching reply, prevent account mistakes, and avoid silently overwriting text. If navigation is required, a short-lived, account-, thread-, and pending-response-bound handoff may be kept in Chrome session storage; it expires and is removed after use. The generated reply is not persisted in extension storage, and the extension does not scan or persist unrelated Gmail message bodies.

Why we collect it

So your search persists between sessions and devices. So your inbox can be matched to roles. So your resume variants can be tied to the jobs they were tailored for. So model providers can parse, rank, classify, and draft the product output you ask nexste to create, including a recruiter reply you request. Nothing else.

Connected email and calendar access

Google sign-in accesses your Google account identifier, verified email address, name and profile image to identify your nexste account. It does not connect Gmail or Calendar. Each integration requires a separate opt-in.

When you connect Gmail or Outlook, nexste requests read-only API access to message metadata and bodies. It scans bounded time windows to detect application and recruiter threads and link them to roles. Selected thread content can be sent to our model providers so nexste can classify job-search messages, match them to jobs, and generate a reply when you request one.

Gmail data includes message and thread identifiers, sender and recipient details, subjects, timestamps, labels, snippets, message bodies and attachment metadata. Google Calendar data includes calendar identifiers and names, event identifiers, titles, start and end times, attendees, descriptions, locations, status and meeting links. nexste also stores derived job-search records: matched roles, application stages, interview context, summaries, suggested next actions and replies. These raw and derived records serve your workspace; aggregated or anonymized versions are subject to the same use and transfer restrictions.

The Chrome extension can insert a generated reply into the matching Gmail composer only after you choose the pending item and explicitly request insertion. This is a local browser action, not a Gmail API write: the base inbox connection does not request Gmail compose, modify, or send scopes. Gmail may autosave the inserted composer text as a draft. The extension never clicks Send, sends mail, deletes, archives, or labels a message; you review the account, recipients, and text, and you decide whether to send it. Inbox content is never used for advertising, resale, credit decisions, or general model training.

You can separately opt in to Gmail draft saving where it is available. Google’s compose permission allows managing drafts and sending email. nexste saves a reply after you review it and click Save draft in Gmail. Where review-and-send is available, it retrieves that saved draft and displays the sending account, recipient, subject and body. It sends only when you separately confirm that exact reply and choose Send reply. Generating, editing or saving a draft never sends it. There is no automatic or bulk sending. We retain body-free save and send receipts to prevent duplicate actions and reconcile uncertain Gmail responses. A short-lived encrypted review snapshot binds confirmation to the displayed message and is held in memory only during the review, without persistent browser storage. Draft credentials are encrypted and stored separately from inbox credentials, using the same Google integration client. Google may combine granted scopes; inbox tracking only reads mail. Disconnecting draft saving clears its local credentials and keeps inbox tracking and sign-in connected. Local disconnect does not revoke Google permissions. Google sign-in uses a separate identity client. Google revocation affects all clients in the revoked project; separate client IDs alone do not isolate sign-in if the projects are shared. Sign-in alone never reconnects inbox, Calendar or drafts. Saved drafts remain in Gmail, where you can edit, delete, or send them yourself. Disconnecting in nexste does not revoke Google’s grants.

When you connect Google Calendar or Outlook Calendar, nexste requests read-only access to calendar and event details so interviews, recruiter meetings, and prep reminders can appear in your workspace. We never create, edit, cancel, or respond to calendar events on your behalf.

What we share

Nothing with advertisers. Nothing with data brokers. We use Stripe for payments, infrastructure providers for hosting/storage/database work, email and anti-abuse providers for support and account operations, and model providers for parsing, ranking, tailoring, inbox classification, and replies you request. Those providers process data only to operate nexste and not for general model training.

Connected Google data and derived job-search context are processed by our hosting and database providers, including AWS. Relevant message text and job context may be sent to OpenAI, or through OpenRouter to model providers, to classify your inbox and produce the user-facing output you request. We restrict OpenRouter requests to providers that do not collect prompts for training and disable stored OpenAI responses by default. Provider security and abuse-monitoring retention may still apply. We do not share raw, derived, aggregated or anonymized Google data with advertisers, data brokers, information resellers or lenders, or use it to determine creditworthiness.

Limited Use

nexste's handling of user data adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. nexste's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. nexste's use and transfer of information received from Google Workspace APIs also adheres to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

Raw, derived, aggregated and anonymized data received from Google Workspace APIs is not used to develop, improve or train general or non-personalized AI or machine-learning models. We do not transfer it to services for that purpose. Processing a message to classify it or create output for your workspace is inference, not model training. Human access to connected Google data is limited to your affirmative agreement to review specific data, necessary security or abuse investigations, legal obligations, or permitted internal operations using aggregated data under the Limited Use requirements.

Data protection

nexste uses HTTPS for browser and Google API connections, encrypted database storage, and application encryption for stored OAuth credentials. Account sessions and workspace ownership checks limit access to connected data. Provider permissions are checked before use; sign-in does not enable an integration, and a connected read feature cannot use broader permissions to send or modify mail or Calendar events.

Retention and deletion

We retain connected-account credentials while that feature is connected. Disconnecting removes its local credential and sync cursor and stops future access. Previously imported messages, Calendar context and derived workspace records remain available until you delete the relevant records or request account deletion. Disconnecting does not remove Google permissions or delete a draft already saved in Gmail.

An account-deletion request immediately removes synced email threads, Calendar events and local Gmail draft and send receipts from the active database and clears connected-account OAuth credentials. Remaining account and workspace records are removed when an operator completes the final account purge. A deletion request records a target date seven days later, but this is not a guaranteed recovery period; there is no in-app cancellation or restoration control. Final erasure removes account-linked database records; security and deletion audit records, legally required records and anonymized product-event counts may remain for their stated operational purposes. We do not keep Google message bodies or Calendar event details in those product analytics counts. Database backups expire on their configured retention schedule rather than being edited in place. Contact support for the status of a deletion request or backup-retention questions.

Your rights

You can request an export, request account deletion, or disconnect providers from your settings page. You can also contact support to request deletion of imported connected-account data. The retention and deletion section explains local cleanup, operator fulfillment and backup limitations.

Contact

Privacy questions, data requests, or concerns: write to our contact form with the subject Privacy or email [email protected]. We'll get back inside two business days.