Privacy Policy

Information we collect

Account information. When you sign in with Google, we receive your name and email address through Google and Supabase, our authentication and database provider. We don't collect or store a password — Google handles sign-in.

Profile information you provide. School, expected graduation year, majors, and your recruiting preferences — target roles, industries, locations, season, experience level, work mode, and, only if you choose to answer, whether you'll need visa sponsorship. Every one of these is optional and never required to use Upwind.

Where you'll be based, if you tell us. So we can show you how far each opportunity is — and let you narrow the catalog to the ones within a distance you pick — you can set a general location: your school's city, or a ZIP code you enter. We store the centre of that city or postal area, never a street address, and we never ask your device for your location or work it out from your IP address. It's optional, you can change or remove it at any time, and without it you simply don't see distances.

Files and links you add. Resumes, cover letters, transcripts, and other documents you upload to your Asset Vault, plus any links you save — portfolio, LinkedIn, GitHub, personal site. Files are stored in a private location only you can access.

Your application pipeline. The companies and roles you're tracking, the stage each one is in, notes you write, next actions, and dates. This is entirely self-reported — we don't verify it and don't obtain it from any employer.

Recruiting contacts and interview notes. If you choose to track a recruiter's name, email, or LinkedIn URL, or notes about an interview — prep notes, a debrief, a schedule, a location — that's stored against the specific application you added it to.

Club membership. Which clubs, if any, you join through Upwind.

Product usage. We log a small set of internal events — like which tab you viewed, or that you marked something as applied — to understand how the product is used. These events carry codes and counts, never the content you typed. See "Who else sees your information" below.

How you found Upwind. If you arrive at Upwind before signing in — from a link carrying campaign tags (the "utm_" labels on links in our posts) or a referral code, or from another website — we store those tags, the code, the other website's domain (not the page you were on), the first Upwind page you opened, and the time in one cookie of our own on your device, for up to 30 days. If you create an account, we copy them onto your account once and delete the cookie. We use this only to learn which posts, partners, and referrers bring students to Upwind. It is not shared with advertisers or any outside analytics company.

Page visits and page speed. When any page of Upwind loads — signed in or not — Vercel, our hosting provider, records an anonymous page view and how quickly the page loaded: the page's address with everything after the "?" removed, the site that referred you, your approximate location (country and region), and your browser, operating system, and device type. No cookies are used, and none of it is linked to your account, your name, or your email.

Feedback you send us. Anything you submit through Upwind's in-app feedback form, plus the page you were on when you sent it.

How we use your information

To operate Upwind — to run your dashboard, pipeline, reminders, and every other part of the product you interact with directly.

To send you reminder emails about deadlines and next actions, and a weekly briefing on Sunday evenings — your next two weeks, plus listings closing soon or newly added that match the field and preferences you gave us — if you haven't turned them off. We also send every account one welcome email, ever: how to get started, and a note from our founder, who reads the replies. Each is chosen by fixed rules, never by AI. Every email links back to your Profile, where you can turn each one off separately at any time, and carries a one-click unsubscribe link. Links in these emails pass through Upwind so we can count which ones get clicked; that's recorded only if you're signed in, as a product-usage event like any other. Our emails contain no images and no tracking pixels, so we can't tell whether you opened one.

To respond to feedback and support requests you send us.

To maintain and improve Upwind — understanding usage patterns, fixing bugs, and deciding what to build next.

To generate aggregate, group-level analytics that we may share with, or sell to, partner clubs and, in the future, partner institutions. This is the one use of your data that isn't purely about running the product for you, so we describe it on its own below rather than folding it into a general sentence.

Aggregate analytics we share with clubs and institutions

If you join a club through Upwind, the club's officers can see aggregate statistics about the club's members as a group — for example, how many members applied to a given company this cycle, or which industries are most common among members. These statistics are never about you individually.

Concretely: a club's dashboard stays locked until it has at least 10 members, and any individual data point in a breakdown — a company, a major, an academic unit — is grouped into a range rather than shown as an exact small number when the group is small. No club officer, and no institution, can see your name, your email, your specific applications, your notes, your files, or your resume through this feature — only counts and ranges about the group as a whole.

We may share or sell this kind of aggregate, group-level information — never your individual, identifiable activity — with partner clubs and, as Upwind grows, partner institutions such as schools and career centers. We're disclosing this plainly because it's a real part of how Upwind may generate revenue, and because it's a condition of using Upwind through a club or institutional partner, not a setting you can opt out of feature-by-feature.

We do not sell your personal information to employers, and we do not give any employer visibility into your individual activity before you choose to apply. What's described here is limited to aggregate, group-level statistics shared with clubs and institutions — not individual data, and not employers.

Anyone we share this aggregate information with agrees not to attempt to re-identify an individual student from it.

Who else sees your information

We use a small number of outside services to run Upwind. None of them may use your information for their own purposes — they process it only to provide their service to us.

We don't use any advertising trackers or third-party cookies. Our own cookies keep you signed in, carry a club's Join link through sign-in, and remember display choices such as light or dark mode; the only other one is described under "How you found Upwind" above, and it is deleted when you create an account. The product-usage events described above are recorded to our own database, not sent to any outside analytics company. The only outside measurement is Vercel's anonymous page-visit and page-speed counting described below: it uses no cookies, isn't linked to your account, and we remove search terms, ZIP codes, and anything else after the "?" in a page's address before it's sent.

• Google — handles sign-in (OAuth). Google sees that you're signing into Upwind; it doesn't see your Upwind data.
• Supabase — our database, authentication, and file-storage provider. Nearly everything described above is stored there.
• Vercel — hosts Upwind, runs the scheduled jobs that send our emails, and counts anonymous page visits and page-load speed (Vercel Web Analytics and Speed Insights). Instead of a cookie, Vercel tells visits apart with a short-lived code worked out from the request, and discards it after 24 hours.
• Resend — sends our emails to you (reminders, the weekly briefing and the welcome email) on our behalf. It sees your email address and what each email says; it doesn't get access to your account.
• Sentry — helps us catch and fix errors. It's configured to not collect personal information, and request details, cookies, and page content are stripped before an error is ever sent to it — it only ever sees a bare account identifier.

Your choices

Update or correct your profile, preferences, files, and pipeline data at any time from within Upwind.

Turn off reminder emails at any time from your Profile, or with the unsubscribe link at the bottom of any reminder email.

Ask us for a copy of your data, or ask us to delete your account and data, by emailing mahmoud@joinupwind.app. We don't yet have a self-service export or delete button in the product — until we do, this is a manual request we'll handle by email, and we'll respond within a reasonable time.

If we ever update this Privacy Policy or our Terms of Service in a way that requires renewed acceptance, an account that doesn't accept isn't deleted — it's paused. Your data stays exactly as it is, you're signed out, and you can come back and accept whenever you're ready to keep using Upwind.

How long we keep your information

We keep your information for as long as your account exists — including a paused, not-yet-re-accepted account, which we keep rather than delete, exactly as described above. We may also keep some information for a period after an account is closed where we have a legitimate business, legal, or security reason to — for example, to comply with the law, resolve a dispute, or maintain security logs.

If you ask us to delete your data, we'll do so within a reasonable time, except for anything we're required to keep.

Security

Your data is protected by row-level security in our database — code that enforces your data belongs to you, not just application logic that happens to check it. Files you upload are stored in a private location that only you can access, and are only ever shared with you through short-lived, signed links. Our error-monitoring tool is configured to never see request content, cookies, or personal data. No method of storing or transmitting data is perfectly secure, but Upwind's data model is built around minimizing what could go wrong.

If we ever experience a security incident that puts your personal information at risk, we'll notify affected users, and any regulators or authorities the law requires, without unreasonable delay.

Children's privacy

Upwind is built for college students and isn't directed at children. We don't knowingly collect information from anyone under 13. If we learn we've collected information from a child under 13, we'll delete it. If you're under 18, using Upwind means you have the legal capacity to agree to this policy and our Terms of Service, or a parent or guardian's permission to do so.

If Upwind is acquired or merged

If Upwind is ever acquired, merged with another company, or has its assets sold, your information may transfer as part of that transaction. Whoever receives it remains bound by this Privacy Policy, or will give you notice if they intend to handle your information differently.

Changes to this policy

We may update this Privacy Policy as Upwind changes. If we make a material change, we'll ask you to accept the updated version the next time you use Upwind — the same acceptance flow that applies today. Every version is dated, and we keep a record of which version you accepted and when.

Your rights under state privacy law

Depending on where you live, a state privacy law may give you rights beyond what's described above — for example, the right to know exactly what we've collected about you, correct it, delete it, or opt out of a "sale" of your personal information as that state defines it. Whether a given law currently applies to Upwind depends on things like how many residents of that state use Upwind, which changes as Upwind grows. If one ever applies to you, we'll update this policy and add the tools it requires, like a "Do Not Sell or Share My Personal Information" option, rather than assume the aggregate-analytics description above is sufficient on its own.

Nothing in this policy or in our Terms of Service waives any right a state privacy law gives you. If anything here ever conflicts with a right you're legally entitled to, the law wins.

Contact us

Questions about this policy, or a data request: mahmoud@joinupwind.app.