Privacy Policy

Last updated: August 2026

1. Controller

Simple UG (haftungsbeschränkt) c/o ADIUVO Rechtsanwälte PartG mbB Grafenberger Allee 125 40237 Düsseldorf, Germany Email: Support@tryapplyos.com Hereinafter referred to as "we" or "provider".

2. Collection and Processing of Personal Data

We only process personal data insofar as it is necessary for providing the app and this website. Processing is based on Art. 6(1) GDPR.

3. Data Processing in the App

ApplyOS can only be used with a user account. When you register, we create an account on our servers (Supabase). Your profile and application data are stored on your device and synchronized with your account so that they remain available across devices and are not lost if you lose your device. The legal basis is Art. 6(1)(b) GDPR (performance of contract). For AI-assisted processing of your data, we obtain separate consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the app's privacy settings. The following data is processed:

• Profile data (skills, work experience, preferences)
• Job listings and application status
• Generated documents (resumes, cover letters)

4. AI-Powered Features

Core features of ApplyOS use large language models (AI). This processing takes place exclusively on the basis of your separate, explicit consent (Art. 6(1)(a) GDPR), which we obtain before first use and which you can withdraw at any time in the app's privacy settings with effect for the future. Without consent, the AI features remain disabled; the rest of the app remains usable. For AI processing we use the service OpenRouter (OpenRouter, Inc., USA) as a technical intermediary, which forwards the requests to language models operated by Google (Gemini). The following features use AI and transmit the data listed:

• Cover letter generator: first and last name, desired job, skills and career history, plus the job description
• Résumé analysis: the text of your uploaded résumé — directly identifying details (name, address, email, phone number, date of birth) are removed on your device before transmission
• ATS optimization: profile summary, career history and skills (without name and contact details), plus the job description
• Culture analysis and task summary of job postings: only the text of the job posting and the company name, no data from your profile
• Interview preparation: job description and its analysis results, no data from your profile
• Career field matching: your desired job and your skills, without name and contact details

The servers of OpenRouter and Google are located in the USA. We base this third-country transfer on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). In addition, we submit all requests with the binding requirement that they may neither be stored by the provider nor used for training AI models (zero-data-retention configuration); they are processed solely to generate the immediate response. Each AI feature is subject to a usage limit. AI-generated content is labeled as such in the app. No automated decisions with legal effect within the meaning of Art. 22 GDPR are made — you make all application decisions yourself. We log the granting and withdrawal of your consent (date, version of the consent text) as proof under Art. 7 GDPR; this log is deleted together with your account.

5. Abuse Prevention (Apple DeviceCheck)

To prevent free usage quotas from being circumvented by repeatedly deleting and re-creating accounts, we use Apple's DeviceCheck service (Apple Inc.). Two device-related marker bits are stored with Apple; only we know their meaning, while we in turn receive no device identifier — we cannot identify your device or your person through this. We only store the check result (quota available/used up) with a month reference linked to your account; it is deleted together with your account. The legal basis is our legitimate interest in preventing abuse of our free services (Art. 6(1)(f) GDPR). You may object to this processing under the conditions of Art. 21 GDPR.

6. Usage Statistics and Error Diagnostics

Only with your explicit consent (Art. 6(1)(a) GDPR) do we collect statistical usage data and error reports in the app via PostHog (PostHog Inc.), operated on servers in the EU (Frankfurt). Consent is disabled by default and can be withdrawn at any time in the app's privacy settings. Only predefined events are collected (e.g. which features are used) as well as technical crash and error reports — no application data, no free text, no search terms, and no location data; the IP address is not stored. The data is processed under a random, device-based identifier with no link to your user account. If you withdraw consent, this identifier is discarded; renewed consent starts with a new identifier.

7. Purchases and Subscriptions

Subscriptions (ApplyOS Plus / Studi) are purchased as in-app purchases via Apple. Payment processing is carried out exclusively by Apple as an independent controller; we never receive payment or credit card data. To provide premium features, we process subscription information: product identifier, a pseudonymous Apple transaction number, subscription status, and expiry date, linked to your user account. Apple notifies our servers of status changes to your subscription (e.g. renewal, cancellation, refund). The legal basis is Art. 6(1)(b) GDPR (performance of contract). This data is deleted when you delete your account.

8. No Sharing with Corporate Clients

ApplyOS has no corporate clients. Your data is not sold or shared with employers, recruiters, or any other third parties.

9. Hosting and Website

This website is hosted by Vercel Inc. When visiting the website, technical data (IP address, browser type, access time) is automatically stored in server log files.

10. Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. For this, please contact the email address mentioned above.

11. Contact

For questions about data protection, please contact: Support@tryapplyos.com