Privacy Policy

This Privacy Policy governs the operation of F.R.I.D.A.Y. (Female Replacement Intelligent Digital Assistant Youth), developed by Alpha Software Solutions ("we", "us", "our"). F.R.I.D.A.Y. is a private personal AI assistant and career automation client engineered for local-first execution on authorized macOS workstations.

1. Google API Data & Permissions Requested

F.R.I.D.A.Y. requests access strictly to one restricted Google OAuth scope:

https://www.googleapis.com/auth/gmail.readonly — Read-only access to messages and metadata in your Gmail account.

F.R.I.D.A.Y. does not request, cannot access, and does not possess permissions to compose, send, modify, delete, or manage messages, settings, drafts, or labels in your Google account.

2. Purpose & Scope of Data Processing

Gmail access is utilized exclusively for automated identity verification during authorized job and internship application submissions:

• Applicant Tracking System (ATS) Verification: During online application flows, employer systems (such as Workday, Greenhouse, Lever, and Ashby) frequently email a short-lived one-time passcode (OTP) or magic sign-in link to confirm candidate ownership of the submitted email address.
• Strictly Scoped Queries: F.R.I.D.A.Y. queries messages using tightly bounded filters:
  from:({ats_domain}) to:{applicant_email} after:{attempt_start_timestamp}
• No General Mailbox Scanning: F.R.I.D.A.Y. never reads, indexes, or browses general inbox messages, personal email threads, newsletters, financial statements, or any messages outside the active ATS query criteria.

3. Credential Storage, Session Security & Token Lifecycle

Authentication credentials and session states are protected through operating-system security controls:

• macOS Keychain Services: OAuth access tokens and refresh tokens are stored in the user's macOS login keychain under service com.friday.career.gmail_oauth, protected by operating system user authentication and AES-256 keychain encryption.
• Session State Security: Browser session states and cookies utilized for employer portals are stored locally on the workstation filesystem with owner-only access permissions (POSIX mode 0600). Secrets and tokens are never committed to source control or logged to plaintext files.
• Token Lifecycle: OAuth refresh tokens are long-lived to facilitate automated background operation, but remain subject to standard Google lifecycle and revocation policies. Tokens are not unconditionally permanent; they can be revoked at any time by the user, invalidated by a Google account password change, or expired according to Google's standard inactivity policies.
• Authorization Security: Initial OAuth authorization utilizes Proof Key for Code Exchange (PKCE with SHA-256) and cryptographically secure state parameters. Local loopback redirects bind strictly to 127.0.0.1 on local ephemeral ports.

4. Data Retention Disclosures

Data retention within F.R.I.D.A.Y. is separated into email content handling and local operational tracking:

• Email Content (Zero Long-Term Retention): Verification passcodes and authentication links extracted from Gmail are retained in volatile memory dataclasses solely for the immediate, in-flight form completion step. Once submitted into the employer portal, the transient object is cleared. Raw email body texts, subjects, attachments, and headers are never written to disk, SQLite databases, or permanent application logs.
• Local Application Records: To prevent duplicate submissions and allow application status monitoring, F.R.I.D.A.Y. retains local operational records in an on-device SQLite database (career.sqlite). This includes employer names, job requisition URLs, application timestamps, submission status, form responses provided to employers, and confirmation receipts. These records are stored strictly on the local workstation.

5. Third-Party Sharing, Advertising & AI Training Disclosures

In accordance with strict privacy principles and Google API policies:

• No Commercial Sale or Sharing: We never sell, rent, license, or share Google user data with data brokers, advertisers, or commercial third parties.
• Target Employer Transmission: Verification codes or links retrieved from Gmail are transmitted solely to the specific employer ATS portal authorized by the applicant to finalize the submission.
• No AI Model Training: Google user data retrieved via Google APIs is never used to train, retrain, fine-tune, or improve generalized machine learning or artificial intelligence models.
• No Human Review: No human (including developers, system operators, or contractors) reads or reviews your Google user data.

6. Google API Services User Data Policy Compliance (Limited Use)

7. User Control, Revocation & Local Data Purge

Users maintain complete control over application access and local data:

• Revoke Google Access: You can revoke F.R.I.D.A.Y.'s access at any time through your Google Account:
  Google Account Security — Third-Party Apps with Account Access.
• Purge Stored Tokens: You can delete all stored OAuth credentials from macOS Keychain at any time using Keychain Access or the macOS terminal:
  security delete-generic-password -s com.friday.career.gmail_oauth -a <your_account_email>.
• Clear Local Application Data: Local application history and session states can be deleted at any time by removing the application data directory located at ~/Library/Application Support/FRIDAY/career.

8. Changes to this Privacy Policy

If our operational practices or integration scopes change, this policy will be promptly updated with a revised "Last Updated" date. Material changes will be noted on the official homepage.

9. Contact Information

For questions, privacy inquiries, or technical verification regarding F.R.I.D.A.Y., please contact:

Alpha Software Solutions
Privacy & Developer Operations
Website: alphasoftwarehq.com
Email: contact@alphasoftwarehq.com