Privacy Policy

Coverage is a personal tool for networking in investment-banking recruiting. You sign in with Google, and what you save is kept in yourCoverage account so it's on every browser and computer you use. This page explains exactly what is stored where, who it's shared with, and the choices you have. Questions or deletion requests: nagong1@g.ucla.edu.

1. Your account and what it stores

Signing in. “Sign in with Google” gives us your Google account's ID, name, email address and profile picture (the openid email profile permissions, nothing else). We keep them as your account, plus one-way hashes of the random session tokens that keep each of your browsers signed in (a cookie, 30 days after you last used it).

Your data. Your contacts, spreadsheet (the file and its parsed tabs), drafts, templates, settings, resume, signature logo, coffee-chat transcripts and grades, the recipients of your last 120 days of sent mail (to spot bankers you emailed who aren't in your tracker), your job applications and the application info you enter for autofill (contact details, home address, education, work authorization, and any voluntary self-identification answers such as gender, race, veteran or disability status), your writing samples and extra resumes, and the API keys you add are saved to your account on our servers, encrypted (AES-256-GCM), so they follow you to every browser you sign in to. They're only decrypted to send them to you. Each browser also keeps a copy (IndexedDB) so pages load quickly; signing out removes that copy.

What stays in one browser: the link to a spreadsheet file on your computer that Coverage saves into, your color theme and similar display preferences, and the capture key on your phone's capture page. Data saved in a browser before accounts existed stays there until you move it into your account (we offer a full backup download first) and click Remove this browser's old copy. Signed out, you see a demo with made-up data; nothing you do there is saved.

2. What our server uses while your dashboard is closed

If you connect Google (Settings → Account, or Follow-ups → Reminders), our server also keeps what it needs to work while your dashboard is closed:

• A random account ID, and a one-way hash of a random secret your browser created (no name or password).
• Your Google refresh token, encrypted (AES-256-GCM), the Gmail address it belongs to, and which permissions you granted. Short-lived access tokens made from it (about an hour) are cached encrypted and handed to your signed-in dashboard, so its own Gmail, Calendar and Docs features work without Google pop-ups.
• The queue of emails you scheduled: Gmail draft IDs, the contact's name, and the send time. Not the email text.
• If you use WhatsApp reminders: your WhatsApp number and CallMeBot key (encrypted), and the next two weeks of reminder lists (names, email addresses and labels such as “Follow-up #1”), plus the names, email addresses, firms, LinkedIn profile links, last-emailed dates and last-logged-conversation dates of people who replied to you, have a call with you or met you at an info session (to recognize them on your calendar and link their profile in the evening text).
• Your time zone, so reminders arrive at 9 PM your time.
• If you allow reply tracking (read-only Gmail): the names and email addresses of the people in your tracker you've emailed or talked to, and for each one what Gmail showed: dates you emailed them and they replied, Gmail message and thread IDs, other addresses they wrote from, and people they added to a reply (name and email). The text of their newest replies (at most 1,500 characters each, quoted history removed) waits for at most 14 days until your dashboard reads it, and is deleted as soon as it does.
• If you use info-session capture: the photos, screenshots and text you send from your phone (the capture page, your phone's share sheet, or a text to your own Twilio number), and which info session they belong to. They wait for at most 14 days until your dashboard pulls them in, and are deleted as soon as it does. Also a random capture key (a one-way hash, plus an encrypted copy so reminder texts can include your capture link).
• If you connect a Twilio number: your Twilio Account SID and Auth Token (encrypted), the Twilio number, and your own phone number (only texts from it are accepted). We set that number's incoming-message address to Coverage.

If you connect Coverage to Claude (or another AI app that supports MCP connectors) and approve it on the Connect page, that app can read what this section lists for your account (tonight's to-dos, replies, thank-yous, intros found in replies, scheduled sends) and cancel a scheduled send when you ask it to. It can't send email or read the rest of your mailbox. What it reads is handled by that app under its own terms (for Claude, Anthropic's). We keep the app's registration and one-way hashes of its access tokens (1 hour) and refresh tokens (90 days); turning automatic sending off revokes them.

Turning automatic sending off deletes all of this and revokes our Google access; deleting your account (section 8) deletes everything. To limit abuse, the server also keeps your IP address for up to an hour in a rate-limit counter. It is not linked to your account.

3. Gmail and Google data

With your permission, Coverage uses Google's Gmail API. In your browser it can read your sent mail and replies to people in your tracker (to fill in when you emailed them and whether they replied) and create drafts. On our server, with automatic sending on, it can send drafts you scheduled (the gmail.compose permission). If you also allow read-only Gmail access (gmail.readonly), the server searches your mail every hour (people you were recently in touch with) or every six hours (everyone else) for messages to or from the people your dashboard tracks, and reads the headers of those threads (from, to, cc, subject, date) and the text of their replies, to know whether you thanked them, whether they replied, and whether they introduced you to someone. It reads nothing else in your mailbox, and keeps only what section 2 lists. If an AI model is set up in your dashboard, your browser sends those reply texts to it to spot referrals and promises. If you also allow read-only Calendar access (calendar.events.readonly), the server reads that day's events once in the evening (9 PM your time), only to list the people you met so you remember to thank them, log the conversation and connect on LinkedIn. With WhatsApp reminders on, it also reads the next few hours of your calendar every hour to find info sessions (events titled like “… Info Session”) and text you before and after each one, and it lists your info sessions for the dashboard's Info sessions page and your phone's capture page. When you open the dashboard's Calendar page (or press Sync), it reads your events from three weeks back to six weeks ahead and sends them to your browser, which picks out coffee chats and info sessions. Event details are used for those texts and lists and not stored (only a marker that a reminder was sent, for 3 days).

If you allow read-only Google Docs access (documents.readonly and drive.metadata.readonly, on the automatic-sending connection or, without it, as a separate permission in your browser), Coverage searches your Google Drive by the names of people you've had conversations with (file names, and docs that mention them) to link each conversation to its notes doc, and reads the text of a linked doc when it writes an email that mentions that conversation. The doc's text is sent to your browser and, if an AI model is set up, the part about that person is sent to it to write one sentence. Nothing from your docs is stored on our server; the dashboard keeps only the doc's link and title in your browser.

If you use Schedule calls, your browser also reads the latest email from that banker (to see which days and time zone they asked for, and their phone number), and your Google Calendar (calendar.events and calendar.freebusy, granted with Connect Google or as a separate permission in your browser): your free/busy times, so offered times skip your events, and creating the call event with the banker as a guest. Calendar data is used only in your browser and isn't stored on our server. If an AI model is set up, the text of that one reply is sent to it to read the request.

To protect you from emailing senior bankers by mistake, your browser lists your Gmail drafts and scheduled emails (recipients and subject only) and compares them with your contacts' titles. If you click Label them in Gmail, it asks for permission to manage labels and adds a “⚠ VP+ check” label to those messages. Nothing else in your mailbox is changed.

Coverage's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google data, use it for ads, use it to train AI models, or let anyone read it. The only exception is something you ask for, such as sending an email's text to the AI model you chose to draft or improve it.

4. Services you connect

You bring your own accounts for enrichment, search, AI and alerts. When you use a feature, your browser sends the request through our server, which passes it to that service with your key and returns the answer. The server doesn't keep the request, the answer or the key. Depending on what you connect, that means:

• Apollo, Hunter: a contact's name, firm and LinkedIn URL, to find a work email.
• Serper, Brave: search queries, to find bankers and public background for coffee-chat prep, including a bank's name and your sector interests for its recent deals (bank brief).
• Your AI provider (Anthropic, OpenAI, Google Gemini, DeepSeek, Z.ai, Vercel AI Gateway, or one you configure): contact details and draft text, to screen candidates and write emails, a coffee-chat transcript you upload or paste, only when you click Grade it, to grade the call, and, when you click Build brief on a bank, the bank's name, your profile and interests, and your own notes about that bank and its contacts (firm notes, tracker comments, call notes, chat summaries), to write your “Why this bank” answer, and the photos and notes you captured at an info session, sent by your browser when you review them, to read out the names of the people you met, and, when you use application autofill, the open questions on that application form, the visible text of the application page, and your education, the background and interests you wrote, your answer library and your writing samples, to draft answers in your voice. Your address, phone, email, work authorization and self-identification answers are never sent to the AI.
• CallMeBot (WhatsApp), ntfy, Twilio: the reminder text, to send it to you. Twilio also delivers the texts and photos you send to your own Twilio number.

Each of these services handles data under its own privacy policy.

5. Hosting, storage and analytics

The app runs on Vercel. Account data (sections 1 and 2) is stored with Upstash (Redis), large files (spreadsheets, resumes, your logo) in Vercel Blob (private, encrypted at rest by Vercel), and timed jobs run on Upstash QStash. We use Vercel Web Analytics and Speed Insights to count page views and measure page speed. They use no cookies and don't identify you across sites. You can turn them off in the notice at the bottom of the page, or under Settings → Backup.

6. Cookies and local storage

Coverage doesn't use advertising or tracking cookies. Signing in sets one cookie (coverage_session, HttpOnly, for this site only) that keeps you signed in, and a short-lived one during sign-in (coverage_signin, 10 minutes) that protects it from forgery. Google's sign-in window may set its own cookies on google.com. Each browser keeps a copy of your data (section 1) because the app can't work without it. On your phone, the capture page stores your capture key in local storage and in one cookie (coverage_capture, sent only to the share address) so sharing photos from your phone's share sheet works.

7. LinkedIn and the browser extension

Coverage doesn't scrape LinkedIn. The optional bookmarklet reads only the LinkedIn page you have open, when you click it, and hands that text to your own dashboard.

The optional Coverage extension for Chrome and Edge works the same way. It reads the page in your current tab only when you click its button (the browser's “activeTab” permission), and opens your dashboard with that text in the address's fragment, which browsers don't send to any server. It has no access to other tabs or sites, and sends nothing to us or anyone else. It stores one setting, your dashboard's address, in your browser's extension storage.

Application autofill (extension 1.1+): when you click Autofill this page on a job application, the extension reads that form's questions and the page's visible text, and passes them to your open Coverage tab, which decides what goes in each field from the application info you saved and returns those values (and your resume file, for upload fields). The extension then types them into that form, picking the matching choice in dropdowns, and on multi-page forms pressing Next only when you ask it to go on. It never submits an application or presses Submit, never reads your browser's saved passwords, fills a password only from saved logins you added to the extension yourself (below), and never fills Social Security numbers, bank or card details. Until you submit, nothing leaves your browser except the AI request described in section 4; when you submit, the employer receives your application under its own privacy policy. To talk to your dashboard tab, the extension runs a small script on Coverage's own pages only. Details: extension privacy policy.

Fill selected (extension 1.3+): when you press Fill selected on Applications, the extension opens those jobs in a tab group and fills each the same way, on application sites you allowed in the extension. If you turn on saved logins in the extension, it can sign in to application accounts you already have: those logins are encrypted with your PIN inside the extension and used only on the site they were saved for. So they follow you to your other browsers, the extension keeps that encrypted copy in your Coverage account (extension 1.3.1+); your PIN never leaves the extension, so neither we nor your dashboard can read a login, and logins are never sent to any AI.

Find jobs: the search you start on Applications runs through Coverage's server, which reads public job lists from the career boards involved (Workday, Greenhouse, Lever) and, with your Serper or Brave key, a web search. It sends those services only your search words, the years you picked and the names of banks on your list; nothing is stored or logged.

8. Your choices and rights

• Download everything: Settings → Account → Download everything (one file with all your data and files).
• Delete your account: Settings → Account → Delete my account deletes everything we store for you (your data and files, Google access, which is revoked, the send queue, texts, captures and connector tokens) and signs you out everywhere.
• Turn off Google access only: Follow-ups → Reminders → Turn off. You can also remove access at myaccount.google.com/permissions.
• Remove this browser's copy: sign out (or clear your browser storage).
• Ask what we hold, or ask us to delete it: email nagong1@g.ucla.edu. Include the Google address you sign in with.

9. Security

Traffic is HTTPS only. Secrets on our server are encrypted, server credentials are stored only as hashes, job calls are signed, and API routes are rate-limited. No system is perfectly secure. Use strong passwords on the accounts you connect.

10. Children

Coverage is meant for university students and isn't directed at children under 13.

11. Changes

If this policy changes, the date at the top changes too. Material changes will be noted in the app.