Second Summit

Privacy Policy

Effective October 14, 2026

This is the beta version of our policy. We will update it as the service grows, and tell you about material changes.

Second Summit ("we", "us") helps people find jobs and prepare applications. This policy explains what we collect, why, who handles it, and your choices. Questions: support@secondsummit.ai.

What we collect

• Account: your email address and a password (stored only as a salted hash by our authentication provider), or your Google account email and name if you sign in with Google. We receive only the basic profile that Google shares for sign-in.
• What you give us: your resume, as text, as a file (PDF, Word or text), as photos of its pages, or as a link to a Google Doc or Drive file you have shared with "Anyone with the link" (for a link we fetch the document once, keep only its text, and do not store the link; photos are sent to our AI provider, Anthropic, to read the text, and are deleted as soon as they are read); the job titles, cities, remote preference, seniority levels, salary minimum and career goals you enter; your survey answers for cover letters; the application answers you choose to save (for example work authorization, salary expectation, start date, links); jobs you add by paste or link; short verification codes that employers email to your Second Summit application address (we keep only the code, the employer name and the sender's website, for about one hour, so you can copy it into the application; we do not keep the email); and the status, notes and ratings you set on jobs.
• What we create for you: match scores and reasons, tailored resumes, cover letters, ATS keyword reports, skills-gap and insight summaries.
• Monthly data brief (optional, only if you sign up): your email address, the area you pick (if any), the page you signed up on, when you confirmed, and a one-way hash of your network address used only to limit abuse. We use it only to send the brief; every email has a one-click unsubscribe, after which we keep only a record that you unsubscribed so we never email you again.
• Usage and billing: when you use AI features (type, time, size and cost, used to enforce daily limits), error logs, and your plan status. If paid plans are introduced, payment card details will be handled by our payment processor and we will never see full card numbers.

Analytics on our public website

Our public website (secondsummit.ai: the home page, guides, tools, data pages and this policy) uses Google Analytics to count visits and see which pages people read. Google Analytics sets cookies and collects things like the pages you view, how you arrived, your device and browser, and your approximate location. We do not use it for advertising and do not turn on Google's advertising features. It does not run in the Second Summit app or in Trailhead; the app counts how its features are used with our own anonymous counts, which are not linked to your name or email.

It stays off if your browser sends Global Privacy Control or Do Not Track. You can also switch it off for this browser:

Sign-in suggestions

If you use "Want a different way to sign in?" on the sign-in page, we record the option you chose (and any text you type under Other) with the date. It is not linked to an account or email address. We keep a one-way scrambled form of your network address for about a day's worth of rate limiting to stop abuse.

Technical error reports

When the app hits a technical problem, it sends us a short anonymous report so we can fix it: the error text (with email addresses, tokens and link details removed), the app version, the type of phone or browser, and which screen it happened on. It never includes your resume, documents or anything you typed. We keep these reports for 14 days.

Application results (Trailhead)

To learn where applications get stuck, Trailhead can record a short anonymous result for each application attempt: which employer job-site address the attempt was on (the website address only, never the page or the job), not who you are or what you typed; which application system it was (for example Greenhouse or Workday), whether it happened in the iPhone app or the browser extension, and the day; how far it got (for example the review page or the confirmation page); how many form fields it found, filled and left for you; what kind of problem stopped it (for example a sign-in wall); how long each step took and your longest pause; how you left (for example by closing the tab or going back to the app); which kinds of form fields it could not fill for you, as counts (for example phone number, work authorization or a dropdown; never what was in them and never your answer); and, if you tap it at the end, whether it went well, with an optional reason chosen from a short fixed list (there is no text box). It never records what you typed, your answers, your name or email, your resume or documents, or the job title. It is not linked to your account. Attempts made by our own team and by test accounts are marked as such and left out of the numbers we use. To count how many different people hit a problem on a given day, each result carries a scrambled code made from your account and a random value that is changed every day and then thrown away, so we cannot tell whether the same person tried several sites over time, and nobody can rebuild a list of the sites you tried. We keep these results for 180 days and then delete them. You can turn this off at any time in Settings (“Help improve Trailhead with anonymous results”); turning it off stops recording immediately.

The same switch covers a simple count of how the resume designer is used: when you open it, which look you pick, whether you save for one resume or all, and which kind of file you download or Trailhead attaches (for example PDF, Word or the print version). It carries the same daily-changing scrambled code, never your resume or anything you typed, and is kept for 180 days. If you create a personal site, the same switch covers a simple count of what happens to it (created, published, taken down, look changed). Visits to a published site are counted only as a number per day, with nothing about the visitor.

What we do not collect

We do not read your email, connect to your accounts on other sites, or access LinkedIn, Indeed or similar accounts. We do not sell your data and do not use it for advertising.

How we use it

To run the service: find and score jobs for you, generate the documents you ask for, keep your history, limit abuse and cost, send account emails (confirmation, password reset and service notices), and fix bugs and improve the product.

Who handles it (service providers)

• Supabase (database and sign-in) and Netlify (hosting and server functions) store and process your account and content.
• Google provides sign-in if you choose "Continue with Google".
• Anthropic (AI model provider) receives the text needed for each AI request, for example your resume and a job description, to produce scores and documents. It handles that text under its own commercial terms and privacy policy.
• Resend sends account emails. Stripe will process payments if paid plans are introduced.
• Job data providers: we receive public job postings from employers' career pages and licensed job-data services. Searches are made from our servers using job titles and places only, shared across users, and never include your personal data.

These providers act on our instructions under their own terms and privacy commitments.

Browser extension (apply assistant)

Trailhead is our optional Chrome extension. It runs by itself only on employer application pages hosted on Greenhouse, Lever, Ashby, Workday and iCIMS. On Greenhouse, Lever and Ashby it fills the form from your confirmed profile, saved answers and tailored resume and cover letter in your Second Summit account. On Workday and iCIMS it helps with sign-in, plain text boxes, and your saved answers and resume. It never answers legal, demographic or consent questions for you, and it never presses Next or Submit: you review the form and submit it yourself.

On any other page it does nothing unless you click its toolbar icon, and then it reads the form fields of that one page. It asks Chrome only for the storage, activeTab and scripting permissions; it has no history, tabs or cookies permission, and it never runs on LinkedIn, Indeed or Google. It also runs a small bridge on Second Summit's own pages so the extension can pair with your account. It keeps nothing about the pages you visit beyond the job link of the current tab and a cached list of sites it has been switched off on, and it keeps its connection token in your browser only. When you ask for a drafted answer to a free-text question, it sends the text of that question and the job to our AI function.

Anonymous results: unless you turn off "Help improve Trailhead with anonymous results" in Settings, it sends us records of how a run went: the type of site, the steps reached, counts, times, categories and a rating if you give one. These never contain your answers, field labels, values, names or page text. If that same box is on and the extension could not fill a question, it may also send the text of that question (for example, a question about security clearance) with numbers, links and email addresses removed, never your answers and never legal or demographic questions. We use these to teach the assistant new fields. We use this information only to fill your applications and improve the assistant, and we do not sell it or use it for advertising.

In the iPhone app, the employer page you open from a job opens in the app's own browser, where the same Trailhead code runs only on that page, reads its form fields and helps with your saved answers and resume; it does not see anything outside that browser window, and on Workday and iCIMS it does not type for you.

Job postings

Postings come from employers' public job boards and licensed data services and are shown with a link to the original posting. They are not your personal data.

Retention and deletion

We keep your content while your account is active. You can delete individual jobs and documents in the app, and delete your account yourself at any time in Settings (Danger zone), which removes your profile, resume, jobs and documents and cancels any subscription right away. Copies in backups age out within 30 days. Backups age out on their normal schedule. Usage logs without content may be kept for security and accounting.

Your choices and rights

You can access, correct, export or delete your data in the app or by contacting us. California and other US state residents may have additional rights to know, delete and correct personal information and to opt out of sale or sharing; we do not sell or share personal information for advertising, and we will not treat you differently for using these rights.

Security

Per-user access rules in the database keep each person's data private to their account; data is encrypted in transit; secrets are kept on the server. No system is perfectly secure; tell us at support@secondsummit.ai if you find a problem.

Children

The service is for people 18 and older and is offered in the United States only.

Changes

We will post changes here and update the effective date; material changes will be emailed.

Back to Second Summit · Privacy Policy · Terms of Service

More from us: Punch List, the shared to-do list that fills itself in · BookWard, a book tracker that learns why you like what you like