Privacy policy

It's a Numbers Game is a job application tracker run by Shapes.IO. This page says exactly what the app stores, who else it passes through, and how to make it all go away. It describes what the software actually does today — if the two ever disagree, the software is the bug.

What we collect

Only what you type in, plus the minimum needed to keep an account working:

• Your account— email address, a bcrypt hash of your password (never the password itself), an optional display name, and whether you've confirmed your email.
• Your profile — anything you choose to save for autofill: name, email, phone, postal address, and links to LinkedIn, GitHub or a personal site. If you import a resume, the extracted text is stored too.
• Your saved answers — the question and answer pairs you add for application forms.
• Your applications — company, role, link, status, dates, notes and the log entries you write against each one.
• Extension tokens — a hash of each browser-extension token you generate, its label, and when it was last used.
• Abuse-prevention records — when someone fails a sign-in or requests an account email, we record the IP address or email address involved and the time, purely to rate-limit it. These rows are deleted about an hour later.

There is no analytics, no advertising, no tracking pixels and no third-party scripts on this site. We don't build a profile of you, and there is nothing to sell.

Cookies

One cookie: the session cookie that keeps you signed in. It is strictly necessary for the app to function, which is why there's no cookie banner — there is nothing optional to consent to. Signing out or deleting your account clears it.

Why we're allowed to hold it

Everything above is here because you asked for an account and put it there: we hold it to provide the service you signed up for. The abuse-prevention records are the one exception — those exist so other people can't brute force your password or use the app to send mail to strangers.

Who else sees it

We use a small number of service providers to run the app. They only ever process data on our instructions:

• Vercel — application hosting. Requests to the site, including IP address and browser user agent.
• Neon — database hosting. Everything you store: account, profile, applications and notes.
• Anthropic — resume and profile extraction. The text of a resume or LinkedIn profile you choose to import.
• SMTP email provider — account email delivery. Your email address, for confirmation and password-reset messages.

Nobody else. We don't sell data, share it with advertisers, or hand it to anyone for their own purposes.

AI and your resume

When you import a resume or pull details from a LinkedIn page, the text of that document is sent to Anthropic's API so a model can pick out the fields — name, contact details, and any recurring application answers it finds. The extracted fields come back and are saved to your profile.

• This only happens when you choose to import. Nothing is sent in the background.
• Under Anthropic's commercial API terms, inputs sent through the API are not used to train its models.
• Your applications, notes and account details are never sent to a model — only the document you explicitly import.
• The model can misread a document. Everything it extracts lands in an editable form for you to correct, and none of it is treated as advice.

How long we keep it

Your account data stays until you delete it — we don't expire accounts for inactivity. Password-reset and email-confirmation links expire on their own and are single-use. Abuse-prevention records are swept about an hour after they're written.

Deleting your data

You can delete your account yourself, at any time, from your profile page. It removes the account and everything attached to it — applications, log entries, profile, saved answers and extension tokens — immediately and permanently. There is no grace period and no undo, so save anything you want to keep first.

Want a copy of your data instead, or want deletion handled for you? Email support@shapes.ioand we'll action it by hand within 30 days.

Security

Passwords are stored as bcrypt hashes. Extension and email tokens are stored as hashes too, so a database leak doesn't hand anyone a working link. Changing your password signs out every other session. Every query is scoped to the signed-in account, so one account cannot read another's data.

Who we are, and how to complain

Reach us at support@shapes.io for anything on this page — access, correction, deletion, or a complaint.

The registered legal entity and governing jurisdiction for this service are not yet finalised, and we'd rather leave this blank than state something inaccurate. This section will name the operating entity, its address, and the supervisory authority you can complain to, before the service is promoted publicly.

Changes

When the app starts collecting something new or adds a new provider, this page is updated in the same release, and the date below changes with it.

Last updated 17 August 2026.