Privacy policy
10 October 2026. Published at https://gradgap.co.uk/privacy/.
GradGap is a phone app for finding and tracking UK and Ireland Technology and Finance graduate roles. DFLY Labs Ltd operates and owns GradGap and is responsible for the personal information it stores. Contact [email protected].
Website private beta invite list
If you request private beta access through the website form, we store the mobile number you enter, its country, when you submitted it, and the exact wording you agreed to. We use this information to send one text with a GradGap TestFlight invitation when a beta place is available. Invites are sent in batches, so the text may not arrive immediately and a place is not guaranteed. We do not verify that you own the number at signup and do not use this list for recurring marketing. The legal basis is your consent, which you can withdraw at any time by emailing [email protected]. You do not need to join this list to use the app when it launches publicly.
The list is kept separately from app accounts in our database in Germany. We will delete waitlist numbers within 90 days after sending the invitation text or ending the list. Encrypted backups can retain a deleted number for up to 14 further days. We do not currently use a text-message provider; before sharing numbers with one to send invitations, we will update this notice with the provider and any international transfer details. The invite text will identify GradGap and explain how to opt out.
What we store
- Account: email address, or the Apple account identifier if you use Sign in with Apple. A password is stored only as a hash.
- Profile: name, phone number, education, work rights, and job-search preferences you enter.
- Optional recordings about your job search: the original audio, transcript, and preferences derived for recommendations. Typed descriptions are stored without audio.
- CV PDFs you upload, up to five, including the file name and the text extracted from the PDF.
- Roles you save or dismiss, applications you track, and the status and notes you set.
- Answers you choose to save for a later application.
- Technical logs of API requests, such as the path, status, and time. These logs are not used to build an advertising profile.
Telling GradGap about your search
If you choose to record what you are looking for, your phone transcribes your speech on device. After you choose “Use this”, we save the original audio and transcript privately with your account. Recording before signup stays on your device until you create an account. You can type instead or skip this step.
We send the transcript, not the audio, to OpenRouter to understand your interests. We also send that understanding with job descriptions to rank recommendations. Additional recordings add context to your search; they do not replace previous recordings or change the requirements you selected. The app does not provide a recording library or playback. We do not send these audio files to AI labs or include them in a research dataset. Search recordings and derived preferences are retained while your account exists and removed when you delete it.
Reading your CV
When you upload a CV, we send the text of that CV to OpenRouter so the app can copy education, skills, and similar facts into your profile. OpenRouter is in the United States. We send the text only for that reading. We do not sell it. Deleting your account deletes our copy. We cannot pull back a prompt that has already been sent.
That send is a transfer of personal information outside the UK. OpenRouter’s employment-data terms and the applicable international-transfer arrangements remain under review for this internal test release; we do not represent those agreements as completed. You can ask us for the current details at [email protected].
Applying
You apply on the employer’s own website from your phone and submit the application yourself. If you choose a saved CV, that file is attached to the employer’s form from your phone. Optional application help can suggest short form answers or draft longer replies. A suggestion changes a field only when you tap it; GradGap never submits the form for you.
Before application help sends data, the app asks you to allow AI sharing. It sends your profile, CV evidence, relevant saved answers, application questions and field descriptions, and messages you exchange with the assistant to OpenRouter in the United States. OpenRouter routes suggestions and drafts to Google or OpenAI and their hosting providers. Your uploaded CV text may be used as evidence when no approved CV version is available. Normal suggestions exclude existing control values and credential, payment, verification and upload fields. You can continue manually without allowing AI sharing.
Screenshot sharing is included when you allow AI help. Opening or refreshing the assistant sends a screenshot of the employer page to read its questions. Visible answers, including health, disability or equality information, can appear in that image. Ordinary follow-up messages use retained question context instead of sending the image again. We remember your choice for your account on this device, so closing the browser or signing in again does not ask you again. You can turn AI help off in Settings or by pressing and holding the application chat button. Withdrawal stops new requests but cannot recall data already sent. You can continue manually without AI help.
Drafts are suggestions for you to check. Answers are stored for reuse only when you explicitly save them, at the scope you choose: across applications, for this employer, or for this application. Saved writing examples are drafts, not verified profile facts. Saved answers are included in your data export and deleted with your account. We do not keep assistant screenshots or chat transcripts in production application logs or operational AI traces; provider processing and retention follow the applicable provider terms.
The separate remote-browser Co-Pilot remains unavailable in Release builds. Application help described above runs alongside the employer page on your phone.
Why
We store the account, profile, CVs, and application records to provide the app you signed up for: showing roles, keeping your CVs, reading a CV into your profile, opening an employer’s form on your phone, and tracking applications you mark. We keep encrypted backups so the service can be restored.
Who else sees it
- The app and database run on a server in Germany, reached through Cloudflare. CV files are stored on that same server.
- Apple handles Sign in with Apple. Apple’s privacy policy covers that sign-in.
- OpenRouter, in the United States, receives CV text when you upload a CV, search transcripts and derived interests when you use search personalization, and the application-help data you explicitly allow, as described above. OpenRouter routes application help to Google or OpenAI and their hosting providers.
- We do not sell personal information.
If you choose to share app recordings and crash reports, GradGap uses PostHog to understand how people move through the app and whether applying on a phone works well. PostHog receives your account's user ID, a generated device ID, approximate location inferred from your IP address, app screens and interactions, and screenshots of what appears in GradGap, including employer application pages opened inside the app. Visible text, images, CV previews, and answers you type may appear in recordings. We do not deliberately add your email address, CV file, search text, employer URLs, or application notes as separate analytics event properties. The app does not record until you opt in to this broader recording choice, and you can turn recordings and crash reports off in Settings. Declining does not limit the app.
PostHog stores this data in its EU Cloud. Its service providers may process data outside the UK and EU under PostHog's data-processing terms. Session recordings are set to expire after 30 days, though deletion may take a little longer to finish. We do not use PostHog for advertising or tracking you across other apps. After you accept the current sharing choice, PostHog also receives crash reports with technical details such as the failing code, device and app version, associated with your account user ID. We use them to fix problems. Earlier recording consent does not authorize crash reports; the app asks again for this expanded choice. Crash breadcrumbs, replay logs, and network telemetry are disabled.
Your recording choice applies separately to each device. We store the choice on your phone and sync a consent history to your GradGap account, including when the prompt was shown, whether you allowed or declined recordings, later changes, the consent wording and version, and the app version and build. A random app installation ID keeps each device's choice separate. If your phone is offline, the choice takes effect on that phone immediately and syncs when it can reconnect. This record stays in our backend, including when you decline; it is not sent to PostHog. Older app versions may not have reported a choice. Consent records are included in your data export and removed when you delete your account.
How long
We keep account information, including original search audio, while your account exists. Deleting the account in the app removes the account, profile, phone number, saved and dismissed roles, applications, notes, saved answers, uploaded CVs, search audio, transcripts, and derived search preferences. It stops new PostHog capture on that device and queues erasure of analytics events, crash reports, and recordings already sent to PostHog. External erasure is asynchronous: we retry failed requests and track completion, retaining the account and PostHog identifiers needed for the task until it is complete. PostHog recordings also have a 30-day expiry. You can contact [email protected] about an erasure request. An encrypted backup can still contain a copy of account data for up to 14 days, until that backup is replaced. Backups are for restoring the service, not for other uses.
Your choices
You can see and edit your profile in the app, delete a CV, turn app recordings and crash reports off, and delete the whole account. Settings includes “Download my data”, which gives you a JSON copy of your account, profile, extracted CV text, saved and dismissed roles, applications and notes, saved answers, search transcripts and recording metadata, and preferences. You can also ask for a copy of your original CV files, search audio files, or PostHog data, a correction, or deletion by emailing [email protected]. You can complain to the Information Commissioner’s Office in the UK.
Children
GradGap is for people applying to graduate and early-career roles. It is not directed at children under 16.