Warmada Privacy Policy

Effective date: 2026-10-26 · Version: 2026-10-26

Warmada helps job seekers turn an application into a personal introduction. It is a free beta run by its founders ("Warmada", "we", "us"). It is not yet a company, it charges nothing, and it earns nothing from your information.

This policy explains what we collect through the Warmada website, dashboard, Chrome extension and free lookup (the "Service"), why, who else handles it, how long we keep it, and the choices you have. It also covers the people whose work contact details Warmada looks up (Section 9). The Service is for adults in the United States.

This policy does not cover the sites and services Warmada works alongside but does not run: employers' career sites and application systems, LinkedIn, and Google's own services, including Gmail. Their own policies cover what you give them and what they collect.

Information we receive through Google APIs, and through our Chrome extension, is handled under Google's and the Chrome Web Store's Limited Use requirements (Section 11).

The short version

• We will not sell your information, use it for advertising, or let a data broker use it for its own purposes. The contact-data provider that runs our searches (AI Ark) receives the company and job title you target and, for alumni matches, your school, and nothing that names you or your account. Warmada charges nothing and earns nothing from your information, so nothing about how it runs depends on selling it or advertising with it (Section 4).
• We do not train or fine-tune any AI model on your data, and the AI models our features use are barred by our settings from training on it. The two steps that run outside those settings follow their own providers' terms (Section 3), and the AI tool the founders use to run Warmada has its provider's model-training setting turned off in our account (Section 4). If we ever want to use your data to train a model, we will ask you first, and nothing changes unless you say yes. We do read your feedback on the contacts we suggest, to fix mistakes in how we choose them (Sections 2 and 3).
• The AI models our features use get your information under no-retention, no-training settings. Every AI request that carries it may be served only by providers that commit to keep no copy once they have answered and not to train on it; if none is available, the request fails. Two steps run outside those settings, under their own providers' policies: converting a résumé PDF for a model that cannot read PDF files, and web searches for a company's website. Every AI service our features use is listed at warmada.com/ai-services (Section 3). The AI tool the founders use to run Warmada can see what our logs hold and what an operator shows it, such as the email address on a request we are acting on, under its provider's terms (Section 4).
• The extension sends us nothing about the pages you visit until you sign in, except what you choose to send us, and after that only what Section 1.2 lists.
• Nothing leaves your email unless you approve it. Our Gmail access can send; it cannot read (Section 1.3).
• Your résumé file and its text, the education, work history, skills and links we read from it, your demographic answers, phone number, work authorization, assistant chats and job-search description are encrypted in our database, on top of our host's disk encryption. Section 7 lists what has that extra layer and what does not. Backups are encrypted before they leave our server.
• You can export or delete your data at any time. If you do not use Warmada for 11 months, we warn you, and if you still have not used it 30 days later, we delete your account (Sections 5 and 6).
• People we look up can see, correct or remove what we hold about them (Section 9).

1. What we collect

1.1 What you give us

• Account: your email address and password, stored only as a one-way hash. If you sign in with Google or LinkedIn, the account identifier, name and email address they share with us.
• Profile and résumé: the résumé file you upload and the text we read from it; your name, phone number, city and state, headline, summary, links, school, education, work history and skills; your answers about work authorization and sponsorship, including your visa status in your own words.
• Demographic self-identification: gender, Hispanic or Latino ethnicity, race, veteran status and disability status, which autofill enters on application forms. Each question must be answered to save your profile, and "Prefer not to say" is always an answer; it is what autofill then enters.
• Job search: the roles, locations, work modes and pay you describe, and your chats with Warmada's assistant. Share in a chat only what helps your search: we do not screen what you volunteer, and the whole chat goes to the AI service that runs the assistant (Section 3).
• Job matches: the postings we suggest to you, each with a fit score and a short note our AI writes on why it fits you, and the fit scores we give postings we ranked but did not show you, kept until the posting is 14 days old.
• Outreach: drafts and your edits; the recipients, subject lines and messages you send; LinkedIn notes you generate; the application questions you ask autofill to answer (neither they nor the answers it drafts are kept).
• Your activity: which job matches you save, dismiss or open; the stage you set for an application; your verdict on a suggested contact, and why; when you last used Warmada; and your acceptance of these documents (which version, when, and where).
• Support: what you send us when you write to us.

1.2 What the extension collects

Where it runs. On known job sites: applicant-tracking systems, LinkedIn Jobs, and a few large employers' own careers sites. If you turn on "Detect jobs on every site", it also runs on pages whose address, after the site's name, contains a word such as job, career, apply, position or hiring. That includes pages that are not job postings, such as applications for a credit card, a loan or student aid. It reads those on your device as it reads any page, and sends us nothing about one unless it mistakes it for a job posting. "Run on this page" adds it to the page you are on until you close or reload that page. Once it starts on a tab, it keeps running as you move within that site without reloading, for example from LinkedIn Jobs to other LinkedIn pages, and it keeps reading those pages on your device. It never runs on the sensitive sites we exclude by name, such as email, password managers, major banks and some government services, except those organisations' own careers pages.

What it reads, on your device. The page's visible text, headings, links, buttons and image descriptions, the job data some pages embed, and the shape of any application form, to decide whether the page is a job posting and to notice when you apply. On Workday and Eightfold sites it reads the posting from the site's own job feed. That reading stays in your browser. What is sent to us is listed next.

What we receive. Nothing about the pages you visit while you are signed out, except what you choose to send us: Report a problem opens a page on our site with the job page's address, title and company, ready for you to email to us. Our server reads the report from that link only to show it to you, and keeps none of it; the page runs no analytics and sets no cookie, and the report reaches us only if you send the email. Signing in also talks to us, as any sign-in does. While you are signed in:

• the address of the job page you are viewing, so we can show whether you are already tracking that job;
• when you click Find a contact: the company, job title, website domain, page address and the first 2,000 characters of the page's visible text, which on most job pages is the posting;
• when you click Autofill: the form's custom questions and their answer options, with the company and job title, so we can draft answers. The extension then fetches your profile and résumé from us and fills the form in your browser;
• what you do in the panel: the message you send and its subject, that you sent it yourself, your verdict on a suggested contact, a contact you reject or choose, and that you applied, which it notices on its own;
• the name of the job platform it detected and how completely it could read the posting, which we use to fix detection.

Application tracking. The extension notices that you applied by watching for a form submission, a confirmation message or a change of page address. It does not send us, or keep, anything you type into the form.

Stored in your browser. Your sign-in token and your email address, and the job found on each job page you open, with its address and the start of the page's text. Those job entries are held in memory, for each tab's ten most recent job pages at most, and go when you close that tab or the browser.

The extension does not read your browsing history or your cookies. Beyond the job pages and actions listed above, it sends us nothing about the sites you visit, and nothing it sends is used for advertising.

What the job site can see. The panel and autofill work inside the job site's own page. That site's scripts, including any analytics it runs, can see what the panel shows there (the suggested contact, the draft and what you type into the panel, including the Warmada password if you sign in there) and every answer autofill enters before you submit, and can tell the extension is installed. The site's own policy covers that.

1.3 Gmail

Connecting Gmail is optional. It lets Warmada send the messages you approve from your own address.

• What we ask Google for: permission to send email as you (gmail.send) and to see your email address.
• What we keep: a refresh token, encrypted, so we can send what you approve; the Gmail address you connected, which we show you; and the message and thread identifiers Gmail returns for each message you send.
• What we cannot do: read your inbox, your other messages or your contacts.
• A test message, only on request: if you ask us in writing to check that sending works, we may send one test message from your Gmail to your own address. We send such a test only from the account of someone who asked, or from the founders' own accounts.
• How Google data is handled: under Google's Limited Use requirements (Section 11).
• Disconnecting from your dashboard stops all sending through it, deletes our copy of your token and the connected address, and asks Google to revoke our access. Removing our access at myaccount.google.com/permissions stops sending at once; we delete our copy the next time we try to use it. Records of messages you already sent stay with your account (Section 5).

Without Gmail. Open in Gmail opens Gmail's compose window in your browser with the message filled in; your browser carries it to Google in the page address, and Warmada sends nothing to Google. Copy email puts the message on your clipboard. If you then tell us you sent it, we record that it was sent.

1.4 What we collect automatically

• Technical information: your IP address, browser type and the time of each request reach our server with every request, as with any website. Our application's logs record which feature was used, your account's internal identifier, our internal identifiers for the records involved, the companies and website domains a request was about, the places named in your search brief and whether you accept remote work (in the matching log, each night and when you search), and any error. They do not record your messages, your résumé, your IP address or your browser's identifying string. We use your IP address, in memory only, to limit sign-in, sign-up and reset attempts and free lookups (Sections 1.6 and 5).
• Browser storage. The dashboard keeps your sign-in token in your browser's storage, with your display preferences, a beta invite code if you used one, the state of a sign-in in progress, and the job you came from if you signed up from one of our job pages. While you set up your account, it also saves your answers in this browser so a reload loses nothing. When setup finishes, only a marker that it finished is kept, and the text of your first search stays in that tab until that search has saved your search brief, you sign out, or you close the tab. If you choose "Finish later", your answers stay until you finish or sign out. Your sign-in token and setup answers are removed when you sign out, or the next time the dashboard finds your session has ended; display preferences, an invite code, and a note that setup answers kept before 2026-10-26 were cleared, stay. None of this is a cookie, and none of it leaves your browser except as the requests described here.
• One first-party cookie, wm_src, set when you first open one of our public pages (never on the Report a problem page). It records which site sent you, any utm_ campaign tags on the link, the page you landed on and the date, for 90 days. If you sign up, these are copied to your account so we can count which channels bring people. It holds no identifier, email or IP address.
• Visit statistics on our public pages, through Umami (Section 4): the pages viewed, and which of our sign-up, apply and lookup buttons are clicked. Not on the dashboard, the extension, these legal pages or the Report a problem page.
• Do Not Track and Global Privacy Control are honoured. If your browser sends either signal, we set no wm_src cookie (and remove one set before), record nothing about where you came from if you sign up, and send nothing to Umami. The technical information above reaches us either way.

We use no advertising or cross-site tracking cookies.

1.5 From other sources

• Contact-data providers and public sources: the work contact details of people at hiring companies. See Section 9.
• Public job postings, gathered from employers' job boards to suggest matches. They are not information about you, though a posting may name a recruiter or another contact at the company.

1.6 The free hiring-manager lookup (no account)

Anyone can paste a Greenhouse, Lever or Ashby job link into the lookup on our website.

• What happens: we read the posting, from our own copy or the job board's public feed, and run the same contact search a signed-in user gets. AI Ark receives the posting's company and job title, and the AI services in Section 3 receive the posting's details and the job titles, seniority and departments of the people AI Ark finds, without their names; nothing about you. AI Ark also confirms the chosen person's work email, which we discard: it is never shown or kept.
• What you see: a suggested person's name, job title and LinkedIn address. Never a work email; that, and a drafted note, need a free account.
• What we keep about the posting: the result, for 14 days, so anyone who looks up the same posting gets the same answer without a new search: the job title, company, website domain and the suggestion above. A record of how the search went (company, size, outcome and our confidence, nothing about you) is kept for up to 6 hours.
• What we keep about you: to enforce the limit of three lookups a day, a one-way hash of your IP address mixed with a random value that exists only in our server's memory and is never written down. The hash is deleted once its day is over, and without the value it cannot be turned back into an address or linked to another day. We also keep daily counts of lookups and their outcomes, with no address, for 90 days.

2. How we use information

• To provide the Service: detect jobs, suggest contacts, draft and send the messages you approve, fill the applications you ask us to fill, track your applications, match you with jobs, run the assistant and keep your account working.
• To keep it safe: prevent fraud, spam and abuse, enforce usage limits, and protect the Service and the people who use it.
• To talk to you: password resets, the warning before an idle account is deleted, answers to what you ask us, and notice of changes to these documents. We send no marketing email.
• To fix and plan the Service: from counts that identify no one (sign-ups, the pages that brought them, how often detection works) and, to fix errors, from the logs described in Section 1.4. When we use totals that identify no one, we keep them that way: we do not try to re-identify anyone from them, and we do not share them with anyone who has not agreed to do the same.
• To fix how we choose contacts: when you tell us a suggested contact is not the right person, we suggest someone else for that job. Where the panel asks you why, we keep your answer, with our record of how that suggestion was made, and read it to find and fix mistakes in how Warmada chooses people. This is reading, not model training.
• To meet the law and enforce our Terms.

Warmada's AI decides nothing about you. It suggests contacts, drafts messages and ranks jobs; you decide whom to contact, what to send and where to apply, and nothing is sent without your approval. Automatic usage limits and the idle-account deletion in Section 5 apply rules, announced here, not AI judgments. For the people in Section 9, our estimate of whether someone is involved in a hire is a suggestion to the user, not a decision about that person. If you want to know why Warmada suggested a match or a contact, ask us at hello@warmada.com and one of the founders will look at it.

We do not use your information:

• to train or fine-tune any AI model;
• for advertising;
• to decide creditworthiness, lending, or anyone's eligibility for credit, employment, housing or insurance; or
• for any purpose other than those listed above.

The founders read your content only when you ask us to (for example, for help), to fix a problem you report or one that affects your account, when needed to investigate security or abuse, or when the law requires it. Information we receive through Google APIs is read by a person only in the narrower cases in Section 11.

3. The AI services we use

Warmada uses AI to read your résumé, choose who to contact, draft messages, answer application questions, rank job matches, run the assistant and find a company's website. We do not build or host AI models. Every AI request goes through OpenRouter, which passes it to a provider of the model we name.

The services and models we use today, who makes and runs each, and links to their own policies are listed at warmada.com/ai-services. Its model ids are read from the code that sends the requests; that code refuses any other model, a check stops a release that adds a model the page does not describe, and the page shows the date of its last change. This section sets out what does not change with a model: what each feature sends, and the settings every request carries. The AI tool the founders use to run Warmada is not a feature of the Service; Section 4 describes it.

3.1 What each AI feature receives

Your saved demographic answers and your Gmail data are never sent to an AI service. Anything you type into a chat with the assistant, including personal details, goes to the AI service with the rest of the chat.

3.2 The settings we send with every request

• Zero data retention: only providers that OpenRouter lists as keeping no copy of the request or the answer once they have replied may serve it.
• No data collection: only providers that do not store or train on it may serve it.

If no provider meeting both is available, the request fails; it is never sent elsewhere. OpenRouter applies these settings to model providers, not to the PDF conversion step or to web search. After every release, and every night, we check that each model on the AI services page can still be served under both settings.

Our OpenRouter account is set so that OpenRouter does not log what our requests contain and may not use it to improve its product. OpenRouter does keep a record of each request's model, size and time.

3.3 Who is responsible for what

We choose which AI services and models Warmada uses, what each request contains and the settings it is sent with, and we are responsible for those choices and for checking that the settings are still met (3.2). Where a service we chose picks the model, the PDF conversion or the search engine for a request, the AI services page says so. We send requests through OpenRouter under its terms with us; OpenRouter passes each one to a provider of the model we name under the same settings. Each of these companies runs its own systems and is responsible for keeping the commitments it makes, including the no-retention and no-training commitments those settings rely on. Their own terms and policies, linked on the AI services page for each company it names, describe how they run their services; this policy describes what we send them and why. AI output can be wrong; the Terms (Section 7) say how to treat it.

3.4 When this list changes

We add a service or model to the AI services page before we send personal information to it, and the page shows the date of that change. The models Jev Router picks for each request are covered by its entry there. If a change would alter what a feature in 3.1 sends, we change this section too, as Section 12 describes.

4. Who else handles information

We do not sell your personal information, and we do not share it for advertising. We share it only with the providers below, and as the rest of this section describes.

Service providers, who process it for us and only to run the Service:

When you direct it. If you sign in with Google or LinkedIn, we exchange a sign-in code with it, and it tells us your account identifier, name, email address and whether it is verified (its answer also carries your profile photo link, which we do not keep). The messages you send go to their recipients. The forms you fill go to the employers' sites you are on.

For legal and safety reasons. To comply with the law or a valid legal process, and to protect the Service and the people who use it from fraud, abuse and security threats. Before we disclose your information in answer to a subpoena, court order or other legal demand, we will tell you, so you have a chance to object, unless the law forbids it or someone's safety is at immediate risk. We disclose only what the demand requires.

If Warmada becomes a company, or changes hands. The founders intend to form a company to run Warmada. When that happens, we will tell you before it takes over, and it will ask you to accept updated Terms. Later, if the Service is merged, acquired, sold or wound down, including in an insolvency, your information may pass to whoever takes it over, only to keep running the Service under this policy. In either case we will tell you before it moves; information received through Google APIs or the Chrome extension moves only with your consent; and you can export or delete your data first.

5. How long we keep it

Expired items are deleted by a job that runs every 6 hours, so an item can outlast its period by up to 6 hours while the job is working.

When you delete your account, your data is removed from our live database at once, our copy of your Gmail access is deleted and we ask Google to revoke it, and the backups, disk snapshots and application logs that still hold your data expire within 30 days. Automation logs at GitHub, which hold your internal account identifier, your match counts, and the places named in your search brief and whether you accept remote work, expire within 90 days. Emails between you and us are kept as the table says. Copies that the AI tool we use to run Warmada, and the PDF conversion service, keep under their own terms (Sections 3 and 4) are theirs to delete, not ours. We keep nothing else about you unless the law requires it or we need it for a legal claim that already exists.

6. Your choices and rights

Everyone who uses Warmada has these, wherever you live:

• See and take your data: download it from your dashboard settings. The file holds everything in your account except your password's hash, your sign-in and Gmail tokens, and short-lived security counters. It does not include our logs, our backups or the emails you sent us; ask us for those.
• Correct it: edit your profile at any time. To change your account's email address, write to us.
• Delete it: delete your account from your dashboard settings, or ask us at hello@warmada.com.
• Disconnect Gmail: from your dashboard, or at myaccount.google.com/permissions.
• Control the extension: turn "Detect jobs on every site" on or off, sign out, change its site access in Chrome's extension settings, or remove it.

Some US states give their residents rights to know, access, correct, delete and port their personal information, and to opt out of its sale, of targeted advertising and of profiling with significant effects. We give those rights to everyone, and we do none of the things they let you opt out of. We use sensitive information (your demographic answers, your work-authorization and sponsorship answers, and your sign-in details) only to provide the Service you ask for.

To make a request, use your dashboard settings or email hello@warmada.com. Deleting your account in the dashboard asks for your password, or, if your account has none, a sign-in from the last ten minutes, and downloading your data needs only that you are signed in; for an emailed request we write to your account's email address. We confirm an emailed request within 10 days and answer it within 45 days; if we need longer, we will tell you why within those 45 days, and answer within 45 more. Someone you authorize may ask for you with your signed permission. If we turn a request down, reply to our answer to appeal; if we turn the appeal down, you may contact your state attorney general. Using these rights never costs you anything or changes how we treat you.

California notice at collection. We do not sell or share any of the information below. Our hosting and backup providers (Section 4) hold all of it; the table names who else receives each category.

7. Security

The measures we use today include the following. We may replace one with another that protects your information at least as well, and we update this list when we do.

• Encryption in transit everywhere, with HTTPS enforced by the browser (HSTS).
• Encryption at rest, with AES-256-GCM and a key kept apart from the database, of: your Gmail token; your résumé file and its text; your profile's headline, summary, school, links, education, work history and skills; your demographic answers, phone number and work authorization; your chats with the assistant; and your job-search description.
• Everything else is stored without that extra layer, on the encrypted disk: your name, email address, city and state, and your résumé file's name; your applications, including the contacts suggested for them and why (such as a shared school); your drafts and sent messages; your job matches and our note on each; and your activity (Section 1.1).
• Backups encrypted with age on our server before they are stored, and our server's disk encrypted by our host.
• Passwords hashed with Argon2id; sign-in and reset tokens stored only as hashes.
• A strict content security policy on the dashboard, which loads nothing from any other website.
• Limits on sign-in and password-reset attempts per email address, and on sign-in, sign-up and password-reset attempts per network address.
• Access to production limited to the founders and the deploy automation they control.

No system is perfectly secure. If a breach affects your information, we will tell you as the law requires. If you find a security problem, tell us at hello@warmada.com, and do not access other people's data or disrupt the Service while looking (Terms, Section 8).

8. Children

Warmada is not for anyone under 18, and we do not knowingly collect information from them. If you believe a minor has given us information, tell us and we will delete it. If we learn that an account belongs to someone under 18, we close it and delete its data.

9. People we look up

This section is also published on its own at warmada.com/people-we-look-up, for people who receive a message sent with Warmada's help.

To help a user reach a company, Warmada may handle the professional information of people who work there: name, job title, seniority, department and employer, work email address, LinkedIn profile address and photo, and whether they went to the same school as the user, with our estimate of whether they are involved in the hire. It comes from a licensed contact-data provider (currently AI Ark) and public sources, including job postings that name them. To choose whom to suggest, your job title, seniority, department and employer, without your name, go to the contact-choice model listed at warmada.com/ai-services, with the job posting, which may name you; to draft a user's message, your name and job title go to the drafting model listed there. Both go through OpenRouter, under the no-retention settings described in Section 3 of the Privacy Policy. The photo is shown from the provider when a user looks, and we do not store it.

We use it only to show the user who asked, so they can send a message they approve and at most two follow-ups to it, and, on the free lookup (Section 1.6), to show the person's name, job title and LinkedIn address to anyone who looks up that posting, for 14 days. The free lookup never shows a work email. We do not sell this information, publish it where search engines can find it, or train models on it.

What we never do with your details. Warmada itself never contacts you, and never uses your details to advertise or market anything to you. We do not use them to judge anything about you other than whether you are a likely person for a user to ask about a particular job. A message drafted with Warmada was reviewed and sent by the job seeker from their own email or LinkedIn account; someone who found you through the free lookup writes their own.

To see or correct what we hold, email hello@warmada.com with the subject "My details". We will tell you what we hold about you and, as far as our records show, which of the sources above it came from, and we will correct or delete it.

To be removed, email hello@warmada.com with the subject "Remove my details". We will delete what we hold about you as a contact, including from users' applications and drafts (a job posting that names you stays as its employer published it), and you will not be suggested again, including on the free lookup. Copies in our encrypted backups expire within 30 days. To keep that promise we keep only your work email and/or LinkedIn address, your name, your employer's domain and the contact-data provider's identifier for you, with the date of your request, as a do-not-suggest entry.

To report a message someone sent you with Warmada's help, email hello@warmada.com with the subject "Report a message" and include the message. We will review it, can remove you as described above, and may act against the sender under our Terms.

We act on each of these requests within 30 days. To do it, a founder may use the AI tool described in Section 4 of the Privacy Policy, which then sees the details in your request. If you write for an organisation about its staff, we may ask for proof that you can act for them, such as a request sent from an address at the organisation's own domain, and we decide each request on its own facts.

10. Where information is kept

Our servers are in the United States (Chicago). Backups are stored by Tigris, encrypted; Tigris may keep them in more than one region. The automation that deploys Warmada and checks it runs on a founder's computer in the United States and reports to GitHub. Our other providers (Section 4) process information on their own servers; the AI providers in Section 3 may process a request in other countries: model providers under the settings in Section 3.2, and the PDF conversion and web search services under their own policies.

11. Google and Chrome Web Store commitments

Warmada's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, information we receive through Google APIs is used only to sign you in and to provide the features in Sections 1.1 and 1.3. It is not used for advertising, not sold, not transferred except as Section 4 allows, and not read by any person except with your permission, for security, to comply with the law, or once aggregated so that it identifies no one. Information we receive through Google Workspace APIs, including Gmail, is not used to create, train or improve any machine-learning or AI model, as the Google Workspace API User Data Policy requires.

The use of information collected by the Warmada Chrome extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

12. Changes

If we change this policy in a way that matters, we will tell you by email or in the Service at least 14 days before the change takes effect. If a change would let us use information we already hold in a materially different way, we will ask for your consent first, and without it we will keep handling that information under the version you accepted. The version and effective date at the top always describe the current policy.

13. Contact

The Warmada founders · hello@warmada.com