← Back

Privacy

Last updated 2026-05-26.

What Kleos stores

• Account: email, bcrypt password hash, name, created/updated timestamps, TOS-accepted timestamp.
• SMTP credentials: host, port, username, AES-256-GCM-encrypted password. Plaintext password never persists.
• Resume: PDF file on disk + extracted text. Used only as prompt context for your campaigns.
• Preferences: roles, locations, keywords, tone, optional addendum.
• Campaigns and derived rows: matches, draft variants, sent-email metadata (message-id, smtp response).
• Warm-up state: per-day counters and pause status.
• Audit log: signup, login, smtp add/delete, send events, admin actions. Retained for security review.

What Kleos does not do

• No open/click tracking pixels. Emails are plain text.
• No third-party analytics in the web UI.
• No selling, renting, or sharing of user data with advertisers.
• No reading of recruiter inboxes or replies. Kleos only sends; replies land in your own inbox.

Recruiter contact data

Recruiter emails come from three sources: public mailto links on careers pages, commit metadata from public GitHub repositories the company owns, and operator paste. Role-alias addresses (security@, abuse@, …) are filtered. By signing up you attested you have a lawful basis to contact each recruiter you send mail to.

Deletion

Use Settings → Danger zone → Delete account. Kleos removes your user row and cascades to refresh tokens, preferences, SMTP credentials, resumes, campaigns, matches, drafts, and sent-email history. Audit-log rows are retained with the user_id cleared. The operation is immediate and irreversible.

Subprocessors

• OpenAI / Codex CLI — prompt and resume excerpt used for generation; bound by their data policy.
• Your SMTP provider (Gmail, ForwardEmail, etc.) — receives your sends.

Contact

Open an issue at github.com/abhinav-yadav-official/Kleos.