Privacy Policy
Last updated: September 18, 2026
1. Who we are and what this covers
Codexa ("Codexa," "we," "us") operates the Codexa desktop app for macOS and Windows, the Codexa Chrome extension, and the website and web workspace at codexapro.com (together, the "Service"). This policy explains what information the Service collects, how it is used, who it is shared with, how long it is kept, and the choices you have. If you do not agree with it, do not use the Service. Questions go to privacy@codexapro.com.
2. What Codexa does
Codexa is a job-search copilot. It scores LinkedIn job postings against your resume, tracks your applications from the emails employers send you, notices interviews on your calendar, and captions your interviews so it can suggest answers drawn from your own experience. Everything below exists to provide those features and nothing else.
3. Information you give us
- Account. When you sign in with Google we receive your name, email address and profile picture from Google, and we create a Codexa account keyed to that email.
- Profiles and resumes. You may create one or more profiles and upload resume documents. We extract your work history, education, skills and the companies you have worked for from those documents to build your profile and to score jobs and answer questions. You can edit or delete any of it.
- Companies, applications and notes. Companies you add, applications you track by hand, achievements you record, and questions you type into the copilot.
- Phone number. Only if you opt in to text messages (Section 9).
- Payment. Credit purchases are processed by a third-party payment provider. We keep a record of the order and the credits it granted; we never see or store card numbers.
- Support messages. Whatever you send us when you contact us.
4. Information from Google (Gmail and Google Calendar)
Codexa's use of information received from Google APIs is limited to providing the features you turn on. When you connect a Google account, Google asks you to grant the permissions below. You can connect several accounts, and you can disconnect any of them at any time from Settings → Accounts in the web workspace or from your Google Account's third-party access page.
| Permission | What we read | What we keep | Why |
|---|---|---|---|
gmail.modify | Codexa looks at each new incoming message — its headers, preview and text — only long enough to decide whether it concerns a job application. Messages that are not about hiring are not kept, labelled or used for anything else. It also sees the headers (sender, recipient, subject, date) of messages you send, so it can tell when you have replied to an application thread. | For messages we recognise as application correspondence: the Gmail message and thread ids, the subject line, the sender's domain and the stage we detected (submitted, screening, interview, offer, rejected, …) and, when a recruiting email contains the job description, that description text as the job posting record. We do not store message bodies otherwise. | To keep your application list and its stages current without you filing anything, and to apply Codexa/… labels to those messages in your Gmail so you can find them. The modify permission is used to create, apply and remove the Codexa labels (for example clearing "needs action" once you reply) and, for messages at the submitted, update, rejected and closed stages, to move them out of your inbox into their label (archive). Codexa may also place a draft reply in an application thread for you to review; you decide whether to send it, and if you do, Codexa reads your sent reply once to learn how you changed the draft. Codexa never sends, forwards or deletes email. |
calendar.readonly | Events on your primary calendar as Google sends them, including updates to past events: title, times, organizer, attendees, description, location and meeting links. When Codexa drafts a reply for you, it also reads your calendar's time zone and your free and busy times, so the times it suggests do not clash with something you already have. | For events we recognise as interviews or meetings with a company you are talking to: the event id, title, times and attendee addresses, attached to the interview session they belong to. | To show your upcoming interviews in the desktop app, to let the copilot get ready for them, and to remind you before they start. |
userinfo.email, userinfo.profile, openid | Your name, email and picture. | The same. | To sign you in and label your connected accounts. |
To learn about new mail and calendar changes promptly, Codexa registers Google push notifications (watches) on the connected account; these tell us that something changed, not what.
Automated classification. To decide whether an email is about a job application and what stage it describes, the message text is processed by Google's Gemini API. Calendar events are matched to your applications by the organizer's and attendees' email domains and by words in the title; they are not sent to an AI model when they are read. Google processes what we send only to return an answer to us, and under the Gemini API terms that apply to paid use, Google does not use this data to improve its models.
No advertising, no selling, no human reading. Google user data is never used for advertising, never sold, and never shared with data brokers. No person at Codexa reads your email or calendar unless you ask us to for support and consent to it, or the law requires it.
5. Information from LinkedIn and the Chrome extension
The Codexa extension runs only on linkedin.com. When you open a job, or run a scan, it reads the posting's public details (title, company, company logo, location, description, salary range, work mode, employment type, how to apply, posting date, the posting id and url) and sends them to Codexa so we can score the job against your profile. It also notes when LinkedIn shows a job as applied, so your applications stay in sync. During a scan it opens the job cards on the page and turns the page so it can read them. It does not read your LinkedIn messages, connections or profile, and it never applies, messages or posts on your behalf.
6. Interview and meeting sessions
- Audio. While captions are running in the desktop app, it captures the meeting audio playing on your computer and, if you turn the microphone on, your voice. Audio is streamed to our speech-to-text provider (Deepgram) to produce live captions. Captions and the questions you type are sent to the AI model provider to generate suggested answers.
- What we keep. The session's transcript and the copilot's answers, so you can review them later in History, and a recording of the session audio stored encrypted in our cloud storage, which we use to produce an accurate transcript after the session. You can delete a session, which removes its transcript and recording.
- What we do not keep. Live captions outside a session are transcribed by our speech provider in the moment, shown on your screen and discarded; neither the audio nor the text is stored.
7. Information collected automatically
Server logs (IP address, request times, the feature used), the desktop app's own diagnostic log on your machine, crash reports, and basic device information (operating system, app version). We do not use third-party analytics or advertising trackers.
8. How we use information
- To provide the Service: scoring jobs, tracking applications, preparing and running interview sessions, answering your questions.
- To keep your account secure and the Service working, and to bill credits you buy.
- To send service messages (account, billing, session reminders). Marketing messages only with your opt-in.
- To comply with the law and to enforce our terms.
We do not sell personal information and we do not use your information, including Google user data, to train AI models.
9. Mobile Messaging (SMS)
If you opt in to receive text messages from Codexa — through the SMS sign-up form, by texting START to +1 (928) 414-8215, or by giving consent elsewhere in the Service — the following applies.
9.1 We Do Not Share Your Mobile Number
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell, rent, or otherwise disclose mobile phone numbers or SMS consent to any third party. Text messaging originator opt-in data and consent are never shared with any third party except the messaging service providers that transmit messages on our behalf, and those providers are contractually prohibited from using the information for any purpose other than delivering our messages. This exclusion applies to all of the sharing circumstances described in Section 10 below.
9.2 What We Send and How Often
Subscribers may receive recurring automated text messages covering account and security alerts, billing and credit notices, appointment reminders, hiring process updates, product updates and new releases, and promotional offers. Msg frequency varies — messages are triggered by activity on your account rather than sent on a fixed schedule, so the number you receive depends on how you use the Service.
9.3 Message and Data Rates
Message and data rates may apply. Codexa does not charge for text messages, but your mobile carrier may charge you for sending or receiving them under your plan. Carriers are not liable for delayed or undelivered messages.
9.4 Opting Out and Getting Help
Consent to receive text messages is not a condition of purchasing any product or service. You may cancel at any time by replying STOP to any message from us; you will receive a single confirmation text and then no further messages. Reply HELP to any message, or email support@codexapro.com, for assistance.
9.5 Consent Records
When you opt in, we record your mobile number, the fact and timestamp of your consent, the exact consent language shown to you, and the IP address and browser used to submit it. We retain these records for as long as you remain subscribed and afterwards as required to demonstrate compliance with applicable telecommunications regulations.
10. Who we share information with
| Provider | What | Why |
|---|---|---|
| Amazon Web Services (United States) | All stored data: databases, resume documents, session recordings; authentication (Amazon Cognito). | Hosting and sign-in. |
| Google's Gemini API | Email text for classification; resume text, job postings, captions and your questions for scoring and answers. Calendar events are not sent to it. | The AI features. Not used for training. |
| Google (Gmail and Calendar APIs) | Your access tokens, held encrypted, to read mail and calendar and apply labels. | The connections you grant. |
| Deepgram | Session audio. | Live captions and transcripts. |
| Payment and SMS providers | Order details; phone number and message content. | Credits purchases; text messages you opted into. |
We may also disclose information when the law requires it, to protect the rights or safety of Codexa or its users, or as part of a merger or sale of the business, in which case this policy continues to apply.
11. Retention and deletion
- Your account, profiles, applications and sessions are kept while your account is active.
- Disconnecting a Google account stops the watches, revokes Codexa's access at Google and deletes the stored tokens immediately; the application records already derived from it stay in your workspace until you delete them.
- Deleting a resume removes the document and its search index; the work history already merged into your profile stays until you edit or delete it. Deleting a session removes its transcript and its recording. Deleting a profile removes the profile and everything attached to it.
- To delete your whole account and all of its data, email privacy@codexapro.com from your account address; we complete deletion within 30 days and confirm by email. Database backups expire within a further 7 days.
- Server logs are kept for 7 days. SMS consent records are kept as long as telecommunications rules require.
12. Security
Data moves over TLS. Google refresh tokens and session recordings are encrypted at rest. Access to production systems is limited to the people who operate the Service. No method of storage is perfectly secure; if we learn of a breach affecting your data we will tell you.
13. Your rights
You can access and correct your data in the workspace, export it by asking us, delete it as described above, opt out of marketing, withdraw consent by disconnecting an account, and complain to your data protection authority. Write to privacy@codexapro.com to exercise any of these.
14. Cookies
Essential cookies and local storage only, to keep you signed in and remember your preferences. No advertising cookies.
15. Children
The Service is not for anyone under 16 and we do not knowingly collect information from children.
16. Changes and contact
We will post changes here and update the date above; for material changes we will also email you. Contact: privacy@codexapro.com.