The short version
- We store only what Reachout needs to work, and everything is encrypted before it's stored.
- Your mailbox is read read-only. We never send email you didn't ask for, and never mark messages as read.
- We don't sell your data, show ads, or use your data to train AI models.
- You can delete your account at any time; everything is removed with it.
What we collect
| What | Where it comes from | Why |
|---|---|---|
| Your name and email address | You, when you sign up | Your account, and sending you sign-in codes |
| Email settings and an app password | You, on the Profile page | Sending your messages and reading your mailbox |
| Contacts (names, emails, phone numbers, notes) | Files you upload, or contacts you add | Campaigns and your contact history |
| Message templates and files (for example your résumé) | You | Attaching them to messages you send |
| Emails in your mailbox related to your outreach and job search | Your mailbox, read-only | Replies, application tracking, job matches and inbox insights |
| Your website: text, images, projects | You, in the website builder; public details from GitHub if connected | Publishing your website |
| Messages sent through your website's contact form | Visitors to your website | Showing them to you in Leads |
| GitHub and LinkedIn access tokens, WhatsApp link | You, when you connect them | The features you connected them for |
| Technical data: IP address, browser, pages, errors | Your browser | Security (rate limits, abuse prevention), error reports, website visit counts |
Your mailbox
When you connect Gmail or another provider with an app password, Reachout signs in to your mailbox read-only to:
- find replies to emails you sent through Reachout;
- recognise job application updates (applied, in review, assessment, interview, offer, rejected) and job alerts;
- group your inbox by company for Inbox insights.
We keep only what those features need (sender, subject, date, and the relevant part of the message), encrypted. We never delete, move or mark messages in your mailbox. Messages leave your account only when you send them. You can disconnect at any time by removing the app password, and revoke it in your provider's settings.
How we use it
- To provide the features you use, including scheduled work such as the morning sync.
- To keep Reachout secure: sign-in codes, rate limits, and detecting abuse.
- To send you service emails, such as sign-in codes and notifications you turned on.
- To find and fix errors.
We don't sell or rent your data, don't use it for advertising, and don't use it to train AI models. We process your data to provide the service you asked for (contract), to keep it secure (legitimate interests), and where needed with your consent, which you can withdraw.
How it's protected
- Your data is encrypted before it's stored, with a key kept separately from the database. Email addresses are looked up by a keyed fingerprint, not stored in plain text.
- There are no passwords to steal: you sign in with one-time codes. Sign-in cookies are HttpOnly and sent only over HTTPS.
- Every workspace is private to its owner. Pages carry strict security headers, and sign-in attempts, messages and requests are rate-limited.
No system is perfectly secure. If we learn of a breach affecting your data, we'll tell you and the relevant authorities as the law requires.
Services we use
These providers process data on our behalf, only to run Reachout:
| Provider | What for |
|---|---|
| MongoDB Atlas | Database hosting (stores encrypted data) |
| Render | Runs the Reachout server |
| Netlify | Delivers the website and app pages |
| Our email provider | Sends sign-in codes and service emails |
| Sentry (if enabled) | Error reports, without message contents, cookies or form data |
| Google Fonts, jsDelivr | Fonts and the code editor load from their servers, which see your IP address |
| Microlink | Screenshot previews, only when you ask for a preview of a project's live site |
| GitHub, LinkedIn, WhatsApp, your email provider | Only when you connect them, and only for the features you use |
Some of these providers process data outside your country. Where that happens, we rely on their contractual and security commitments for international transfers.
Cookies
We use only functional cookies, with no advertising or tracking cookies:
- Sign-in: keeps you signed in (HttpOnly; expires after 7 days without use, or 30 days at most).
- Preferences: theme, sidebar layout, and whether the enquiry pop-up was shown.
- Source: on public pages, how you found us (referrer and campaign tags), stored once.
We don't use local storage or session storage for any of this.
How long we keep it
- Account data: until you delete your account.
- Sign-in codes: 10 minutes. Rate-limit counters: a few days at most.
- When you delete your account, your data is removed from the live database immediately. Copies in encrypted database backups disappear as those backups expire on their regular schedule.
- Enquiries sent through Reachout's own contact form: until we've dealt with them and delete them.
Your rights
Depending on where you live (for example under India's Digital Personal Data Protection Act, the GDPR or similar laws), you can:
- see and correct your data, most of it directly in the app;
- get a copy of it (contacts and enquiries can be exported to Excel; for anything else, ask us);
- delete your account and all its data from Settings, at any time;
- withdraw consent, or object to processing;
- complain to your data protection authority (in India, the Data Protection Board of India).
To use these rights, contact us. We reply within 30 days.
People in your contacts
If you upload contacts or message people through Reachout, you decide whose data is processed and why, and you're responsible for having a lawful reason to contact them. Reachout never guesses or scrapes email addresses. If you believe your details are in someone's Reachout account and want them removed, contact us and we'll help.
Children
Reachout isn't meant for anyone under 18, and we don't knowingly collect their data.
Changes and contact
If we change this policy in a meaningful way, we'll update the date above and announce it on this site before it takes effect. For any privacy question, write to us through the contact page.