How Bearings handles your data.

Bearings is run by an individual operator as a personal project. It is not a company, and access is invite-only: an account can only be created for an email address that has been invited.

For privacy questions, data requests or security reports, email acm6603@gmail.com. This is the same address for every request described on this page.

We collect only what the service needs to work:

• Account data. When you sign in through Google via Clerk, we receive your name, email address and profile image.
• Job search data you enter or import. Your search criteria; companies and their grades; roles; applications and their stages; interviews; offers; contacts and the details you add for them; notes, next steps and activity history. It also includes any tracker file or CSV you choose to import.
• Assistant input, if you use the assistant. The text, links and pasted content you send it, the pages it fetches on your behalf, and the fields it extracts for you to review.
• API and MCP data. If you connect an outside agent, we store the client name, scopes, token metadata (the token itself is hashed), its last-used time, and an audit entry for each call.
• Usage and audit metadata. Counts of model calls, token counts, estimated cost, and a log of access through the API and MCP. These records do not contain your messages or record contents.
• Technical data. Our hosting provider records standard request information such as IP address, browser type and request time, used for security, rate limiting and debugging.

Sign-in uses Google Sign-In through Clerk. From Google we receive only your basic profile: your name, email address and profile picture. We request the openid, email and profile scopes and nothing else.

• We do not access Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google data.
• We do not use Google user data for advertising, and we do not sell it.
• Google user data is used only to authenticate you, create your Bearings account and display your name and picture in the app.
• Bearings' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use your data to run Bearings: to sign you in, store and show your job search, import a tracker you provide, power the assistant when you use it, enforce limits and keep the service secure.

Where data protection law asks for a legal basis, we rely on:

• Performance of a contract for providing the service you signed up for.
• Legitimate interests for security, abuse prevention, debugging and keeping the service reliable.
• Consent where we ask for it, such as enabling an optional feature. You can withdraw consent at any time.
• Legal obligations where we must keep or disclose something by law.

We do not sell personal data. We do not use it for advertising. We do not use your records or messages to train models.

We use a small set of service providers. They process data on our behalf and are listed here as subprocessors:

Clerk

Sign-in, sessions and your account identity.

Neon

The managed Postgres database that stores your records.

Vercel

Application hosting and standard request logs.

If you use the assistant, the messages and content needed to answer them are sent to Anthropic, our model provider, under terms that exclude training on API inputs. The assistant is not available today; this applies only if it is enabled.

If you connect an outside agent with an API token or MCP, that client can read and change the data you have authorised. We do not control what that client does with it.

We do not share your data otherwise, except where the law requires it or where it is needed to protect the service or someone's safety. We do not sell it.

Bearings does not use advertising cookies or third-party analytics cookies.

• Session cookies. Clerk sets the cookies needed to keep you signed in. They are required for sign-in and cannot be turned off while you use the service.
• Theme preference. Your light or dark choice is stored in your browser's local storage. It stays on your device and is not sent to us.

We keep less for less time. A nightly job enforces these periods, and they are the same for every account.

Companies, roles, applications, interviews, offers, contacts, notes and activity

Until you delete them. Deleted records are kept for 30 days so you can restore them, then permanently removed.

Raw assistant input and fetched page snapshots

30 days, then deleted. The fields extracted from them stay in your records.

Assistant chat transcripts

90 days, then deleted. This period is fixed; there is nothing to configure.

Model request logs and traces

30 days. Metadata only, with no message content.

Usage ledger (model calls, tokens and cost)

13 months. No content.

Audit log of API and MCP access

12 months.

A deleted account

All of your rows are permanently deleted within 30 days, and backups age out within 35 days.

When you delete your account, we delete your Bearings rows and remove your sign-in identity from Clerk.

You can, at any time:

• Access and export your data. Download everything as JSON or CSV from Settings → Privacy, or email us and we will send you a copy.
• Correct your data. Edit any record in the app, or email us if something cannot be changed there.
• Delete a record. Open the record's detail page and delete it there, or email us.
• Delete your chat history or your whole account. Use Settings → Privacy, or email us. Both use a typed confirmation.
• Ask us a question or make a request. Email acm6603@gmail.com. We aim to respond within 30 days.

Depending on where you live, you may also have the right to object to or restrict certain processing, or to complain to your local data protection authority.

Data is encrypted in transit with TLS, and the managed database encrypts it at rest. Every query is isolated to your account with row-level security, so one account cannot read another's records through the app.

API tokens are stored hashed, limited to the scopes you grant, expire, and can be revoked at any time. Sign-in and token creation are rate-limited. Fetched pages, pasted emails and API input are treated as untrusted.

No service is completely secure. If you find a problem, email acm6603@gmail.com.

Our providers (Clerk, Neon and Vercel) may process data in the United States and other countries where they operate. Where required, we rely on appropriate safeguards for those transfers, such as the providers' contractual data-protection terms.

Bearings is for people aged 16 and over. It is not intended for children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, email acm6603@gmail.com and we will delete it.

If this policy changes, we will update the date at the top of this page. For a material change, we will also tell you in the app before it takes effect.

Questions about this policy, your data, or a deletion or export request: acm6603@gmail.com.

Bearings · Effective November 12, 2026 · Last updated November 12, 2026