Privacy Policy

Effective date: September 22, 2026

Last updated: September 22, 2026

Kroot is operated by Kroot Co., a Delaware corporation operating from Los Angeles, California ("Kroot," "we," "us," "our"). This policy explains how we handle personal information when you visit krootme.com, use our job-search tools, connect a Google account, subscribe to Kroot Plus, receive job alerts, or contact us. We decide how information is used to operate these services; where privacy law uses the term, we are the "controller" or "business" for that processing.

Privacy contact: trykroot@gmail.com

Mail: Kroot Co., 2810 N Church St STE 89710, Wilmington, DE 19802, USA

This policy should be read together with our Terms of Service.

Kroot is intended for adults aged 18 or older. Kroot is a U.S.-based service. Coaching and mentor-marketplace features are planned but not yet available; we will update this policy before they launch.

1. Information we collect

Account information. You sign in with Google. We receive your name, email address and profile image from Google, and we maintain your account, session and preference information. We do not receive or store your Google password.

Google connection information. If you authorize Gmail or Google Calendar access (see section 3), we store the connection status, the permissions you granted, and the credentials needed to operate that connection.

Profile and preferences. Information you choose to provide, such as your interests, school, career track, focus areas and job preferences.

Resumes and portfolio links. You may upload a resume in PDF format and add links to external portfolios or professional materials. A resume may contain contact, education, employment, project and other information you chose to include. Uploading a resume does not make it public or send it to any employer. Linked portfolio sites have their own privacy practices.

Job-search information. Applications, saved jobs, company and role details, application stages, dates, interview details, next actions, notes and corrections that you enter, or that Kroot creates from a connected Gmail account.

Gmail-derived information. If you connect Gmail, records created from your mail can include message and thread identifiers, sender information, subject lines, timestamps, hashes used to recognize messages, short supporting excerpts, summaries and meeting links. See section 3.

Subscription and billing information. If you subscribe to Kroot Plus, Stripe processes your payment details. We receive and store the billing, subscription, invoice, payment-status, renewal, cancellation and limited payment-method information (such as card brand, last four digits and expiration date) that Stripe makes available and that we need to administer your subscription, provide support, prevent fraud and keep accounting records. We do not receive or store your full card number.

Communications. Support requests, privacy requests, feedback and other messages you send us. Please avoid including sensitive information that isn't needed.

Technical and usage information. Our systems and service providers process request and device information such as IP address, browser and device details, timestamps, security events, errors, and identifiers used to operate and protect the service. Product analytics are described in section 5.

Public sources. We collect job listings and company information from public sources and third-party listing providers. A listing does not mean the employer endorses Kroot. When you open an external application link, that site receives information under its own practices.

Information about other people. Connected email and your notes may contain information about recruiters or other people. We process it only as needed for the feature you are using, for security, or for legal reasons.

Incidental sensitive information. We do not ask you to provide sensitive personal information (such as health, immigration status, or protected characteristics) in email, resumes, notes or support messages. Such information may nevertheless appear in material you provide or connect. We minimize access to it, do not use it for advertising, and do not use it to infer unrelated sensitive characteristics about you.

2. How we use information

We use information to:

• Create and maintain your account, authenticate you, and remember your preferences.
• Provide application tracking, saved jobs, interview information and related job-search tools, including automatic tracking from a connected Gmail account.
• Process uploaded resumes and portfolio links to provide the features you use.
• Administer Free and Plus plans, billing, renewals, cancellations and billing support.
• Send email job alerts and roundups you have requested or enabled.
• Send service communications about your account.
• Respond to support, access, correction and deletion requests.
• Detect misuse, protect accounts, investigate failures, and comply with legal obligations.
• Understand how Kroot is used, through product analytics (section 5).
• Create Recruiting Intelligence, as described below.

Accepting our Terms is not consent to an unrelated use of your connected-account data. If we introduce a feature that requires a new use of your information, we will provide notice and, where required, obtain your permission before that use begins.

Recruiting Intelligence

Kroot shows users aggregated recruiting trends, benchmarks, cohort statistics, hiring-velocity signals and historical recruiting patterns ("Recruiting Intelligence"). To create it, we combine application records that Kroot users entered manually with public job and company information, and we present the results in aggregated, statistical form. We do not use records created from connected Gmail accounts, or any other information obtained from Google APIs, to create Recruiting Intelligence.

Recruiting Intelligence is designed so that it does not expose another identifiable user's private application activity, communications, resume or account information. We remove direct identifiers before aggregation and apply safeguards designed to reduce re-identification risk, such as grouping data into broader categories and not displaying statistics drawn from fewer than a minimum number of users. Removing a name or account identifier does not, by itself, make information anonymous, and we treat source records as personal information.

Your choice. You can exclude your application records from Recruiting Intelligence at any time using the setting in your account, or by emailing our privacy contact. Exclusion applies to future aggregation; statistics already computed may not be recalculated.

Limits. We do not sell Recruiting Intelligence inputs, use them for advertising, or use them to train generalized AI models. If we ever propose to use Gmail-derived information in Recruiting Intelligence, we will do so only where Google's policies permit it, after updating this policy, and after obtaining any permission those policies or applicable law require.

3. Google connection and email processing

Separate steps. Signing in with Google authenticates your Kroot account. Gmail access is a separate permission that Google asks you about. You can decline Gmail access and still use Kroot's manual job-search tools. If you grant it, Kroot automatically tracks applications from your mail.

What the permission allows. Gmail access is read-only. It does not allow Kroot to send, modify or delete your messages. We search for messages likely to concern recruiting and process candidate messages to decide whether they are relevant. Filtering is imperfect, so a non-recruiting message may be processed before being excluded. Do not connect a mailbox you are not authorized to share.

What we store. We process message content to create the job-search records described in section 1. We store message metadata, short supporting excerpts and derived records; we do not maintain an ongoing archive of full message bodies in our application database. Excerpts may contain personal information. Our AI providers may also retain processing data for a limited period, as described in section 4.

Restricted uses. Kroot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and to applicable Google Workspace developer requirements. We do not sell Google user data, use or transfer it for advertising, or use it to assess creditworthiness or for lending. We do not use Google Workspace API data, or information derived from it, to train generalized or non-personalized AI or machine-learning models. Information from your Gmail is used only to provide features to you and is not used to create Recruiting Intelligence shown to other users (section 2).

Human access. Mail processing is automated. Kroot personnel access specific message content only with your affirmative agreement to that access, where necessary to investigate security issues or abuse, or where required by law. Our service providers' access is limited by contract consistently with the Google restrictions above. We restrict staff permissions to their responsibilities.

Declining or revoking Gmail. Declining Gmail access does not prevent you from having a Kroot account. You can revoke Kroot's access at any time from your Google Account permissions or by disconnecting in Kroot. After revocation is processed, we stop ongoing access and remove the connection credentials. Records already created on your board remain until you delete them or your account (sections 7 and 8).

Google Calendar and Meet. When mentor or coaching session booking is available, we will separately ask for permission to access your Google Calendar so we can create and update session events and generate Google Meet links. This permission is optional, is requested only when you use booking features, and is separate from Gmail access. We use calendar information only to schedule and manage your sessions, and the Google restrictions above apply to it.

4. AI-assisted features

We use third-party AI service providers to interpret candidate recruiting messages. Processing can include the sender, subject, date, thread identifier and a limited message-body excerpt. We use the result to suggest or record companies, roles, application stages, interview information and next actions.

AI output can be incomplete or wrong. Review important details against the original message and correct your records as needed. These tools organize your job search; Kroot does not make hiring decisions for employers.

We use these providers under business terms that prohibit them from using your data to train their generalized models. Providers may retain processing data for a limited period for abuse monitoring and reliability under their terms. We configure and contract for this processing consistently with the Google restrictions in section 3.

5. Cookies and analytics

We use cookies and similar storage for account sessions, security, the Google connection flow, and remembering your choices. Blocking essential storage can prevent sign-in or other features from working.

Product analytics. We use PostHog and Statsig to collect information about page visits, feature interactions, device and browser characteristics and related identifiers, so we can understand usage, run product experiments and diagnose problems. When you are signed in, analytics may be linked to your account identifier. We also use Vercel's hosting-level traffic measurement. Pseudonymous analytics data is not necessarily anonymous.

Session replay. Statsig may record a reconstruction of your interactions on eligible pages so we can diagnose usability problems. Replay is not used to read your Gmail messages and does not give staff access to your mailbox.

Your choices. You can turn off product analytics and session replay at any time using the setting in your account, or by emailing our privacy contact from your account email; we will then exclude your account from future analytics collection. Opting out does not affect core features. You can also use browser controls to block or delete cookies.

Tracking signals. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use third-party advertising trackers, so browser signals such as Do Not Track and Global Privacy Control do not change how we process your information.

6. When information is shared

Service providers. We use the following providers to operate Kroot. They process information on our behalf under contracts that limit their use of it.

Some providers, particularly Stripe and Google, also process information for their own legally permitted purposes under their own privacy notices.

Recruiting Intelligence. Aggregated statistics are shown to Kroot users as described in section 2. Your individual application records, communications and resume are not shown to other users.

Legal and safety. We may preserve or disclose information when required by law, or when necessary to protect Kroot, our users or others, or to investigate misuse.

Business changes. If Kroot is involved in a merger, acquisition, financing or sale of assets, information may be transferred with appropriate protections and notice. Restricted Google data remains subject to Google's transfer requirements, including your prior consent where Google's policies require it.

No sale or advertising sharing. We do not sell personal information and do not share it for cross-context behavioral advertising or targeted advertising. We do not disclose personal information to third parties for their own direct-marketing purposes.

De-identified and aggregated information. Where we maintain information as de-identified or aggregated, we maintain reasonable measures to prevent it from being associated with you, do not attempt to re-identify it except to test our safeguards where permitted by law, and do not call information "anonymous" merely because a direct identifier was removed.

7. Retention

We keep personal information only as long as needed for the purposes described in this policy, for security, or to meet legal, accounting and dispute-handling obligations.

If we must retain information for a legal obligation or claim, we restrict it to that purpose and delete it when no longer needed. We do not use a generic legal exception to keep everything indefinitely.

8. Your choices and rights

Account controls. You can edit your profile, delete records from your board, disconnect Gmail, manage email alerts, turn off Recruiting Intelligence and analytics, delete your account, and cancel Kroot Plus through the app (see the Terms of Service for subscription cancellation). Privacy choices do not automatically cancel a paid subscription.

Requests. Email our privacy contact to request access to your information, a copy of it, correction, or deletion of your records or your account, or to opt out of Recruiting Intelligence or analytics. Before deleting your account, request a copy of anything you want to keep.

What deletion does and doesn't do. Disconnecting Gmail stops ongoing access but does not erase records already on your board — delete those records or your account if you want them removed. Deleting your account removes your identifiable information within the periods in section 7. It does not remove aggregated statistics that no longer identify you, or billing records we must keep.

Verification. We verify requests using information proportionate to the request — normally by confirming the request comes from your account's Google sign-in email or from within your signed-in session. An authorized agent may submit a request on your behalf where the law allows, subject to verification. We respond within the time required by applicable law and will explain any lawful refusal or extension. We will not discriminate against you for exercising your privacy rights.

Additional rights under state law. Depending on where you live, you may have rights under a state privacy law to confirm whether we process your personal information, access or obtain a copy of it, correct it, delete it, obtain it in a portable format, or opt out of sale, targeted advertising or certain profiling. We do not sell personal information, share it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. To exercise a right, email our privacy contact. If we deny a request and your state gives you a right to appeal, reply to our decision email and ask for an appeal; we will have a different person review it and respond within the time the law requires.

9. Security and international users

We use technical and organizational safeguards designed to protect information, including access controls, encrypted transport and protections for stored credentials. No system is perfectly secure. Contact us immediately if you suspect unauthorized access to your account.

Kroot is operated from the United States and our providers process information in the United States. If you use Kroot from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Kroot does not currently target the European Economic Area or the United Kingdom.

10. Age eligibility

Kroot is for people aged 18 or older. We do not knowingly collect information from anyone under 18. If you believe an under-18 user has an account, contact us and we will investigate, suspend the account and delete the information as required by law.

11. Changes to this policy

We identify revisions by the effective date above and will notify you of material changes through the app or by email. Where a new use of Google information requires advance notice or consent, we provide it before that use begins. A revision to this policy does not retroactively authorize processing we had not disclosed.

12. Contact

Questions, requests or concerns: trykroot@gmail.com, or by mail to Kroot Co., 2810 N Church St STE 89710, Wilmington, DE 19802, USA. Please include "Privacy Request" in the subject line so we can route your request promptly.