What we collect, what we don't, and why.

• Account info: email, password (hashed), and authentication tokens.
• Profile info: name, phone, school, major, graduation year, work authorization, where and when you can work, and the other fields you choose to save.
• Your record: what you bring once. The links you give us (LinkedIn, GitHub), the projects, courses and past work you describe, a resume if you upload one and the text we extract from it, and anything you tell UTern in chat, by text or on a call about what you know and what you want next.
• Checks you take: if you prove a skill on UTern, your answers to the task, the three follow-up questions and the link or upload you show, plus the score and its reasons.
• People you name: if you ask a professor, advisor or manager to vouch for one claim, their name and email address, the one question we sent, and their yes or no.
• Seats you answer: which seats invited you, your yes or no to each, the eligibility facts you gave for that seat, and the intro times you picked.
• Saved roles: the internships you save and pass on, used to improve what UTern shows you.
• Voice samples: short writing samples you may provide so anything drafted for you sounds like you.

Birdee, UTern's AI, remembers you between visits only if you say yes to memory. It is off until you do, and you can turn it off at any time in Settings.

• What is saved: each conversation you have with Birdee in the app (what you wrote, what Birdee answered, a one-line note of each tool it used and the ids of the roles it showed you), and the facts Birdee learns from them: your goals, the roles, companies and places you want, your projects and what you did in them, skills you mention, people you mention, your preferences, and needs like work authorization, pay or start date. Each fact keeps the words you used and the date.
• How it is used: Birdee reads the facts before each reply so you do not repeat yourself, and may ask you for one missing detail per conversation. A fact Birdee learns never counts as a verified skill; only the verification described above can verify one. When a fact fills a blank field on your profile (for example your school or graduation year), it is saved there too, never over something you entered.
• How long: saved conversations are deleted 12 months after they happen. Facts are kept until you delete them, turn memory off and choose to delete, or delete your account.
• Your control: Settings, “What Birdee knows about you”, lists every fact with its source. You can edit or delete any fact, delete everything, download it with your account data, and turn memory off, which stops the saving and offers to delete what was saved. A deleted fact is gone from Birdee's next reply.
• Who sees it: you. Companies never see your saved conversations or these facts; a company sees only the evidence you agree to share with its seat. To write the facts, the conversation is sent to the AI provider that runs Birdee (listed below).

• Usage analytics: page views, button clicks, and feature usage on utern.ai, used to operate and improve the product. Internal records may be linked to your account; they are not necessarily anonymous. They hold which features were used, never what you typed, and are deleted after 13 months. A browser that sends Do Not Track or Global Privacy Control is not recorded.
• Optional Google Analytics: this tag stays off unless you select “Allow analytics”. If enabled, UTern sends Google broad page category labels (for example, “/enterprise”) and, when you create a new account, a signup event with a broad sign-in method such as Google or email. It does not send the full URL, query string, page title, or account identifier. Google may receive device, browser, and network information as part of the request and may use analytics storage. We do not enable Google Ads signals or ad personalization. You can change this choice by clearing UTern site data in your browser. Do Not Track and Global Privacy Control keep the tag off.
• Device info: browser type, operating system, and a session ID. Used for debugging and to keep you signed in.
• Application form contents (extension only): when you click “Fill All” on a supported ATS apply page, the extension reads the form fields on that page so it can fill them. The form structure and the questions are sent to our AI service to generate draft answers. We don't store the page contents after the fill completes.

You can optionally connect your Gmail so UTern can keep your application tracker current automatically. This is off by default and only happens if you explicitly click “Connect Gmail” and approve access on Google's consent screen.

• What we access: read-only access (gmail.readonly). We cannot send, delete, or modify your email.
• What we look at: only messages that look like application updates - confirmations, interview invitations, rejections, and offers from employers and applicant tracking systems. We extract the application status and update your tracker.
• What we store: your encrypted OAuth grant and the derived status events (e.g. “Stripe application moved to interviewing”). We do not store your inbox or message bodies.
• What we never do with it: Gmail data is never used for advertising, never sold, and never used to train generalized AI models. No human reads your messages except with your explicit permission for support, or where required for security or by law.
• Disconnecting: revoke access any time from your profile or at myaccount.google.com/permissions. We delete the grant and stop reading immediately.

UTern's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Reading your record against a seat: when you say yes to a seat, UTern checks the eligibility facts the company set, then scores your record against the company's rubric. The scoring never sees your name, photo, school rank or graduation year. Every score is logged with its reasons.
• Verifying what you bring: when you ask to prove a skill, Birdee, UTern's AI, asks you about your own work in it and our AI processor reviews your answers. If they are specific and first-hand, the skill is marked verified. We keep a short summary and two or three of your own sentences as the evidence, and a company sees those words only after you say yes to its seat, never a score. UTern may also verify a claim from a page published about you by a school, employer, judge or platform (a dean's list, a club roster, a competition result, your public GitHub activity, a certificate's verification page), keeping the page address and an excerpt. It reads public pages only and never logs in anywhere as you. A vouch or a page adds weight; neither is required.
• Vouching and checks: if you name someone to vouch, we send them one email with one question. If you take a check, your answers are scored against the rubric by our AI processor. Do not submit confidential or restricted work.
• Introductions: when a company asks to meet you and you say yes, UTern sends one introduction to both of you with the time you picked, and follows up until there is an outcome.
• Help me apply (optional): if you ask UTern for help with an application, your profile, resume and voice samples are used to draft answers you review and, when you ask, to fill the apply page in the extension. You submit on the employer's site.
• Personalizing what you see: your saves and passes shape which internships and seats UTern shows you first.
• Keeping you signed in: auth tokens and session cookies tell the extension which UTern account is yours.
• Sending you product updates: if you opt in. You can unsubscribe from any email with one click.
• Improving the product: internal usage records and aggregate statistics helps us understand which features matter.

• We never sell your data to third parties.
• We do not send your record, resume or answers to advertisers or data brokers. A company sees you only after you said yes to its seat, and then only your name, your email and the evidence on your record for that seat. Saying yes to one seat is never a yes to another.
• We do not use your personal data to train our own general-purpose AI models. Provider training and retention controls depend on the selected service and account arrangement. We do not promise universal zero retention.
• Nothing is sent on your behalf without your authorization: not an application, not an introduction, not a request to someone to vouch.
• When Help me apply fills an application, it fills voluntary self-identification questions (race, gender, veteran status, disability) with “Decline to self-identify” unless you choose otherwise by answering them yourself on the employer's form. UTern never shares self-identification answers with seat scoring, and scoring never reads them.
• We never log in to LinkedIn, Handshake or any other network as you or as anyone else. UTern reads public pages only.
• We never use your data for purposes unrelated to UTern's single purpose: bringing the right internships and seats to you, and bringing you to the companies that fit.
• We never determine creditworthiness or use your data for lending decisions.

When a company hands UTern a seat, UTern looks for students who fit among the students already on UTern and on the open web. Outreach is to people in the United States only.

How UTern finds you: public web search results (including public LinkedIn profile results, which UTern reads from search, never by logging in), GitHub, Devpost, club, department and school directory pages, and licensed prospecting data vendors.

How UTern gets an email address, in this order: an address published on a public page about you; an address from a licensed data vendor (People Data Labs) looked up by your public profile or your name and school, where we keep a school or work address and never a personal mailbox the vendor lists; or, when UTern already holds one verified address at your school, an address in your school's own format (for example first.last@school.edu), which is sent only after an email verification service confirms it exists.

What UTern keeps about a person who has not signed up: the name, school and headline the page showed, the page address, the email address and where it came from, the verification result, the seat it was found for, and the fact and date of the one email we sent. Nothing about you goes to the company unless you say yes. If you got one of these emails, here is why.

• One email, then silence. First contact is a single email from Birdee, UTern's recruiting agent, that says who asked, with an unsubscribe link and a postal address. No reply means you never hear from us about it again. We never text a number we found; texts happen only after you opt in.
• Saying no is remembered. An unsubscribe, a bounce or a complaint puts your address on a suppression list so no seat contacts you again.
• Nothing more until you say yes. No student record is built about you until you sign up, and then it holds only what you chose to bring. If you never answer, what we found is deleted after 180 days (see how long we keep things, below).
• Deleting it. Email contact@utern.ai from the address we wrote to and we delete what we hold, keeping only the one-way hash that stops future outreach.

The UTern Chrome extension runs on five domains only:

• utern.ai - to read your signed-in session and sync your profile to the extension.
• *.myworkdayjobs.com, *.workday.com - Workday apply pages.
• boards.greenhouse.io, *.greenhouse.io - Greenhouse apply pages.
• jobs.lever.co, *.lever.co - Lever apply pages.
• jobs.ashbyhq.com, *.ashbyhq.com - Ashby apply pages.

The extension does not load on any other website. It does not track your browsing. It does not see what other tabs you have open.

The cookies permission is requested only when you click “Sign In” in the extension, never at install time. It's used to read the Supabase session cookie from utern.ai so the extension knows which signed-in account to autofill with. You can revoke it anytime in Chrome’s extension settings.

All JavaScript in the extension is bundled at build time. We do not load or execute remote code.

• Database: hosted on Supabase (Postgres) in the United States. Encrypted at rest and in transit (TLS 1.2+).
• Resume files: stored in Supabase Storage with private access. Authorized server processes also access files to provide the features you request.
• AI inference: providers may retain request data for abuse monitoring or features such as search grounding. Disabling training or response storage does not by itself provide zero data retention. Zero-retention treatment applies only where the provider has approved it and the feature supports it.
• Local browser storage: the extension caches your profile in chrome.storage.local so autofill is instant. Clearing the extension's data or uninstalling it removes the local cache.

• Your account and record: for as long as your account is open. When you delete your account, we remove it from active systems as described under “Delete” below.
• Birdee's memory (only if you turned it on): saved conversations for 12 months, then deleted; the facts Birdee learned until you delete them or your account.
• People UTern found who never answered: 180 days after the one email, then deleted.
• Seat and scoring records (who was invited to a seat, eligibility answers, scores with their reasons, the short list and the hire): 4 years, because employment law requires hiring records to be kept. If you delete your account, these records are anonymized: your name and contact details are removed and the record is kept without them.
• Opt-outs, bounces and complaints: kept as a one-way hash of the address for as long as UTern sends email, so you are never contacted again.
• Email verification results: cached for 90 days under a one-way hash of the address, never the address itself.
• Connected Gmail: the grant is deleted when you disconnect or delete your account.

• Access: view everything in your profile at utern.ai/profile.
• What Birdee knows: with memory on, read, correct, download or delete every fact Birdee learned, and turn memory off, in Settings under “What Birdee knows about you”.
• Edit: change any profile field, re-upload your resume, update voice samples.
• Delete: email contact@utern.ai or use Settings to request account deletion. We disable the account and queue removal from active systems, including stored files and connected Gmail credentials. Failed steps are retried. Provider records, backups, legally required records and copies already received by employers may persist separately; we do not promise complete deletion within seven days.
• Export: download your account data in JSON from Settings, or contact contact@utern.ai for help. Credentials and private records belonging to other people are excluded.
• Revoke extension permissions: right-click the UTern icon in Chrome → Manage Extension → Permissions.

• Supabase: database, authentication, file storage.
• Vercel: hosting and edge functions.
• Google (Gemini) / OpenAI / Anthropic: AI model providers: the agent's conversations, reading a record against a seat, scoring a check, drafts you review, and web search (Gemini with Google Search grounding first) to verify claims and to find students for a seat.
• GitHub's public API: your public repositories and commit activity, read only to verify a claim you made about them.
• People Data Labs (where enabled): a licensed data vendor. For a person a seat found on the open web, UTern sends the public profile address, or the name and school, and receives a school or work email address. Never for students who signed up.
• ZeroBounce or NeverBounce (whichever is enabled): email verification. UTern sends an address to check that it exists before one email is sent to it.
• Origami: UTern's recruiting spreadsheet. Once an hour, UTern copies its seat pipeline there so the team can track each seat: for each student invited to or joining a seat, the name, email address and whether it was verified, where they were found, the seat, consent and eligibility state, the score and stage, and any opt-out; for each seat, its details and counts; for each company, the name, website and the contact person's name, email and role. Origami also finds work email addresses for hiring contacts at companies UTern may offer seats to.
• Public job sources, employer job boards and applicant tracking systems: internship listings, and, for a seat, the five names a company receives written into its own ATS (Greenhouse, Lever or Ashby, with the company's key).
• Resend: delivery of the email we send: account mail, seat invitations and introductions, the one-line vouch request, and the newsletter if you asked for it.
• Sendblue, Twilio and Vapi: texts and calls with the agent, only after you opted in and only from the number we publish.
• Stripe: the fee a company pays when it hires. We never see card numbers.
• Browserbase: browser sessions used for approved application assistance. New sessions disable recording and session logs.
• Google Analytics: optional page-category analytics, only after you allow it through UTern's privacy choices.
• PostHog (where enabled): product usage events that may be linked to your account, used to operate and improve the product.

Each provider's contract and configuration govern its processing and retention. Employers also handle applications under their own policies. Contact us about access, deletion, or provider-specific retention.

UTern is for college students and job seekers aged 18 or older. Users must affirm that they are at least 18 before accessing AI features. We do not permit use by people under 18. If you believe we have, email contact@utern.ai and we'll delete it.

If we change this policy, we'll update the “last updated” date at the top and, for material changes, notify signed-in users by email before the change takes effect.

Email contact@utern.ai. We respond within one business day.

UTern is operated by UTern Corp.