Privacy policy

Last updated September 2026.

What Relinked collects

Your Google account identity and email address from sign-in. Gmail metadata headers — the sender, recipients, subject, and date of a message, plus Gmail’s own message and thread IDs — and never message bodies, snippets, attachments, or drafts. The profile and preference answers you give us. The contact graph derived from that mailbox: names, email addresses, email domains, employers, titles, how often and in which direction you corresponded, and the evidence behind a warm path. Subject lines are read in memory to sort a thread into a coarse type and are then discarded.

Relinked also records the job pages you view on supported sites. That view is normally stored as a hash of the page address along with view counts and visible dwell time; if you choose “Apply anyway” after a warm-path prompt, the page address itself is kept in that audit record. Your actions in the product — tracked and dismissed companies, outreach status, interview notes — are stored too.

If you upload a LinkedIn Connections export (the zip LinkedIn emails, or Connections.csv), the extension reads only that Connections file on your device, drops the export’s email column there, and sends names, profile URLs, companies, and titles so we can match them against people you already email. Only matched rows are stored. Unmatched rows are discarded once the request finishes.

Relinked does not store your card or bank details; Stripe holds those. We keep Stripe customer, subscription, and payment identifiers and your plan status. This marketing site runs no analytics, advertising pixel, session replay, or tracking cookie.

How Gmail metadata is used

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Gmail metadata is used solely to provide Relinked’s warm-path and job-search features.

• It is not used for advertising.

• It is not sold.

• It is not used to train generalized AI models. Relinked sends no data to an LLM.

• Gmail message content is never transferred to anyone, because Relinked never requests it. Contact names and employer names derived from Gmail metadata go only to the service providers named below, only for the purposes described there.

Where other data comes from

Relinked sends a contact’s name together with a known employer name to Apollo to resolve that person’s title and employment history, and sends company domains to Apollo for company details. It never sends a contact’s email address to Apollo: the request disables personal email and phone reveal, code rejects any email-shaped value before the call, and strips email fields from the response. Apollo receives no Relinked user ID.

Relinked also collects job postings from company career pages, Workday, Greenhouse, Lever, Ashby, and the licensed Coresignal job dataset, and reads public SEC filings to find named professional relationships. Those requests carry company, board, and posting information — not your identity, your contacts’ names, or their email addresses. The company whose postings we fetch can reflect that the company showed up in your graph.

Who we share with

Relinked uses these processors: Supabase (hosting, database, authentication, and scheduled jobs), Google (the Gmail access you authorize), Apollo (contact and company enrichment as described above), Coresignal (licensed job-posting data), Stripe (billing), and Resend (email we send you). Sentry error reporting is built in but inert unless a reporting key is configured for the deployment; when it is configured, reports are scrubbed of email addresses, tokens, and subject lines before they leave.

Relinked does not sell personal information and has no advertising, data-broker, or product analytics integration. Whether the Apollo transfer is a “sale” or a service-provider relationship under CCPA/CPRA is an open attorney item.

Email we send you

Relinked sends a role digest only if you turn it on in Settings and pick a cadence. It is off by default, and during alpha it is further limited to an explicit tester list. Resend delivers it. The message goes to your own account email and contains the roles Relinked matched for you — company, job title, level, location, and the posting link — plus the name of your best contact at each company and that contact’s employer, and any job change you have already accepted in review. Those contact names and employers are third-party personal data disclosed to Resend so it can deliver the message.

No contact email address is included, and the sending code refuses to transmit a message containing any email address other than your own. Relinked does not keep the message it sent, only a record that a send was attempted and its counts. Resend keeps its own delivery logs and message content under its contract with us. Relinked sends no other marketing email, and has no push notification or SMS channel.

Retention, disconnecting, and deletion

Relinked has no automatic age-based deletion. Account, graph, evidence, outreach, billing-reference, and audit records stay until you change them in the product or delete your account.

Disconnecting Gmail revokes Relinked’s Google token on a best-effort basis and deletes the stored token, so no further mailbox reads happen. It does not delete the contacts, relationship statistics, scores, or evidence Relinked already derived from your mailbox; that graph stays in your account until you delete the account. Disconnecting LinkedIn deletes the rows matched from your Connections export, the connection evidence and cached results the verifier produced, and any remembered profile URLs, and turns off future verification consent. One record is kept: a log of how many LinkedIn pages were read and when, which is what enforces the daily reading limit. Clearing it would let disconnecting and reconnecting reset that limit. It holds no names or job titles and is deleted with your account.

Deleting your account from Settings deletes your Stripe customer record, revokes the Google token on a best-effort basis, then deletes your login and every table that hangs off it: contacts, the email addresses and threads in your graph, scores, targets, evidence, job changes, LinkedIn rows, outreach and interview records, settings, subscription state, audit events, and processing jobs. The extension clears its local storage once the server confirms. A canonical person record that no other user’s graph still references is removed with it, along with that person’s stored email addresses and employment history. Shared reference data that is not about you — companies, schools, recruiter firms, public job postings, and public filing metadata — is kept.

There is one deliberate exception. If someone has asked us not to enrich them or not to surface them, we keep the minimal record that identifies who the request applies to — their name, the address it was made about, and the request itself. Deleting it along with the graph would mean forgetting the request, and we would start processing them again the next time their address appeared in someone else’s mailbox. Honouring a standing objection requires remembering it.

One record survives deletion: a privacy-request receipt showing that a deletion was requested and completed, including the email address that requested it. Records of privacy requests have to be retained, so deletion is not the erasure of every trace of the account.

Relinked cannot delete what a third party holds on its own legal basis. Google keeps its own account and security records; Stripe keeps transaction and compliance records even after we delete the customer; Resend keeps delivery logs. Relinked sends no deletion request to Apollo, Coresignal, LinkedIn, the SEC, or public job boards, and their retention is governed by their own contracts and policies.

California residents

You can export your data, edit your profile, and delete your account from Relinked Settings. The in-product download covers your account, profile, contacts, relationship and evidence records, outreach, and activity; it does not yet include every record we hold about you, so for a complete copy write to privacy@relinked.network and we will assemble it. Requests to know, correct, or delete, and any opt-out of sale/sharing if counsel determines a sale exists, are served at that address. Relinked is not directed to minors and does not knowingly collect minors’ data.

People who are not Relinked users

Your graph contains people who did not sign up. Relinked keeps that in two layers, and the two layers behave differently.

The relationship layer — that a person is your contact, how you corresponded, their score, the evidence behind a warm path, and your outreach — belongs to your account alone. Database row-level security enforces that: another user cannot read it and it never appears in another user’s product.

The identity layer — a person’s canonical record, with name, email addresses, and employment history — is shared infrastructure. It is keyed on the email address, which is globally unique, so when the same person appears in two users’ mailboxes both accounts point at one stored record rather than two copies. That deduplication is what keeps a person’s identity and employer history consistent. Those tables are backend-only: a signed-in user can read a person’s display-name record only when one of their own contacts points to it, and cannot read the email, employment, or education tables at all. Relinked does not publish a cross-user directory, does not tell one user that another user knows someone, and does not sell any of it.

A person who is not a Relinked user can write to privacy@relinked.network to ask what we hold about them, to be excluded from enrichment, to stop being surfaced to users, or to have references to them removed. We handle those requests by email; there is no self-service form.

Contact

privacy@relinked.network