1. Information We Collect
When you use Fusso, we collect the following information:
- Account information: Your email address (via Google OAuth or email sign-up). We do not collect names or usernames.
- Application data: Job application details you enter (company names, roles, statuses, notes, salary information, interview dates, contacts)
- Usage data: Product analytics (page views, feature usage, session duration) to improve the app. For logged-in users, analytics is tied to your account — we send your user ID and email to PostHog (US-hosted). Analytics is consent-based; you may decline via the cookie banner shown on your first visit.
- Error data: Error reports including stack traces and browser information (via Sentry) to diagnose issues. Local variable values are not captured, and sensitive fields are redacted before reports leave the server.
- Billing data: If you subscribe to Pro, payment processing and subscription management are handled by Lemon Squeezy (fusso.lemonsqueezy.com). We do not store full payment card numbers.
2. How We Use Your Information
We use your information solely to:
- Provide and maintain the job application tracking service
- Send you reminder emails about follow-up dates (Pro feature)
- Improve the app based on usage patterns and error reports
- Process subscription payments and manage your account (Pro tier)
- Respond to your support requests
- Comply with legal obligations
3. Data Storage and Security
Your data is stored securely with the following protections:
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3
- Encryption at rest: Data is stored encrypted at the database level
- Row-Level Security (RLS): Each user can only access their own data — enforced at the database level
- Authentication: Passwords are handled by Supabase Auth using industry-standard bcrypt hashing. We never store raw passwords.
- Session management: Sessions expire after 24 hours of inactivity. Secure, same-site cookies are used for session tokens.
- Infrastructure: Hosted on Vercel (SOC 2 compliant) with database on Supabase (SOC 2 compliant).
4. Data Retention
- Active accounts: Your data is retained for as long as your account is active
- Deleted accounts: When you delete your account, all associated data is permanently deleted within 30 days. Backups are purged within 90 days.
- Analytics data: Aggregated, anonymized analytics data is retained for 12 months
- Error logs: Error reports are retained for 90 days
- Activity Logs: Fusso retains activity logs (create, update, delete actions) for the duration of your account. If you choose to clear your activity log via the Data Management settings, logs are soft-deleted and remain recoverable for 90 days before permanent deletion. You may restore cleared logs at any time within that 90-day window. This is a privacy protection measure — we do not retain data you've chosen to remove. Activity log data is stored in Supabase (PostgreSQL) and subject to the same security controls described above.
- Reminder logs: We keep a log of reminder emails sent to you (Pro feature) to prevent duplicates and troubleshoot delivery.
5. Third-Party Services
We use the following third-party services to operate Fusso:
- Supabase — Database and authentication provider. Stores your account data and application data. Privacy Policy
- Vercel — Hosting provider. Serves the application and handles deployment. Privacy Policy
- Resend — Email delivery service (Pro feature). Sends follow-up reminder emails. Privacy Policy
- Sentry — Error tracking service. Captures error reports to help diagnose and fix issues. Privacy Policy
- PostHog — Product analytics. For logged-in users, receives user ID and email (US-hosted). Initialized only after you accept the analytics consent banner. Privacy Policy
- Lemon Squeezy — Subscription billing and payment processing (Pro subscribers only). We do not store payment card numbers. Privacy Policy
- Google — OAuth identity provider when you sign in with Google (email, name, profile picture). Privacy Policy
- When required by law: To comply with legal obligations or enforceable governmental requests
6. Your Rights
You have the following rights regarding your data:
- Access: View all your data at any time through the app dashboard
- Export: Download your full data as JSON from Settings → Data Management. Applications can also be exported as CSV from the applications view (Pro feature).
- Delete: Delete your account and all associated data at any time from Settings → Data Management
- Rectification: Edit or update your application data at any time through the app
- Data portability: Request a machine-readable copy of your data by contacting us
- Analytics consent: accept or decline product analytics at any time via the cookie banner. Reminder emails are a Pro feature — you can stop receiving them by cancelling Pro or deleting your account.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). If you are in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). To exercise any of these rights, contact us at support@fusso.app. We do not respond to Do Not Track signals; we do not engage in cross-site advertising tracking.
7. Cookies
We use a minimal set of cookies and browser storage required for the application to function:
- Supabase Auth session token: Required to keep you signed in. This is a secure, same-site cookie.
- Local Storage: Used to store filter preferences, view mode preference, and sync queue data. This data never leaves your browser.
- Analytics (PostHog): Only initialized after you accept the analytics consent banner. Stores an identifier in Local Storage for product analytics. Does not track across websites. You may decline — the app works fully without analytics.
We do not use tracking cookies, advertising cookies, or third-party marketing cookies. No data is sold to advertisers.
8. Security Practices
- Authentication: Google OAuth and email/password authentication via Supabase Auth, which includes built-in brute-force protections.
- Authorization: Row-Level Security (RLS) on all database tables ensures per-user data isolation.
- API security: Server API routes implement rate limiting and input validation (Zod schemas).
- HTTPS: All connections use TLS 1.3. HSTS enabled with preload.
- Security headers: Content Security Policy, X-Frame-Options, X-Content-Type-Options configured.
- Dependency management: Dependencies are regularly reviewed and updated.
- Data minimization: Only necessary data is collected. Service role keys are never exposed to the client.
9. Children's Privacy
The Service is intended for users aged 18 and older. We do not knowingly collect personal information from children under the age of 13 (or under 16 for users in the EEA). If you believe a child has provided us personal information, contact us at support@fusso.app and we will delete it.
10. International Data Transfers
Fusso's infrastructure and service providers are located in the United States. If you access the Service from the European Economic Area, the UK, or Switzerland, your personal data will be transferred to and processed in the US. We rely on appropriate safeguards, including the Standard Contractual Clauses and the data-processing agreements offered by our subprocessors (Supabase, Vercel, PostHog, Sentry, Lemon Squeezy, Resend). Contact us at support@fusso.app for more information.
11. Incident Response
In the event of a security incident or data breach:
- We will investigate and contain the incident within 24 hours of discovery
- Affected users will be notified within 72 hours via email
- We will work with relevant authorities as required by law
- A post-incident review will be conducted to prevent recurrence
12. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will also notify you via email.
13. Contact
For questions about this privacy policy, data handling practices, or to exercise your data rights, contact us at:
Email: support@fusso.app