Legal & Compliance
Nomad's terms, data privacy regulations, cookie notices, and infrastructure isolation details.
1. Privacy Policy
At Nomad, we believe that your career search data belongs entirely to you. Your uploaded resumes, cover letters, parsed emails, and job applications are processed and stored securely. We do not sell, rent, or share your data with third parties.
Google Integration Permissions
Nomad requests access to specific, restricted scopes for Google Calendar and Gmail solely to automate your job application tracking:
- Gmail/IMAP Access: Used exclusively to scan incoming recruitment messages, extract status details, and sync card stages. No emails outside of career-related topics are stored or processed.
- Google Calendar Access: Used to write and delete interview events in coordination with your dashboard.
Your authentication tokens are stored securely in our database and can be revoked at any time via the settings page or directly through your Google account dashboard.
2. Terms of Service
Private Beta Scope
Nomad is currently operating in a private testing phase. Users must be explicitly authorized via the `ALLOWED_EMAILS` invite list to sign in and utilize database-connected features.
Since this is a testing phase, service availability is provided on an “as-is” and “as-available” basis. We reserve the right to modify or restrict service access as we optimize our system.
Data Ownership and Compliance
You retain full ownership and intellectual property rights to any content, resumes, or emails you import, upload, or process through Nomad.
By using Nomad, you agree not to submit unauthenticated or malicious files, use automated scraping methods to bypass security barriers, or upload documents violating other intellectual property rights.
4. Data Processing & Isolation
Cloud SaaS Infrastructure
Nomad’s database and storage assets are deployed securely on Supabase Postgres and Supabase Storage buckets (hosted in the eu-west-1 region). All transaction requests and file storage payloads are transmitted using SSL/TLS encryption.
Strict Tenant Isolation
To ensure that user data is never leaked or accessed by other accounts, Nomad enforces strict relation boundaries:
- Row-Level Security (RLS): All Postgres database tables have Row-Level Security enabled by default to restrict postgreSQL operations.
- Logical Verification: API endpoints verify the relationship owner of any linked foreign key in the body of requests.
Credentials Encryption
If you connect an IMAP mailbox, the account password is transmitted over TLS and encrypted with AES-256-GCM before it is stored - the database never holds it in plaintext. The decryption key is derived securely from the application’s environment secrets (`AUTH_SECRET`), which are kept strictly identical between local and production scopes.