Privacy policy

What we collect

Zorlya, "we" on this page, keeps only what the product uses. This is all of it.

Passwords are stored as bcrypt hashes. Tokens issued to AI apps are stored as SHA-256 digests, so a copy of the database holds no usable app credential. Apart from the log of AI app requests described under "Requests from AI apps", the API keeps no request log of its own that holds a message, a password or a token. Cloudflare's Worker logs are switched on for the API and for the inbound mail Worker, and they record the requests those Workers handle.

Jobs you add yourself

In the job seeker app you can add a job that Zorlya does not list, from its link, from posting text you paste, or both. The job is private to your account. It is not added to the jobs other people see, it is not searched, counted or shown anywhere else, and no company or administrator is shown it as part of the job index.

• If you give a link and no title or employer, our server opens that public page once and reads the title, employer, place and date posted from it. The site sees a request from our servers, not from your browser. We follow the site's robots.txt, we do not read the description, and we keep nothing from the page except those four details and the link. If the page cannot be read, nothing is saved and we ask you for the text.
• If you paste posting text, we keep the text you pasted, as you gave it.
• A job you add counts toward your plan's limit on saved jobs.
• Deleting the job, or your account, removes it. The copy of your data includes the link, title and employer of these jobs. It does not include the text you pasted; write to privacy@zorlya.com for a copy of it.

Your resume and AI models

A resume is parsed into fields and split into passages. Each passage is turned into an embedding, a list of numbers that lets Zorlya compare your experience with a job's text. A file that yields no readable text is refused and nothing is saved.

To score a job, explain a score or draft a letter, the relevant passages and the job text are sent to a model. By default the model runs on Cloudflare Workers AI, inside the same Cloudflare account that hosts Zorlya, and embeddings are made there too. No other model provider receives your data today. We may add providers such as OpenAI or Anthropic later. If we do, this policy and the security page are updated before any of your data is sent to one, under the notice rules in the terms. The text of a job you added is treated like any other job text. Each model receives only what one request needs, and Cloudflare does not train its models on Workers AI requests.

Model answers are cached by a hash of the prompt, so the same request is not paid for twice. A cached answer carries no account id.

The free resume checker

The resume checker at zorlya.com/resume-checker works without an account. You choose a DOCX file, or paste text, and the page sends it to our API. PDF files are not read yet.

• What happens to it. The server reads the file or the text in memory to make the result and drops it when it sends the answer. The file, its text and the result are not saved in our database, in storage or in a cache, and the checker writes none of them to a log. The result is shown on your screen only. If you create an account afterwards, you upload the resume again.
• No AI model. The checker uses fixed rules. It sends your file and text to no model and to no other company.
• Cloudflare Turnstile. When you choose a file, the page loads the Cloudflare Turnstile script to check that you are a person. Cloudflare receives the check and the address of your connection. Cloudflare's own terms say what the script keeps in your browser. This page does not know more than that, and it will say so if that changes.
• Abuse limits. Cloudflare's rate limiter counts requests from a network address for up to a minute. We keep no list of addresses.
• What we count. Each day we add one to a count of checks for the way each ended: done, refused for its file, refused for its size, or failed. A count holds no text, no file and no address.
• Sign-up link. The button to create an account carries the label resume-checker, which is kept as the sign-up channel described under "Cookies and storage".
• What it is not. The result is information about the file. It is not advice, not a hiring decision and not a prediction of how an employer's system reads your resume.

Requests from AI apps

You can let an AI app such as Claude, ChatGPT, Claude Code or Cursor connect to your Zorlya account. It then works as the one account you choose, with the permission level you pick, until you disconnect it. Zorlya logs what such an app asks for. This section says what is logged and why.

What is recorded. For each request an AI app makes to Zorlya, including the requests that are refused, we record:

• the time and a request number;
• the AI app, the connection, your account, the kind of account (job seeker, hiring, support or staff), your role and, for a hiring account, the company;
• the tool or method that was called;
• the contents of the request: the arguments the app sent, such as a search, a note or a draft reply it wrote, up to 64 KB. A longer request is cut: the first 60 KB and a hash of the whole are kept. For sign-in requests, a fixed list of parameters (the app's id, return address, permission level and similar);
• the result: its status, an error code if there was one, its size, a hash of it and how long it took;
• your IP address and your browser or program's user agent.

What is never recorded. The Authorization header, access tokens, refresh tokens, authorization codes, PKCE verifiers, client secrets and passwords sent in a sign-in request. The record of a sign-in request keeps only the fixed list of parameters, so those fields never reach it.

What is recorded exactly as sent. The arguments of a tool call are stored as the AI app sent them, and are not scanned or rewritten. If you type a password, a key or any other secret into a chat and the app passes it to Zorlya in a tool argument, it is stored with the rest of the request for 90 days. Do not put secrets in a chat with an AI app connected to Zorlya.

What is not recorded by default. The answer Zorlya sent back, because it holds details of other people, such as candidates and tickets. Only its status, size and hash are kept. A super administrator can switch on capturing answers from the MCP server for a limited time, at most 7 days, to find a fault. While that is on, those answers are stored. It ends by itself. Answers to sign-in requests are never captured.

Requests with no valid sign-in. Traffic that carries no valid token and comes from no known app is not stored request by request. It is counted per hour against a salted hash of the network address, and the count is deleted after about two days. No contents are kept. A request from a known app that fails to sign in is recorded like any other.

Why. To show you what an AI app did for you, to protect your account and other people's data, to investigate a complaint or misuse, and to keep a record of every change an app made. A request that changes data is accepted by the log's queue before it runs. If the queue does not confirm it, or the request cannot be read, Zorlya refuses the change. A request that only reads is recorded as it is answered, and if its contents cannot be stored the rest of the record still is.

How long. The contents of a request, and an answer if one was captured, are kept for 90 days. The rest of the record (who, which tool, when, status, size, hash, IP address and user agent) is kept for 13 months. Both are then deleted. The contents are stored in a private Cloudflare R2 bucket in the European Union. The queue that carries a record to the bucket, and the record in transit, are not tied to the European Union. This page does not say where the rest of the record is held; see security.

Who can see it. You can see your own connections' activity: the tool names, times and counts, and the contents of your own requests when you ask. Zorlya's super administrators can search the log and open the contents of anyone's request, and an answer if one was captured. Every time one does, or you open your own, that view is logged too, with who looked, at which request and when. A company owner or administrator cannot see a colleague's AI app activity.

What the AI app does with it. An AI app passes what it reads from Zorlya to the company that runs the app, such as Anthropic, OpenAI or Cursor's publisher. What that company does with it is set by its own terms and privacy policy, not by Zorlya, and Zorlya does not see your conversation with the app. A hiring or support account can read other people's details, such as a candidate's resume and notes or a customer's ticket. Connecting an AI app to such an account lets that app's company receive those details. Connect only an app you are allowed and willing to share them with.

Emails. Zorlya emails you each time an AI app is connected to your account. The email names the app, the account, the permission level, the time and the country the request came from, and links to where you can disconnect it.

While you connect. The Connect page keeps a record of the app, account, company and permission level you chose for 10 minutes, and sets two cookies on api.zorlya.com, __Host-zorlya_oauth and __Host-zorlya_oauth_form, that last at most 10 minutes. They tie the page to your browser and protect the form. They are needed to connect an AI app.

Deleting. Disconnecting an app ends its tokens at once. Deleting your account does not remove the log of your AI app requests automatically: the contents expire after 90 days and the rest after 13 months. Write to privacy@zorlya.com from your account address and we delete your log within 30 days.

Draft replies. A support agent's AI app can save a draft reply on a ticket. The draft is kept for the agent only, for up to 7 days, until the agent sends it or discards it. Nothing is emailed to the customer until the agent sends it.

Who else handles data

Cloudflare runs the site, the apps and the API, runs the default AI models, stores the mail described below in its R2 storage, keeps the log of AI app requests described below in its queue, database and R2 storage, receives and sends mail for our addresses, and delivers account email: verification codes, invitations, approval decisions, password reset links and the summaries you turn on. Account data, which includes resumes, is held in Cloudflare D1, and files such as resumes, pictures and ticket attachments in Cloudflare R2. Freemius processes payments for paid plans and is the seller of record; see "Payments" below. Gravatar is asked for a profile picture using a hash of an email address; see "Pictures" below. Google receives a copy of some mail sent to our addresses; see "Email you send to us" below. Google also runs Google Analytics on zorlya.com, the public site only, and Cloudflare measures page views and load times there without cookies; see "Cookies and storage" below. The company behind an AI app you connect receives what that app reads from Zorlya for you; see "Requests from AI apps". If you add a Slack or Discord webhook, your alerts are sent to it. The security page lists every service with the data it receives.

Account emails for the people who sign in to Zorlya are sent through Cloudflare Email Sending, from no-reply@zorlya.com. A password reset email holds a link that works once for 30 minutes. You can ask for one yourself on the sign-in page, and an administrator can send you the same email from the Dash. An administrator never sees the link or your new password.

Email you send to us

This section is about anyone who writes to an address at zorlya.com, such as support@ or privacy@, whether or not they have a Zorlya account. Our staff read that mail in Zorlya's own mail app.

• When a message arrives, Cloudflare Email Routing hands it to an Email Worker. The Worker saves the whole message, with its attachments, in a private Cloudflare R2 bucket that has no public address and is stored in the European Union. The platform then reads the message into the database: who sent it, who it went to, the subject, the text, the thread it belongs to, and the flags and labels our staff add.
• When our staff reply, the message is sent through Cloudflare Email Sending, and a copy is kept in the mailbox's Sent folder in the same two places.
• If we cannot save a message, or a mailbox is set to forward, a copy is forwarded to an inbox we own at Google (Gmail). Google then holds that copy under its own terms.
• A message in Trash or Spam is deleted for good after 30 days. Anything else stays until our staff delete it. "Delete forever" removes the message at once and its stored files within about 10 minutes.
• A mailbox that is deleted is emptied after 30 days: its messages, drafts, labels, filters and stored files are removed. Only its address is kept, so that nobody else is given it.
• A file that no message points to is removed after 7 days. A draft nobody saved for 90 days is removed. A mailbox sign-in session is removed 30 days after it ended. The log of mailbox events, such as sign-ins, messages received and sent, and attachment downloads, is trimmed after 400 days.
• Only people who were given access to a mailbox can read it. Opening an attachment or a raw message is recorded in that mailbox's event log. No feature lets an administrator read a mailbox they have no access to.

To have mail from or about you removed, write to privacy@zorlya.com from the address in question. We find the messages by the sender's address and delete them, together with their stored files. We answer within two working days and complete the request within 30 days.

Support tickets

A ticket is opened when you use the contact form, or from a signed-in account. It holds your name, your email address, the messages between you and us, the files you attach (PNG, JPEG or PDF, up to 10 MB each, 5 a message), the notes our team writes for itself, a timeline of what changed and when, and a rating and comment if you give one. If you are signed in, the ticket is linked to your account and, for a company, to your company. Attachments are stored as files in a private Cloudflare R2 bucket; storage is described under "Security" on the security page. An internal note is never shown to you.

• If you are not signed in, we email you a link to confirm your address. The link works once and expires after 24 hours, and only a SHA-256 digest of it is stored. Until you press it, the ticket is hidden from our team. A ticket nobody confirms is deleted after 7 days.
• A reply sent by email to a ticket joins it only when it comes from the address that opened it. Anything else becomes a new unconfirmed ticket.
• Our support team reads tickets in the support app. Each change a team member makes, and each attachment they open, is recorded in the audit log with the ticket reference, never with the text of a message. Resumes and profiles are not shown on a ticket.
• We reply from support@zorlya.com through Cloudflare Email Sending. A ticket that has been solved for 14 days is closed. Closing does not delete it.

Support tickets are kept for as long as the service runs, and they are not removed when you delete your account. The ticket stays, with your name, address and messages, and its link to your account is cut. Write to privacy@zorlya.com from the address on the ticket and we delete it within 30 days. A download of your data does not include your tickets; ask us for a copy of those.

Pictures

Your profile picture. If you add one in the apps, it is stored as a file in private Cloudflare R2 storage as PNG, JPEG or WebP, at most 512 KB, and removed when you remove it or delete your account. It is not listed anywhere, but the address that serves it does not ask for a sign-in, so anyone who has that address can open the picture. Without a picture, the apps ask Gravatar for one, sending a hash of your email address from your browser, and fall back to your initials.

Mailbox pictures. A person who has a mailbox with us can add a picture to it. It is stored in private Cloudflare R2 storage and shown only to people signed in to the mail app. It is not public.

Pictures of people who write to us. The mail app shows a picture beside an outside sender when it can find one. Our server makes the lookup, never your browser, so nobody outside learns that a message was read or by whom. In this order, for the first that has one:

• Gravatar, which receives a SHA-256 hash of the sender's address and our server's IP address. It does not receive the address itself, the reader, the message or the subject.
• The brand logo the sender's domain publishes (BIMI), only for a message that passed its DMARC check. We ask the Cloudflare DNS service (cloudflare-dns.com) for the domain's record, which tells Cloudflare the sender's domain, then fetch the logo the record names.
• The logo on the sender's own website, read from its home page after its robots.txt. The site sees a request from our server and learns nothing about the message or who read it.

Free mail domains such as gmail.com get the Gravatar lookup only. Answers are kept for 30 days when a picture was found and 7 days when not, and shared by everyone using the mail app. Each person using the mail app has a switch, Look up sender pictures, under Settings, Profile. When it is off, nothing is looked up for them and only pictures of our own mailboxes and initials show. We also have a switch that stops every lookup for everyone.

Cookies and storage

The apps set three cookies when you sign in: an access token that lasts 15 minutes, a refresh token that lasts 7 days and is replaced each time it is used, and a token that protects forms against cross-site requests. All three are needed to stay signed in. This site and the apps also remember your light or dark theme in your browser's local storage. Connecting an AI app sets two more cookies for at most 10 minutes; see "Requests from AI apps". Signing in at mcp.zorlya.com, to see your connections, sets a session cookie, zorlya_access_mcp, that lasts 8 hours and is used only on that site, and two cookies while you sign in: __Host-zorlya_mcp_flow for 10 minutes and __Host-zorlya_mcp_form for an hour. There are no advertising cookies.

Sign-up channel. If you arrive on a link that carries a channel, such as ?src=youtube, this site and the apps keep that one label in your browser's session storage under zorlya:src until you close the tab. It holds only the label from a fixed list of channel names, never anything that identifies you, and it sets no cookie. This site adds it to links that lead to the apps. If you then create an account, the label is saved once with the account. When you sign up with Google or GitHub, it is also held for up to 10 minutes in the one-use record of that sign-in. A label that is not on our list is saved as other, and the text of the link is never saved. If you accepted Google Analytics, it may also see the address you arrived on, including the label, as described below.

Google Analytics. This site, zorlya.com, uses Google Analytics 4 to count visits. The apps and the API do not use it. A banner at the bottom of the page asks you to Accept or Decline, and you can change your answer at any time with Cookie settings in the footer.

• If you accept, Google Analytics sets two cookies, _ga and _ga_ followed by an identifier of our property. Google's documentation gives both a default lifetime of two years. It counts page views and records your approximate location from your IP address, your device and browser, the site you came from and how you move through our pages. Google processes that data under its own terms. This site runs no ads, and the tag is told to deny every advertising signal.
• If you decline, or do nothing, no analytics cookie is set and nothing is stored on your device for it. The Google tag still loads, and it sends a basic ping with no cookie: the page address, the site you came from, your browser and device type, and your IP address, which Google receives with any request. That ping is not tied to a cookie from an earlier visit.
• If you decline after accepting, the _ga cookies are deleted from this site.
• Your browser's signal. If your browser sends Global Privacy Control or Do Not Track, we treat that as Decline and show no banner.
• Where it is not loaded. Pages whose address can hold a private token or your email address, such as payment complete, ticket confirmation and the surveys, do not load Google Analytics at all.

Cloudflare Web Analytics. Cloudflare, which already serves this site, also adds a small script to zorlya.com pages that measures page views and how fast pages load. It is separate from Google Analytics and does not depend on your choice in the banner. Cloudflare states that it uses no cookies or local storage for this, does not build a profile of you from your IP address or browser, and does not track you across other sites, so nothing is stored on your device and there is nothing to accept. It reports to this site's own address rather than to a third-party host. It records the page you viewed without the part of the address after a question mark, the site you came from, your browser, device type and country, and page load timings. Cloudflare keeps the detailed records for 7 days and then aggregates them. The apps and the API do not use it.

Your choice is kept in this browser's local storage under the key zorlya:consent. It is never sent to us.

This site and the apps can be installed on a device and opened without a network. A service worker stores the app's own files for that: its scripts, styles, fonts and images, and the page shell. It never stores an API response, a message, a file you uploaded or anything else about you, and it does not touch a request that carries credentials. When you sign out, the apps delete that storage and fill it again with the app's own files.

We do not sell or share your data

No data is sold, rented, or shared for advertising. Employers see nothing about you until you act. If you apply with Zorlya, the company sees your name, your resume and your note, and your fit score and its four parts only if you tick the box to share them. If you turn on Open to being found in Settings, companies see an anonymous card with what you do, where, and what you know: no name, no address and no current employer. A company learns your name and address only if you accept its request to talk, and then only that company does. You can hide any company, and your current employer is always hidden.

Your rights

Wherever you live, you can ask us to:

• Tell you what we hold about you, and send you a copy as JSON
• Correct anything that is wrong. Most of your profile you can edit yourself
• Delete your account and everything attached to it
• Stop processing your data, which in practice means closing your account

The copy and the deletion you can do yourself, in the app under Settings, Privacy: the copy downloads at once as one JSON file, and deleting asks for your password first. For anything else, or if you prefer to ask, write to privacy@zorlya.com from the address on your account. We answer within two working days and complete the request within 30 days.

Deleting your data

Applications, cover letters, outreach drafts, saved jobs, jobs you added, stored resume files and connected AI apps can each be deleted as you go.

To delete the whole account, open Settings, Privacy in the app, choose Delete account and enter your password. It happens at once and signs you out. You can also write to privacy@zorlya.com from your account address and we delete it within 30 days. Deleting an account removes your profile, resume files, embeddings, letters, applications, notes, settings and app tokens in one operation. The log of your AI app requests is the exception described under "Requests from AI apps". Model usage records stay as token counts and cost, with the link to you removed. Support tickets are the exception described under "Support tickets".

Before you delete, Download my data in the same place gives you a copy of everything as one JSON file. Passwords, tokens and embeddings are left out of it, and so are your support tickets.

Age

Zorlya is for people aged 16 and over. If we learn that an account belongs to someone younger, we delete it.

Changes

A change to what we collect, or to who handles it, is emailed to every account 30 days before it takes effect and recorded in the changelog.

Contact

Privacy questions and requests: privacy@zorlya.com. See also Security and Terms.