Privacy Policy

Trellis (“we”, “us”) is a personal job-search assistant built for the 2026 Google Cloud Rapid Agent Hackathon. This policy explains what information we collect, how we use it, who we share it with, and the rights you have over it. By using Trellis you agree to the practices described below.

1. Information we collect

Account information. When you sign up we collect your email address. If you sign in with Google we additionally receive your name, profile picture URL, and Google account ID, as authorized by you through Google’s standard OAuth consent screen.

Google user data (Gmail). If you choose to connect Gmail, Trellis requests the https://www.googleapis.com/auth/gmail.readonly scope. We read message metadata (sender, subject, date, thread ID) and message bodies in order to detect recruiter outreach, build the conversations side of your pipeline, and surface stale threads. We do not send, modify, or delete any of your messages.

Google user data (Calendar). If you choose to connect Google Calendar, Trellis requests the https://www.googleapis.com/auth/calendar.readonly scope. We read event titles, times, and attendee lists to correlate interviews and meetings with applications in your pipeline. We do not create, modify, or delete events.

User-generated content. Applications you add or paste, notes you write, resumes and cover letters you generate, and questions you ask the agent.

Operational data. Authentication sessions, error logs, and minimal request metadata required to operate the service (e.g., timestamps, IP address for rate limiting and abuse prevention).

2. How we use information

• To operate the three loops of the product: intake (tailoring resumes from job descriptions), memory (answering questions about your pipeline), and maintenance (surfacing stale threads and follow-ups).
• To generate vector embeddings of your applications, conversations, and documents so we can perform semantic search across your own data.
• To authenticate you and keep your session active.
• To diagnose errors and improve reliability.

We do not use your data for advertising. We do not sell your data. We do not use your Gmail or Calendar contents to train, fine-tune, or improve any generalized AI or machine-learning model.

3. Google API Services User Data Policy

Trellis’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Google user data to provide or improve user-facing features that are prominent in the Trellis user interface.
• We do not transfer Google user data to others except as necessary to provide or improve user-facing features (e.g., the LLM providers listed below), to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
• We do not use Google user data for serving advertisements.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, we are doing so for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.

4. How we share data

LLM and embedding providers. To generate answers and embeddings we send the relevant portion of your prompt and retrieved context to large-language-model providers, currently Google (Gemini via Vertex AI), routed through the Vercel AI Gateway. These providers process the data on our behalf under their respective data processing terms and do not retain content for training when accessed via these paid APIs.

Database provider. Your data is stored in MongoDB Atlas, including the vector embeddings used for retrieval.

Email and OAuth providers. Authentication is handled by better-auth, which sends OTP emails through our email provider and exchanges tokens with Google for OAuth sign-in and Gmail/Calendar access.

We do not share your data with advertisers, data brokers, or any third party for marketing purposes.

5. Storage and security

Data is stored in MongoDB Atlas in encrypted form at rest. All traffic between your browser and Trellis is encrypted in transit via TLS. OAuth refresh tokens are stored encrypted and used only to re-authenticate against Google APIs on your behalf.

No system is perfectly secure. Trellis is a hackathon-stage project and we recommend you do not connect accounts containing data you would consider catastrophic to lose or expose.

6. Data retention

We retain your data for as long as your account is active. When you delete your account, all associated data — including indexed Gmail and Calendar content, embeddings, applications, conversations, and artifacts — is deleted within 30 days, except for the minimum metadata required to comply with legal obligations or resolve disputes.

7. Your rights

• Access and export. You can request a copy of the data we hold about you by emailing trellis@davidumoru.me.
• Deletion. You can delete your account at any time from the dashboard settings, or by emailing trellis@davidumoru.me.
• Disconnect Google. You can revoke Gmail and Calendar access at any time from your Google Account permissions page. Doing so will stop new data ingestion immediately; existing indexed data will remain until you delete your account.

8. Children

Trellis is not directed at children under 16 and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

9. Changes to this policy

We may update this policy as the product evolves. Material changes will be communicated by updating the “Last updated” date above and, for users with an active account, by email.

10. Contact

Questions, requests, or complaints can be sent to trellis@davidumoru.me.