Privacy Policy
Effective August 27, 2026
This is a template, not legal advice. Larp Log is a prototype. Before launching to real students, this document must be reviewed by qualified counsel, and the Google and Microsoft app verification processes must be completed. See LEGAL_RISKS.md in the repository for the open items.
The short version
- You choose one mailbox to connect. We read recruiting-related mail from it and nothing else.
- We extract structured events (“CodeSignal received, Aug 15”) and discard the message text. We do not store the bodies of your emails.
- Your verified applications contribute de-identified stage records to aggregate statistics. Other users never see your name, address, employer contacts, or individual timeline.
- Cohorts below a configured minimum are suppressed entirely rather than shown as small numbers.
- You can disconnect, withdraw contribution consent, or delete everything at any time.
Who we are
Larp Log (“we”) is a tool for United States college students tracking internship applications. This policy covers the Larp Log web application.
The mailbox you connect
Larp Log works by analysing recruiting email. When you connect a Google or Microsoft account, you authorize read-only access to that mailbox through the provider’s own consent screen. We never ask for your password, and we cannot send mail on your behalf.
Connect the email you actually apply with
This matters enough to state plainly. Connect the account you actually use to apply for internships. If you connect a different email:
- your applications may not be found;
- your tracker may be empty or incomplete;
- application verification may fail; and
- crowdsourced movement for those internships will remain locked.
Scopes we request
| Provider | Scope | Why |
|---|---|---|
openid, email, profile | To confirm which account you connected, asserted by Google rather than typed by you. | |
gmail.readonly | To read recruiting messages. This is a Google “restricted” scope subject to app verification and a security assessment. | |
| Microsoft | openid, email, profile, offline_access | Identity, plus the ability to refresh access without re-prompting you. |
| Microsoft | Mail.Read | To read recruiting messages via Microsoft Graph. |
We narrow at the provider wherever possible — the Gmail query and the Graph search we issue target recruiting vocabulary and known applicant-tracking senders rather than sweeping your whole mailbox.
What we extract and keep
For each recruiting message we identify, we store:
- the employer, internship, and requisition ID where determinable;
- the recruiting event and its date (for example “HireVue received”);
- the sending domain and the applicant-tracking vendor, used to weight how reliable the evidence is;
- a redacted subject line, with email addresses, phone numbers, and long identifiers removed; and
- a hash of the message used to avoid processing it twice.
We do not store message bodies. Content is processed in memory on the server to extract the above, then discarded. We do not log raw email content.
Aggregate movement, and how it stays anonymous
The community side of Larp Log answers “have other applicants started moving?” It is built from contributions, and it is engineered so a contribution cannot be traced back to a person:
- No user identifiers. Aggregate records carry a salted one-way HMAC of your user ID, not the ID itself. The hash exists only so you are counted once per round.
- Day precision at most. Timestamps are truncated to the day before storage, and coarsened further to a week when a cohort is small.
- Small cohorts are suppressed. Below the configured minimum (currently five candidates), counts render as “Activity detected” and timing statistics are withheld entirely.
- No row-level access. No interface, API, or export exposes individual candidate records.
Only verified applications from a connected inbox contribute, and only for United States internships. Manually added applications never contribute.
Why access is tied to contribution
You can see community movement for internships we verified you applied to. That reciprocity is what makes the data trustworthy: without it, anyone could sign in with an unrelated account and consume the pipeline without contributing anything to it. It is not a punishment, and public listing details for every internship remain visible to you whether or not you applied.
Legal bases and purposes
| Data | Purpose | Basis |
|---|---|---|
| Account details | Authentication, support | Contract |
| Mailbox contents (transient) | Extracting your application events | Your explicit consent |
| Extracted events | Building your personal tracker | Contract |
| De-identified stage records | Aggregate community statistics | Your explicit consent, revocable in Settings |
| Audit log | Security, abuse detection | Legitimate interest |
Retention
- Message bodies: not retained.
- Extracted events and applications: until you delete them or delete your account.
- Provider tokens: until you disconnect, then erased.
- De-identified aggregate records: removed when you withdraw consent or delete your account, after which the affected statistics are recomputed.
- Audit logs: retained for a limited period for security purposes.
Your controls
- Disconnect your inbox. Revokes our access and locks community movement that inbox unlocked. Your personal history is kept.
- Withdraw contribution consent. Deletes your aggregate contributions and recomputes the affected statistics.
- Delete your account. Removes your account, applications, events, entitlements, and aggregate contributions.
- Correct mistakes. Classification is imperfect; you can correct employer, internship, location, dates, stages, and duplicates.
Depending on where you live, you may also have rights to access, port, or restrict processing of your data. Manage most of this in Settings.
Security
- Provider tokens are encrypted at rest (AES-256-GCM) and never sent to the browser.
- Sessions are opaque tokens in HTTP-only, SameSite cookies; only their hashes are stored.
- There are no passwords. You sign in with Google or Microsoft, and Larp Log never sees your provider password.
- Community access is enforced server-side; restricted data is never sent to the browser and hidden.
- Third-party assets (company logos) are proxied server-side so no API credential reaches your browser.
No system is perfectly secure. See SECURITY.md in the repository for the full model and its known limits.
Third parties
- Google LLC and Microsoft Corporation — mail access, only for the account you connect.
- Logo.dev — company logos. Requests are made from our server by domain name; no information about you is sent.
- Database hosting — application data at rest.
We do not sell your data, and we do not use it for advertising.
Google API Services user data
Larp Log’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the user-facing features described here; we do not transfer it except as required by law, and we do not use it for advertising or allow humans to read it except with your explicit consent, for security purposes, or as required by law.
Accuracy
Larp Log only sees candidates who use Larp Log, so community data is always partial. Employers change their processes mid-cycle. Listing statuses can go stale. Community movement describes other applicants and does not predict your outcome. Silence at any stage does not mean you were rejected.
Children
Larp Log is intended for college students and is not directed to children under 13.
Changes
We will update the effective date above when this policy changes and will notify you of material changes before they take effect.
Contact
Questions about this policy or your data: reach the operator of this deployment. This prototype has no published contact address yet — that must be added before launch.