Privacy Policy
Last updated November 4, 2026
This policy explains what First Hello collects, why, and who it's shared with. We don't sell your data.
What we collect
- Account: your email address and sign-in details (through our sign-in provider or Google).
- What you add: job postings you paste, contacts you save (names, titles, companies, LinkedIn links, work emails), notes, your background, and the emails we draft for you.
- Gmail, if you connect it: permission to create drafts and to read the email threads with contacts you've written to, so we can tell when an email was sent, bounced or got a reply. We don't read the rest of your inbox.
- Usage: actions you take in the app (searches, lookups, drafts), used for limits, debugging and improving the product.
- Payments: handled by Stripe. We store your plan and subscription status, not your card number.
Public information about the people you contact
To find people and their work emails, and to research them, we use public web sources and data providers. We only use this to help you write to that person.
Who we share data with
Only the service providers needed to run First Hello:
- Supabase: database and backend functions
- Vercel: website hosting
- OpenAI and Google (Gemini): reading job postings and search results, and writing drafts
- Tavily: web search
- Blitz and Apollo: work email lookup
- Google (Gmail API): drafts and reply tracking, if you connect Gmail
- Stripe: payments
We may also disclose data if the law requires it.
Google user data
First Hello's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- What we access: with gmail.compose we create and update drafts you ask for; with gmail.readonly we read only the threads with contacts you saved in First Hello, to detect sends, bounces and replies; with your Gmail address we recognise which messages are yours.
- How we use it: only to show and run these features for you. When you ask us to draft a reply, the contact's last message is sent to OpenAI to write that draft; OpenAI does not use API data to train its models.
- What we never do: sell Gmail data, use it for advertising, use it to train AI models, or transfer it to anyone except as needed to provide these features, for security, or to comply with the law.
- People: no one at First Hello reads your Gmail data unless you ask us to (for example for support), it is needed for security, or the law requires it.
- Your control: disconnect Gmail anytime in Settings, or revoke access at myaccount.google.com/permissions. On disconnect we delete the stored Gmail token.
Keeping and deleting data
We keep your data while your account is open. You can disconnect Gmail anytime in Settings. To delete your account and data, email yg3028@columbia.edu. We'll delete it within 30 days, except records we must keep for legal or tax reasons (such as payment records).
Security
Data is sent over encrypted connections, and access to the database is restricted. No system is perfectly secure; tell us right away if you think your account was accessed without permission.
Changes
We'll update this page when the policy changes, and email you about significant changes.