Morrow Privacy Policy

Morrow is a job-application tool operated by Simkins & Elgazar LLC, a Virginia limited liability company. In this policy, “we,” “us,” and “our” mean that company. “You” means the person who holds a Morrow account.

You can reach us about anything in this policy, including a privacy request, at hello@morrowhq.app.

Our mailing address is 10612 Center Street, Fairfax, VA 22030, United States.

Morrow works by running a worker app on your own computer. That design is the reason this policy reads the way it does.

• Your browser session never leaves your computer. Your resume is different. We keep a copy of the file in private storage so the Morrow app on your computer can get it, and we read it when you sign up to get answers ready for you to check. Section 4.17 says when we read it and how long we keep it.
• Your saved answers are held in our cloud. They have to be, because that is how Morrow fills a form on a laptop it has never seen before. Earlier versions of our privacy page said otherwise. That was wrong, and this policy corrects it.
• We do not sell your personal information, we do not share it for cross-context behavioural advertising, we do not train any model on it, and we run no advertising or third-party analytics in any Morrow app or on our website.
• Morrow only applies to jobs you picked. It never makes up a fact, and it never answers a legal, consent, or background question you have not answered yourself. For fact questions it uses your saved answers and your resume.

These things live on the computer running the Morrow worker app, and we never receive them, except a locked copy of a job site password that we can’t open and a private copy of your resume file, both described below:

• Your resume file. When you add a resume, we keep a copy in private storage so your account and your computer stay in sync and your applications can attach it. It is not public, and only your account and the Morrow systems that fill your applications can reach it. We also keep the filename, format, version, and a SHA-256 checksum. A filename usually contains your name, so we treat it as personal information. Deleting your account deletes the stored copy. The text of a resume you submit to a Resume Improvement Workshop is handled as described in section 4.13. We read your resume’s text only at the times listed in section 4.17.
• Your browser session. The worker fills forms in a browser on your machine. Your cookies, logins and browsing history stay there.
• Job site passwords. Some job sites make you sign in before you apply. You create that account yourself; Morrow never creates one. You can type its password into the Morrow app on your computer, or into the Morrow phone app or website. If you use your phone or the website, the password is locked (encrypted) on that device, with a key that only your paired computer has, before it is sent. Morrow passes the locked copy to your computer and cannot open it. Your computer unlocks it and keeps it in its own password store (Mac Keychain or Windows Credential Manager). We delete the locked copy when your computer picks it up, or after 7 days if it never does (and we tell you, so you can send it again). We keep a short record of which job site it was for and whether it arrived for 7 more days. Locked copies can remain in our encrypted database backups for up to 7 days after we delete them, where they still cannot be opened without your computer. On Windows, Credential Manager doesn’t lock items to one app, so other programs running as you can read them.
• Local diagnostic files. The worker keeps its own screenshots and failure logs on your machine, and cleans them up itself. Each application’s screenshot is deleted as soon as that application reaches an end state, whatever the outcome. Anything a crash left behind is swept at the next start-up once it is more than 24 hours old. The engine’s failure log, which can contain a field label and a value, is cleared after 7 days.

This section is the honest inventory. It is written from the database schema, not from intent.

4.1 Account and sign-in

Your email address, your password in hashed form, your display name, your time zone and quiet-hours settings, and your app preferences. Kept until you delete your account.

4.2 Your answer bank

Every question a job application has asked you and the answer you gave, saved so you never have to type it twice. This includes the identity fields Morrow needs for almost every form: your name, email address and phone number.

It also includes the voluntary self-identification answers you chose to save — gender, race or ethnicity, veteran status and disability status, and, where a form asks, citizenship, sponsorship need and security clearance. Under California and most other state privacy laws, racial or ethnic origin and disability status are sensitive personal information. We hold them because you asked Morrow to reuse them; you can edit or remove any answer in the app at any time.

It also holds the answers on your answers card: whether you can work in the US, need a visa, are 18 or older, your citizenship, whether you are OK with a background check or a drug test, whether you have a criminal record (you can choose “Prefer not to say”), clearance, past government work, a non-compete, whether you know anyone at the companies you pick, and whether Morrow may tick consent boxes for you. If you choose “No, keep private” for gender, race, veteran and disability, we save “Prefer not to say” for those four. These answers are used only to fill the applications you picked.

Your answer bank is readable only by your own account, enforced at the database. It has no expiry date and is kept until you delete your account.

4.3 Applications under review

For every application waiting for your approval, we hold the field-by-field card you see on your phone: each field’s label as the employer wrote it, and the exact value about to be submitted. These rows are removed when the application they belong to is removed.

4.4 Submissions and receipts

For every application Morrow submits, we keep a permanent ledger line: the company, the job title, the job URL, the applicant-tracking system, the timestamp, the outcome and the employer’s own confirmation text. This is the record behind the Nothing-False Guarantee, and it is kept for as long as your account exists.

Alongside it we keep the frozen field list of what was actually submitted. Fields in the sensitive group described in section 4.2 are flagged and deleted after 90 days; the rest of the field list and the ledger line survive.

We also store the results of Morrow’s nine honesty checks. Those results carry field keys, labels and outcome codes only. The answer values themselves are stripped out before the record reaches our database.

4.5 Application screenshots

Morrow takes a full-page screenshot of each application, which is what a guarantee claim is judged against.

Sensitive fields are masked on your own computer before the image is uploaded. A solid box is painted over each self-identification, work authorization, sponsorship and clearance field, the masked image is the one the checksum covers, and the masked image is the only version ever sent anywhere, including to the vision model that verifies the submission. In your review screen you will see the box and the caption “If this form asks for self-ID, work authorization or clearance answers, they are covered in this preview. Every answer is in the field list.”

Screenshots live in a private storage bucket with no public reads. Access is a signed link that expires after 300 seconds and only works for the account that owns the image. Screenshots are deleted after 90 days. A screenshot attached to an application that was closed, expired, skipped or parked without ever being submitted is deleted after 30 days.

4.6 Questions Morrow could not answer

When a form asks something Morrow cannot answer honestly from your saved answers or your resume, it saves the question so it can ask you. That saved question is the employer’s wording, which occasionally is itself a self-identification question. Sometimes Morrow saves a suggested answer with it, for you to accept or change. Kept until you delete your account.

4.7 Devices

The name, platform and version of the laptop you paired, plus a one-way hash of its pairing token; your phone’s push notification address; and the six-digit pairing code, which is deleted 24 hours after it expires. When a device attempts to pair, we record the IP address it came from to rate-limit abuse. Those IP records are deleted after 24 hours.

4.8 Billing

Your subscription tier, status and period, mirrored from our subscription service, and a Stripe customer identifier that links your account to your billing record. We also keep the credit ledger behind tailoring credits. We never receive or store your full card number.

4.9 Usage and telemetry

Counts of how many applications you ran per day and per billing period, and the metering counts behind Morrow’s model calls (number of calls, tokens and cost — never the text sent or received).

Separately we collect product telemetry to find and fix failures. Telemetry is pseudonymous, not anonymous: each event carries a keyed one-way hash of your account id computed with a secret only our server holds. It carries nothing else that identifies you. The only values a telemetry event is allowed to contain are the applicant-tracking system’s name, an outcome, a duration, a time-to-approve bucket, an error code, a count, your plan tier, your platform and the app version. Field labels, field values, question text, names, emails, phone numbers, resume text, job URLs and screenshots are forbidden and rejected by the database itself.

Telemetry is deleted after 180 days. It is one of two categories that are not deleted when you delete your account (the other is in section 4.14); see section 8.

4.10 Email and support

We queue transactional email for sending: your receipt notices and your daily recap. Those messages carry company names, counts and links to your own receipts, never your answers, question text, resume text or job URLs. Queued messages are deleted 30 days after they are sent.

When you write to us at hello@morrowhq.app, your message is delivered into our Google Workspace mailbox at aelgazar@simkinselgazar.com by a routing rule, and it is kept there so we can answer you and keep a history of the conversation. Our reply comes back from hello@morrowhq.app. We keep support mail for 12 months.

4.11 Waitlist

If you gave us your email address on our website before launch, we hold that address and where it came from. We delete it when you unsubscribe, when you create an account with the same address (it is merged into the account), or 12 months after launch day, whichever comes first.

If you join the Concierge waitlist, we hold your email address and which page or link you came from, and use them only to tell you when Concierge opens. We delete them when you unsubscribe, when you become a Concierge customer, or 12 months after you joined the list, whichever comes first. Creating a Morrow account with the same address does not remove you from the Concierge list.

Every email we send to an address on either list carries an unsubscribe link.

4.12 Replay records

To make sure a network retry never submits your application twice, we store the response to certain worker calls for 7 days. For one of those calls the stored response contains a copy of your answer bank and your name, email and phone number. It is readable only by our own servers, never by any user, and it is deleted with the rest after seven days.

4.13 Resume Improvement Workshop

If you start a Resume Improvement Workshop, the text of the resume you submit to it is stored on Morrow’s servers for the workshop and deleted 30 days after the workshop finishes or is cancelled. The answers you give during the workshop are stored and deleted on the same schedule. The finished file the workshop produces is stored for download for that same 30 days. The text is sent to a model under no-retention routing (section 6).

4.14 Test-drive records

To give one test drive per person, we store a one-way hash of your payment card’s Stripe fingerprint (not your card number) and a one-way hash of your computer’s operating-system identifier, computed on your computer, together with the date of first use. These records are kept for 24 months from first use and are not deleted when you delete your account, so that the same card or computer cannot start a second test drive under a new account. They are used for no other purpose and are readable only by our servers.

4.15 Stories and drafted answers

Stories you save are used only to draft answers you approve. To write a draft, Morrow sends your stories, the job posting, the company, the job title and the question to an AI model under no-retention routing (section 6). Your stories stay until you delete them or your account. Drafts you don’t use are deleted 7 days after the question closes.

4.16 Website visits

Website visits. When you visit morrowhq.app we record the page, the time, the site you came from, any campaign tag in the link, and which buttons you click. We do not set a cookie for this and we do not keep your IP address. A one-day code made from your IP address and browser lets us count a visit once; it cannot be reversed and is not linked across days. If you sign up, the campaign tag from your first visit is kept on your account so we know which post brought you.

4.17 Your resume files and the answers we draft from them

As section 3 says, when you add a resume, at sign-up or later in the Morrow app, we keep a private copy of the file. This section says when we read it and how long we keep it.

We read your resume’s text only at these times:

• once when you add it at sign-up, so we can draft answers for you to check
• when you tap “Redo from my resume”
• when a form asks a fact question that is not in your saved answers, so Morrow can find the answer in your resume
• when you start a Resume Improvement Workshop (section 4.13)

Each time, the text is sent to an AI model (Anthropic’s Claude) under no-retention routing (section 6), and we do not keep the text afterward, except as section 4.13 says for a workshop. We never use it to train a model.

The copy you add at sign-up is deleted once the Morrow app on your computer has its own copy, or after 30 days if you never connect a computer. Copies of resumes you add later are kept until you remove that resume or delete your account.

The answers we draft are saved until you approve or delete them, and removed 30 days after you check them. Answers you approve join your answer bank (section 4.2).

Earlier versions of this policy said your resume file never reached us. That stopped being true when we added syncing between your computers. This section corrects it.

We use what we hold for these purposes and no others: to run your account and sign you in; to fill and submit the applications you picked; to remember your answers so you are asked once; to read your resume and draft answers for you to check; to show you an application before it is sent and record what was sent; to honour the Nothing-False Guarantee and the Receipt Guarantee; to bill you and manage your subscription; to send you receipts, recaps and service notices; to answer your support messages; to keep the service secure and to rate-limit abuse; and to find and fix failures using pseudonymous telemetry.

Test-drive records. We use the records in section 4.14 to give one test drive per person.

We use the service providers below. Each acts on our instructions only, and none of them is permitted to use your information for their own purposes. This is not selling and it is not sharing for advertising.

What reaches a model provider is the application content needed to fill or check that one form, your resume text and stories when Morrow drafts or looks up an answer (section 4.17), and the masked screenshot — the sensitive fields are already painted over before the image leaves your computer. We keep no copy of a model’s prompt or completion; we record only the call count, token counts and cost.

We may also disclose information if the law requires it, to enforce our Terms, or to a buyer as part of a merger or sale of the business, in which case this policy travels with it.

• We do not sell your personal information, and we have not sold it in the past 12 months.
• We do not share it for cross-context behavioural advertising, and we have not in the past 12 months.
• We do not use your data to train any model, and no provider we use is permitted to.
• We run no advertising, no advertising identifier and no third-party analytics in any Morrow app or on our website.
• We do not apply to a job you did not pick.
• We do not store your full card number.
• We do not read your browsing activity.
• We read your resume only at the times listed in section 4.17.

Deletion. You can delete your account from inside the app, or from the Delete my account page at /account/delete, signed in or signed out. Deletion removes your stored screenshots, releases any Founding Hundred seat, clears your rate-limit state, deletes your sign-in record, and cascades to every row tied to your account: your picks, holds, answers, receipts and receipt field lists, parked questions, worker devices, push tokens, usage and credit history, and entitlements. It also deletes the copies of your resume files and any answers we drafted for you.

Two categories survive on purpose: telemetry events and the test-drive records described in section 4.14.Telemetry rows carry a one-way keyed hash of your account id, not your account id, and no information that identifies you. They expire by themselves after 180 days. They are pseudonymous before your deletion and stay that way after it.

Access and a copy of your data. Write to hello@morrowhq.app and we will send you a copy of what we hold about you. Email hello@morrowhq.app and we will send you a machine-readable export within 30 days. There is no self-service export button yet; a later version will add one.

Correction. You can edit any answer in your answer bank in the app, and your profile details in your account settings.

California residents (CCPA/CPRA). You have the right to know what we collect, the right to delete it, the right to correct it, the right to a portable copy, the right to limit our use of sensitive personal information, and the right not to be discriminated against for exercising any of these. The categories we collect, and why, are in sections 4 and 5. We use sensitive personal information only to fill the applications you picked and to keep the record of what was sent, which is a permitted purpose that does not require a “Limit the Use of My Sensitive Personal Information” link; you can still remove those answers yourself at any time. We do not sell or share your personal information. Make a request at hello@morrowhq.app; we will verify it against your account email before we act on it, and you may use an authorised agent.

Virginia residents (VCDPA). You have the right to confirm whether we process your personal data and to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, or profiling with legal effects — none of which we do. Virginia’s law requires opt-in consent for sensitive data, and the self-identification answers in section 4.2 are saved only if you choose to save them. If we refuse a request you may appeal by replying to our decision at hello@morrowhq.app, and if the appeal is denied you may contact the Virginia Attorney General.

Other states. If you live in a state with a comprehensive privacy law, you have broadly the same rights and can exercise them the same way. We honour requests without checking your address first.

Outside the United States. Morrow is operated from the United States and your information is processed there. If you are in a jurisdiction with laws such as the GDPR or UK GDPR, you have rights of access, correction, deletion, restriction, objection and portability, and a right to complain to your local supervisory authority. Our lawful bases are performance of our contract with you for running the service, your consent for the self-identification answers you choose to save, and our legitimate interests in security and in fixing failures. Morrow is sold in the United States only at launch.

Morrow is not for children. You must be at least 18 years old to create an account, and we do not knowingly collect information from anyone under 18. If we learn that we have, we delete it. Eighteen is a confirmed policy decision, not a drafting default.

Our website sets a session cookie so you stay signed in as you move between pages, and the technical cookies our sign-in provider needs to keep that session secure. That is all. There are no advertising cookies, no analytics cookies, and no third-party trackers on morrowhq.app. We count visits ourselves without a cookie, as described in section 4.16. We do not respond to browser Do Not Track signals because that counting sets nothing on your device that could be turned off.

• Every table that holds anything about you is locked to your own account at the database, so one user’s request cannot read another user’s rows. The tables our servers use internally are readable by no user at all.
• Screenshots sit in a private bucket with no public reads. The only way in is a signed link that expires in 300 seconds and is issued to the owning account.
• Sensitive fields are masked on your machine before a screenshot is uploaded or shown to a model.
• Telemetry identifiers are one-way keyed hashes, and the database rejects any telemetry field that is not on the permitted list.
• Your laptop’s pairing token is stored as a hash, never in the clear. Keys the worker needs live in your operating system’s keychain.
• Our logs record a request id, account id, device id, endpoint, status, duration and error code. They never record a submitted value, a token, a signed link or a secret.
• Everything is encrypted in transit.

Encryption at rest is the platform default provided by our hosting providers, Supabase and Amazon Web Services. We do not add field-level encryption, per-user keys, or customer-managed keys on top of it.

Server logs are kept for 30 days.

No security claim in this section should be read as a promise that a breach cannot happen.

If we change this policy we will update the date at the top and post the new version on this page. If a change materially affects how we use your information, we will tell you by email or in the app at least 30 days before it takes effect.

Simkins & Elgazar LLC
10612 Center Street
Fairfax, VA 22030
United States
hello@morrowhq.app