Morrow Privacy Policy

Morrow is a job-application tool operated by Simkins & Elgazar LLC, a Virginia limited liability company. In this policy, “we,” “us,” and “our” mean that company. “You” means the person who holds a Morrow account.

You can reach us about anything in this policy, including a privacy request, at hello@morrowhq.app.

Our mailing address is 10612 Center Street, Fairfax, VA 22030, United States.

Morrow works by running a worker app on your own computer. That design is the reason this policy reads the way it does.

• Your resume file and your browser session never leave your computer. We store the resume’s filename, format, version and a checksum, and nothing else about it.
• Your saved answers are held in our cloud. They have to be, because that is how Morrow fills a form on a laptop it has never seen before. Earlier versions of our privacy page said otherwise. That was wrong, and this policy corrects it.
• We do not sell your personal information, we do not share it for cross-context behavioural advertising, we do not train any model on it, and we run no advertising or third-party analytics in any Morrow app or on our website.
• Morrow only applies to jobs you picked. It never invents an answer to a question you have not answered.

These things live on the computer running the Morrow worker app, and we never receive them:

• Your resume file. The bytes never reach us and no resume URL is ever sent to our servers. We hold metadata only: filename, format, version, and a SHA-256 checksum. A filename usually contains your name, so treat the filename as personal information; the document’s contents are not ours.
• Your browser session. The worker fills forms in a browser on your machine. Your cookies, logins and browsing history stay there.
• Employer-portal credentials. Morrow does not ask for, receive or store passwords to Greenhouse, Ashby, Lever or any employer’s own account system. Nothing in the product sends a portal credential to us.
• Local diagnostic files. The worker keeps its own screenshots and failure logs on your machine, and cleans them up itself. Each application’s screenshot is deleted as soon as that application reaches an end state, whatever the outcome. Anything a crash left behind is swept at the next start-up once it is more than 24 hours old. The engine’s failure log, which can contain a field label and a value, is cleared after 7 days.

This section is the honest inventory. It is written from the database schema, not from intent.

4.1 Account and sign-in

Your email address, your password in hashed form, your display name, your time zone and quiet-hours settings, and your app preferences. Kept until you delete your account.

4.2 Your answer bank

Every question a job application has asked you and the answer you gave, saved so you never have to type it twice. This includes the identity fields Morrow needs for almost every form: your name, email address and phone number.

It also includes the voluntary self-identification answers you chose to save — gender, race or ethnicity, veteran status and disability status, and, where a form asks, citizenship, sponsorship need and security clearance. Under California and most other state privacy laws, racial or ethnic origin and disability status are sensitive personal information. We hold them because you asked Morrow to reuse them; you can edit or remove any answer in the app at any time.

Your answer bank is readable only by your own account, enforced at the database. It has no expiry date and is kept until you delete your account.

4.3 Applications under review

For every application waiting for your approval, we hold the field-by-field card you see on your phone: each field’s label as the employer wrote it, and the exact value about to be submitted. These rows are removed when the application they belong to is removed.

4.4 Submissions and receipts

For every application Morrow submits, we keep a permanent ledger line: the company, the job title, the job URL, the applicant-tracking system, the timestamp, the outcome and the employer’s own confirmation text. This is the record behind the Nothing-False Guarantee, and it is kept for as long as your account exists.

Alongside it we keep the frozen field list of what was actually submitted. Fields in the sensitive group described in section 4.2 are flagged and deleted after 90 days; the rest of the field list and the ledger line survive.

We also store the results of Morrow’s nine honesty checks. Those results carry field keys, labels and outcome codes only. The answer values themselves are stripped out before the record reaches our database.

4.5 Application screenshots

Morrow takes a full-page screenshot of each application, which is what a guarantee claim is judged against.

Sensitive fields are masked on your own computer before the image is uploaded. A solid box is painted over each self-identification field, the masked image is the one the checksum covers, and the masked image is the only version ever sent anywhere, including to the vision model that verifies the submission. In your review screen you will see the box and the caption “Sensitive answers hidden in this preview; values are shown in the field list.”

Screenshots live in a private storage bucket with no public reads. Access is a signed link that expires after 300 seconds and only works for the account that owns the image. Screenshots are deleted after 90 days. A screenshot attached to an application that was closed, expired, skipped or parked without ever being submitted is deleted after 30 days.

4.6 Questions Morrow could not answer

When a form asks something Morrow cannot answer honestly from what you have told it, it stops and saves the question so it can ask you. That saved question is the employer’s wording, which occasionally is itself a self-identification question. Kept until you delete your account.

4.7 Devices

The name, platform and version of the laptop you paired, plus a one-way hash of its pairing token; your phone’s push notification address; and the six-digit pairing code, which is deleted 24 hours after it expires. When a device attempts to pair, we record the IP address it came from to rate-limit abuse. Those IP records are deleted after 24 hours.

4.8 Billing

Your subscription tier, status and period, mirrored from our subscription service, and a Stripe customer identifier that links your account to your billing record. We also keep the credit ledger behind tailoring credits. We never receive or store your full card number.

4.9 Usage and telemetry

Counts of how many applications you ran per day and per billing period, and the metering counts behind Morrow’s model calls (number of calls, tokens and cost — never the text sent or received).

Separately we collect product telemetry to find and fix failures. Telemetry is pseudonymous, not anonymous: each event carries a keyed one-way hash of your account id computed with a secret only our server holds. It carries nothing else that identifies you. The only values a telemetry event is allowed to contain are the applicant-tracking system’s name, an outcome, a duration, a time-to-approve bucket, an error code, a count, your plan tier, your platform and the app version. Field labels, field values, question text, names, emails, phone numbers, resume text, job URLs and screenshots are forbidden and rejected by the database itself.

Telemetry is deleted after 180 days. It is the one category that is not deleted when you delete your account; see section 8.

4.10 Email and support

We queue transactional email for sending: your receipt notices and your daily recap. Those messages carry company names, counts and links to your own receipts, never your answers, question text, resume text or job URLs. Queued messages are deleted 30 days after they are sent.

When you write to us at hello@morrowhq.app, your message is delivered into our Google Workspace mailbox at aelgazar@simkinselgazar.com by a routing rule, and it is kept there so we can answer you and keep a history of the conversation. Our reply comes back from hello@morrowhq.app. We keep support mail for 12 months.

4.11 Waitlist

If you gave us your email address on our website before launch, we hold that address and where it came from. We delete it when you unsubscribe, when you create an account with the same address (it is merged into the account), or 12 months after launch day, whichever comes first. Every email we send to a waitlist address carries an unsubscribe link.

4.12 Replay records

To make sure a network retry never submits your application twice, we store the response to certain worker calls for 7 days. For one of those calls the stored response contains a copy of your answer bank and your name, email and phone number. It is readable only by our own servers, never by any user, and it is deleted with the rest after seven days.

We use what we hold for these purposes and no others: to run your account and sign you in; to fill and submit the applications you picked; to remember your answers so you are asked once; to show you an application before it is sent and record what was sent; to honour the Nothing-False Guarantee and the Receipt Guarantee; to bill you and manage your subscription; to send you receipts, recaps and service notices; to answer your support messages; to keep the service secure and to rate-limit abuse; and to find and fix failures using pseudonymous telemetry.

Repeat-trial detection. We use your name, email address, phone number and payment method to detect a second free trial on the same person. That is a use of your personal information and we disclose it here rather than bury it in the Terms.

We use the service providers below. Each acts on our instructions only, and none of them is permitted to use your information for their own purposes. This is not selling and it is not sharing for advertising.

What reaches a model provider is the application content needed to fill or check that one form, and the masked screenshot — the sensitive fields are already painted over before the image leaves your computer. We keep no copy of a model’s prompt or completion; we record only the call count, token counts and cost.

We may also disclose information if the law requires it, to enforce our Terms, or to a buyer as part of a merger or sale of the business, in which case this policy travels with it.

• We do not sell your personal information, and we have not sold it in the past 12 months.
• We do not share it for cross-context behavioural advertising, and we have not in the past 12 months.
• We do not use your data to train any model, and no provider we use is permitted to.
• We run no advertising, no advertising identifier and no third-party analytics in any Morrow app or on our website.
• We do not apply to a job you did not pick.
• We do not store your full card number.
• We do not read your resume file or your browsing activity.

Deletion. You can delete your account from inside the app, or from the Delete my account page at /account/delete, signed in or signed out. Deletion removes your stored screenshots, releases any Founding Hundred seat, clears your rate-limit state, deletes your sign-in record, and cascades to every row tied to your account: your picks, holds, answers, receipts and receipt field lists, parked questions, worker devices, push tokens, usage and credit history, and entitlements.

One category survives on purpose: telemetry events. Those rows carry a one-way keyed hash of your account id, not your account id, and no information that identifies you. They expire by themselves after 180 days. They are pseudonymous before your deletion and stay that way after it.

Access and a copy of your data. Write to hello@morrowhq.app and we will send you a copy of what we hold about you. Email hello@morrowhq.app and we will send you a machine-readable export within 30 days. There is no self-service export button yet; a later version will add one.

Correction. You can edit any answer in your answer bank in the app, and your profile details in your account settings.

California residents (CCPA/CPRA). You have the right to know what we collect, the right to delete it, the right to correct it, the right to a portable copy, the right to limit our use of sensitive personal information, and the right not to be discriminated against for exercising any of these. The categories we collect, and why, are in sections 4 and 5. We use sensitive personal information only to fill the applications you picked and to keep the record of what was sent, which is a permitted purpose that does not require a “Limit the Use of My Sensitive Personal Information” link; you can still remove those answers yourself at any time. We do not sell or share your personal information. Make a request at hello@morrowhq.app; we will verify it against your account email before we act on it, and you may use an authorised agent. [UNKNOWN: whether Morrow meets a CCPA applicability threshold at launch, which depends on user numbers. The risk assessment’s position is that CalOPPA and the app stores require this policy regardless, so it should not wait on the CCPA answer.]

Virginia residents (VCDPA). You have the right to confirm whether we process your personal data and to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, or profiling with legal effects — none of which we do. Virginia’s law requires opt-in consent for sensitive data, and the self-identification answers in section 4.2 are saved only if you choose to save them. If we refuse a request you may appeal by replying to our decision at hello@morrowhq.app, and if the appeal is denied you may contact the Virginia Attorney General. [UNKNOWN: whether Morrow meets the VCDPA applicability threshold at launch. The risk assessment expects not, while noting Virginia is our home state and its Attorney General is the likeliest first regulator.]

Other states. If you live in a state with a comprehensive privacy law, you have broadly the same rights and can exercise them the same way. We honour requests without checking your address first.

Outside the United States. Morrow is operated from the United States and your information is processed there. If you are in a jurisdiction with laws such as the GDPR or UK GDPR, you have rights of access, correction, deletion, restriction, objection and portability, and a right to complain to your local supervisory authority. Our lawful bases are performance of our contract with you for running the service, your consent for the self-identification answers you choose to save, and our legitimate interests in security and in fixing failures. Morrow is sold in the United States only at launch. [UNKNOWN: counsel to confirm whether these generic rights are the right treatment for a US-only launch, or whether a transfer mechanism, an EU or UK representative, or an explicit geographic restriction is preferable.]

Morrow is not for children. You must be at least 18 years old to create an account, and we do not knowingly collect information from anyone under 18. If we learn that we have, we delete it. Eighteen is a confirmed policy decision, not a drafting default.

Our website sets a session cookie so you stay signed in as you move between pages, and the technical cookies our sign-in provider needs to keep that session secure. That is all. There are no advertising cookies, no analytics cookies, and no third-party trackers on morrowhq.app. We do not respond to browser Do Not Track signals because there is no tracking to turn off.

• Every table that holds anything about you is locked to your own account at the database, so one user’s request cannot read another user’s rows. The tables our servers use internally are readable by no user at all.
• Screenshots sit in a private bucket with no public reads. The only way in is a signed link that expires in 300 seconds and is issued to the owning account.
• Sensitive fields are masked on your machine before a screenshot is uploaded or shown to a model.
• Telemetry identifiers are one-way keyed hashes, and the database rejects any telemetry field that is not on the permitted list.
• Your laptop’s pairing token is stored as a hash, never in the clear. Keys the worker needs live in your operating system’s keychain.
• Our logs record a request id, account id, device id, endpoint, status, duration and error code. They never record a submitted value, a token, a signed link or a secret.
• Everything is encrypted in transit.

Encryption at rest is the platform default provided by our hosting providers, Supabase and Amazon Web Services. We do not add field-level encryption, per-user keys, or customer-managed keys on top of it.

Server logs are kept for 30 days.

No security claim in this section should be read as a promise that a breach cannot happen.

If we change this policy we will update the date at the top and post the new version on this page. If a change materially affects how we use your information, we will tell you by email or in the app before it takes effect. [UNKNOWN: the notice period counsel wants. The Terms draft uses 30 days for pricing changes, which would be a consistent choice.]

Simkins & Elgazar LLC
10612 Center Street
Fairfax, VA 22030
United States
hello@morrowhq.app

The decision is to publish this policy as v1 and redline it with counsel afterwards. Every business question that was open on the first draft has been answered and written into the text above. Four counsel markers remain, all of them legal, plus one [EFFECTIVE DATE] flag that is filled in at publication rather than decided.

The four remaining markers

• CCPA/CPRA applicability (section 8). The risk assessment’s position is that CalOPPA and the app stores require this policy regardless of any threshold, so publication does not wait on the answer. Counsel should still confirm the sensitive-information disclosures, whether the permitted-purpose reading in section 8 holds, and whether a “Limit the Use of My Sensitive Personal Information” link is prudent anyway.
• VCDPA applicability and the appeal mechanism (section 8), including whether the opt-in consent framing for the self-identification answers is adequate as drafted. Virginia is the home state, so its Attorney General is the likeliest first regulator.
• The non-US paragraph (section 8). Sales are US-only at launch. Counsel decides whether the generic GDPR-style rights are the right treatment, or whether a transfer mechanism, an EU or UK representative, or an explicit geographic restriction is better.
• Notice period for material changes (section 12). The Terms use 30 days for pricing changes, which would be a consistent choice.

Counsel should also rule on three things this draft asserts that a court might read narrowly: whether describing our providers as service providers is correct for every row of the table in section 6, the model providers included, and whether a data processing agreement is in place with each of them, which the risk assessment lists as open scope; whether “we do not sell or share” is safe to state flatly given the no-retention routing to third-party model hosts; and whether the Nothing-False Guarantee’s dependence on a screenshot we delete at 90 days needs a matching sentence in the Terms, since the durable evidence after 90 days is the field list, not the image.

Answered by Ahmed and the PM, 2026-09-10 — now stated as fact above