Privacy Policy

Chirp (“Chirp”, “we”, “us”) is operated by Chirpmail LLC. Chirp helps students and early-career job seekers find people to contact, write outreach emails, send them from their own email account (Gmail, Outlook, or another inbox), follow up, and track replies. This policy explains what we collect, why, who we share it with, and the choices you have.

The short version: we only touch the parts of your email account you explicitly authorise, we never sell personal information, we do not run advertising or analytics trackers, our AI provider does not train on your data, and you can delete your account and everything in it yourself from Settings at any time.

Account information

You create your account and sign in with Google or Microsoft. We receive your name, email address, account identifier and, from Google, your profile photo. Signing in with Google gives Chirp no access to your Gmail; that is asked for only if you connect Gmail as the inbox you send from, as described below. We record when you agreed to the Terms of Service and this policy, which you do once, when you create your account. We never see or store your Google or Microsoft password.

Sign-in security

When you sign in, we check whether your account has been used from the same network (IP) address in the last 14 days. For each address you sign in or use Chirp from, we keep a keyed hash of the address (for an IPv6 address, of its network prefix) and when it was last used. We never store the address itself, and each record is deleted once 14 days pass without it being used. If the address is new to your account, we email a six-digit code to your account’s email address before signing you in. That email shows the IP address and, where our host can tell, the approximate location of the sign-in, so you can tell whether it was you. The code is stored only as a hash and expires after ten minutes.

Profile information you add

School, major, graduation year, target role, headline, a short bio, what you are recruiting for (industries, internship or full-time, target companies and cities, and things you share with people such as a club or fraternity), how you heard about Chirp if you tell us, an email signature (plain text, or a formatted one you paste or import), timezone and sending preferences, and, if you upload one, your resume (a PDF, Word, OpenDocument, RTF, or text file). Your resume is stored in our database and used only to personalise your emails and, when you tick “Attach my resume”, to attach it to the first email in a campaign.

Google account data (Gmail)

If you connect Gmail as the inbox Chirp sends from (Connect Gmail on the Settings page), you grant two Gmail permissions, and a third only if you ask for it. Signing in with Google alone grants none of them. Here is exactly what each is used for:

• Send email on your behalf (gmail.send): to send the outreach emails and follow-ups you queue, from your own address, inside your sending window and daily limit.
• Read email (gmail.readonly): to check only the threads Chirp started for replies, bounces, and opt-outs, so follow-ups stop the moment someone answers. For those threads we store the Gmail thread and message IDs, who replied and when, a short snippet of the reply, and a sentiment label (positive, neutral, negative). If you let Chirp use your replies, as described under Chirp’s cards below, we also use them for that. We do not read, index, store, or analyse any other mail in your inbox.
• Read your Gmail settings (gmail.settings.basic): granted only if you press Import from Gmail on the Settings page, and used only to copy the signature you have already written in Gmail so your emails can carry it. We read nothing else from your settings, and you are never asked for this permission unless you use that button.

OAuth tokens are stored server-side, encrypted at rest, and used for nothing else. You can revoke access at any time at myaccount.google.com/permissions, and deleting your Chirp account revokes it automatically.

Microsoft account data (Outlook, Hotmail, Live, Microsoft 365)

If you sign in with Microsoft or connect Outlook, you grant Microsoft Graph permissions that Chirp uses as follows:

• Send mail as you (Mail.Send): to send the outreach emails and follow-ups you queue, from your own address, inside your sending window and daily limit.
• Read your mail (Mail.Read): Microsoft offers no narrower permission, so we limit ourselves in code. We read only the conversations Chirp started and messages sent to you by a person you emailed through Chirp after that email, to detect replies, bounces, and opt-outs. We store the same things as for Gmail: message and conversation IDs, who replied and when, a short snippet, and a sentiment label, and use your replies the same way if you let Chirp use them. We do not read, index, store, or analyse any other mail.
• Your basic profile and offline access (User.Read, offline_access): to know which address you send from and to send scheduled emails while you are away.

You can remove Chirp at any time at account.live.com/consent/Manage (work and school accounts: myapps.microsoft.com). Deleting your Chirp account deletes the tokens.

Other inboxes connected with an app password (Yahoo, AOL, iCloud, and others)

If you connect an inbox with an app password, we store that address, its mail server names, and the app password, encrypted with AES-256 and readable only by our servers. Chirp uses it to send the emails you queue over SMTP and to search your inbox over IMAP for replies and bounces on the emails Chirp sent, in the same limited way described for Microsoft above. An app password can be revoked at any time in your email provider’s security settings; removing the inbox in Settings or deleting your account deletes it from Chirp.

Information about the people you contact (“prospects”)

When you search, Chirp queries Google’s public search index (through Serper) for LinkedIn profile pages matching the terms you choose. Search results are shown to you but not stored; we store only the people you keep by saving them, looking up their email address, or typing one in: name, headline, title, company, location, and the public profile URL. If you ask Chirp to find an email address, we first check Chirp’s email directory (below); only if it has nothing do we send the person’s name and their company’s domain to Hunter.io, or generate a pattern-based guess. We store the result with a confidence label. You may add notes and tags. If you log a meeting with someone, we also store when and how you met, the rating you give it, the notes you write, a next step and the day it is due, and any PDF of notes you upload (up to 4 MB each). Your notes, tags, meetings, and the record of whom you contacted are your own; they are never shared with other users or sent to a third party. You decide whom to search for and store, and you are responsible for using that information lawfully (see the Terms of Service). Chirp does not log in to, scrape, or otherwise access LinkedIn.

Chirp’s email directory

Chirp keeps one shared directory of work email addresses so that finding someone a Chirp user has already found does not need another paid lookup, and so that addresses known to bounce are not handed out. An entry holds a work address with the person’s name, company, and public LinkedIn profile URL, where the address came from (typed by a user, found by Hunter.io, or used to send an email), and its track record: how many emails Chirp sent to it and when, whether a later check found them delivered, and whether one bounced or was replied to. Entries are added when a user types a work address, when Hunter.io finds one, and when an email goes out through Chirp. When another user looks up the same person at the same company, Chirp offers them that address. An entry never records which account contributed it, and never includes the content of any email, reply text, notes, or meetings. Personal addresses at consumer mail providers (Gmail, Outlook.com, Yahoo, iCloud and the like) are never added; they stay only on the prospect record of the account that typed them.

Researching a person

If you ask the assistant to research someone, in words, with the Research button, or by tapping a research it suggests, Chirp asks Anthropic to search the public web for them and read what it finds; Anthropic runs these searches through its own search provider. The searches contain the person’s name and the details Chirp holds about them or that you gave (title, company, city, school, public LinkedIn profile URL, and company website), and may check whether they share a school, employer, or group with you. To point out what you have in common, Chirp also sends Anthropic your school, major, class year, headline, bio, target role, recruiting focus, and affinities, but never your name or email address, and nothing else about you goes into a search.

Research looks only for professional, public information: someone’s role, career, education, published work, talks, news, awards, and professional groups. It never looks for or reports home addresses, phone numbers, personal email addresses, family, health, religion, political views, sexual orientation or gender identity, ethnicity, immigration status, criminal or court records, finances, age, appearance, or personal social media. It skips people-search, data-broker, and public-records sites, as well as Facebook, Instagram, and TikTok, and it does not open LinkedIn pages. What it finds is shown to you in the chat with its sources and is not stored; Chirp keeps only a count of the researches you run, for your plan’s monthly allowance. Use it only to prepare genuine professional outreach to that person (see the Terms of Service).

Outreach data

Campaign templates and settings, the emails Chirp writes or you write, send status and timestamps, follow-up schedules, and reply information as described above. Open tracking is off unless you turn it on in Settings. When it is on, emails Chirp sends include a one-pixel image, and when a recipient’s mail app loads it we record when the email was first opened and how many times; our host’s request logs also see the recipient’s IP address and mail app, as with any web request. When it is off, recipients are not tracked at all.

Chirp’s cards

Chirp shows you cards in the corner of your dashboard: who replied, and later whether a call got set up and how a meeting went. For each one we keep which person or meeting it is about, whether you have seen and answered it, and when to ask again. A card’s wording comes from the reply information described above and is not stored a second time. If you type notes when Chirp asks how a meeting went, they are saved word for word on that meeting, and Claude reads them to suggest a next step and a note about the person. Nothing it suggests is saved to that person until you add it, and a suggestion you do not add is erased. Your ratings and notes are private to your account: they are never pooled, shown to a group, or used for anyone else.

If you let Chirp use your replies, Claude also reads each reply on a conversation Chirp started, to suggest a next step, a note about the person, and any time or place they offered, and Chirp can answer your questions about your replies in the assistant, from their saved summaries, and about your own outreach numbers. This is on for accounts created after this was described here, is off for older accounts until they turn it on, and can be changed in Settings. A suggestion is kept only until you add or dismiss it, or for 14 days, and is then erased; one you add becomes your own note. Turning this off erases the suggestions waiting on your replies. It is for you only, and nothing here is used for anyone else.

Community content

Posts, replies, reactions, bookmarks, your handle, and your community profile (name, photo, school, graduation year, target role, headline, and the intro you write) are visible to other signed-in Chirp users. Other members can mention your handle. Do not post other people’s private correspondence or personal details.

A post can also carry things you choose to attach, and everyone who can read the post sees them: on the community board that is every signed-in Chirp user, and in a group’s discussion only its members. You can attach screenshots (we remove the location and camera details stored inside a photo before saving it), a resume as a PDF, one of your saved email templates as you wrote it, with merge fields intact and, only if you tick the box, how many people you sent it to and how many replied, a snapshot of your own Insights numbers (only your own counts and rates, never anyone else’s or the network’s, frozen on the day you post), and an email signature. Templates and Insights numbers come from your outreach, including replies Chirp found in your inbox, and are shared only when you attach them. Other members can save a template you shared to their own list, or start their signature from yours. Screenshots and resumes are stored privately with Vercel and opened only through Chirp, which checks each time that the reader may see the post. Take your phone number and address off a resume, and blur names in screenshots of replies, before you share them. Editing a post to remove an attachment, deleting the post, or deleting your account deletes the files too.

Groups

If you create or join a group, its other members see that you are in it, your community profile, the group’s discussions, and any campaign you choose to share with it (its name, goal, subject line, email and follow-up text, and how many people it has contacted, replied, and booked meetings). While you share your numbers with a group, which is on when you join and can be switched off at any time from the group’s Members tab, its members also see your outreach totals: emails sent, people contacted, replies, positive replies, meetings, and bounces, the same totals by week, round, weekday, and email style, and how many people you contacted at each company, pooled with the other sharing members. If you also share your campaign emails with a group, a separate switch that is off until you turn it on, its members see each of your campaigns’ subject line and email as you wrote them, merge fields such as {{firstName}} intact and never as sent to anyone, with how many people each reached and how many replied, on the group’s Insights tab, and group reports may quote them. Groups never show the names or addresses of anyone you emailed, or what they wrote back. An open group’s name, focus, description, target companies, size, and managers are visible to every signed-in member; a private group is visible only to its members and the people it invites. Join requests and invites, with any note, are seen by the group’s managers and the person concerned.

Insights

Chirp describes each first email you send by its shape: how long it is, whether it has bullets, how it opens, asks and closes, whether it names the recipient’s company, its subject line’s length and form, the day and hour it went out, the email style, and the seniority read from the recipient’s title. These descriptions are stored with your account and set against whether the email was delivered and got a reply, a positive reply, or a meeting. You see them on the Insights tab.

Unless you turn it off in Settings, those descriptions and outcomes also count toward network figures every signed-in user sees, such as the share of emails under 90 words that got a positive reply. Only totals are pooled: never the text of an email or a reply, an address, a name, or which account contributed. A figure is shown only when at least five accounts stand behind it beyond you and the members of your groups whose numbers you can already see, and on your own Insights page your emails are taken out of the figures you are shown.

If you ask for an Insights report, Chirp sends Anthropic your outreach numbers, the network figures, your school, major, class year and recruiting focus, your largest campaigns’ templates, and up to sixteen of your first emails with the recipient’s title and company (not their name) and, for those that were answered, the first lines of the reply. A new report also reads what your last report said and your numbers since it. We keep the report Claude writes and the totals it was written from, not the emails or replies.

You can also let Chirp tailor its suggestions to your own results. It is on for accounts made after this was added, and asked for on the Insights tab for accounts made before; you can change it in Settings. When it is on, Chirp uses which of your emails got replies to work out which suggestion is most worth your attention, and shows you your own counts beside it on the Insights tab and while you write. This is worked out for you alone, and your results are never used to advise anyone else. Turned off, you see the same suggestions in their usual order.

With each email, Chirp keeps how it was written (from a template, changed by hand, or by AI, and which version of our instructions), and it keeps which suggestions were on screen when you saved or released an email: which ones, never the email’s text. These are deleted with your account.

A member of a group can ask for a group report. Chirp then sends Anthropic the group’s pooled numbers, the network figures, the group’s name, focus and target companies, reply rates by company, and the campaigns members share with the group: each one’s subject and email as written, its author’s name, and its own numbers. That includes campaigns shared by hand, whether or not their author shares their overall numbers. Every member of the group can read the report, which may quote those campaigns, name their authors, and give each campaign’s numbers. It contains no member’s overall numbers, no one anyone emailed, and no reply. If a member whose campaigns a report quoted stops sharing them, leaves the group, or deletes their account, that report is deleted.

Payment information

Paid plans are billed by Stripe. Card details go directly to Stripe and never reach our servers. We store your Stripe customer, subscription, and price identifiers, your plan, and its renewal or end date. For a one-time purchase we also store what was bought, its start and end dates, and Stripe’s references to the payment.

Technical information

Our hosting provider records standard request logs (IP address, browser, pages requested, timestamps) for security and debugging. The cookies we use are listed under Cookies. When you scan a Chirp QR code, we count which code was scanned and when, and store nothing about who scanned it.

• To provide the service: find people, find emails, write and send outreach, schedule follow-ups, detect replies, and show you results.
• To personalise: your profile, resume, and campaign settings are used to draft emails that sound like you, and the assistant uses them to answer your questions.
• To research a person when you ask: search the public web for their professional background and show you what you have in common.
• To run the community: display your posts and profile to other members and notify you about replies and mentions.
• To run groups: show your group’s members the discussions, shared campaigns, and, while you share them, your outreach totals, and notify you about invites, requests, and new discussions.
• To keep your Network up to date: tell you when someone replies, ask how your meetings went, save what you answer, suggest what to add from your notes and, if you allow it, from your replies, and look things up for you in the assistant.
• To run Insights: show you what in your outreach gets replies, tailor your own suggestions if you allow it, show every user anonymous network totals (unless you switch your contribution off), show a group what its shared numbers and campaign emails say, and write the reports you or your group ask for.
• To bill you and manage your plan.
• To run Chirp: the people who run Chirp can see each account’s name, email, school, plan, sign-up date, when it was last seen, what kind of inbox it connected, and counts of its searches, saved people, campaigns and emails sent. They see how replies went only as totals pooled across accounts, and never who anyone emailed or what any email said.
• To keep the service safe: enforce sending limits, honour opt-outs and bounces through a suppression list, confirm it is you when you sign in from somewhere new, and prevent abuse.
• To communicate with you about your account, the service, and changes to these terms. We do not send marketing email without consent.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with you (running the service), your consent (connecting your inbox, which you can withdraw at any time), and our legitimate interests in securing and improving Chirp.

Chirp sets only the cookies below. Each is needed for something you asked for (signing in, or keeping night mode on), so none needs consent and there is no cookie banner. We use no advertising cookies, analytics, or cross-site tracking, and no other site’s scripts run on Chirp. On the live site the sign-in cookie names start with __Secure- or __Host-.

Stripe sets its own cookies on its checkout and billing pages, which are on Stripe’s site and covered by Stripe’s privacy policy. You can delete cookies in your browser at any time; deleting the session cookie signs you out.

Chirp uses Anthropic’s Claude models to draft personalised emails, classify the sentiment of replies and, if you allow it, suggest next steps and notes from them, read your resume to fill in your profile, power the assistant, suggest a next step and notes from what you type about a meeting, research a person you ask it to, and write the Insights reports you or your group ask for. To do that we send the relevant text to Anthropic’s API: your profile and resume text, details of the prospect being emailed, your campaign content, the text of a reply being classified, your assistant conversation (including what the assistant looks up for you: the details and notes on a person you ask about and, if you let Chirp use your replies, their summaries and your outreach numbers), the notes you type when Chirp asks how a meeting went, for a research what is described under Researching a person above, and for a report, what is described under Insights above. Anthropic processes this as our service provider under commercial terms that prohibit it from using your data to train its models. Scheduled emails are drafted in batches, and Anthropic keeps a batch’s drafts available to Chirp for up to 29 days before deleting them. AI output can be wrong; you review every email before a campaign goes live and are responsible for what you send.

Chirp’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Gmail data is used only to provide the user-facing features described above: sending the emails you queue, detecting replies on those threads, showing you on the Insights tab which of your emails got replies (and, unless you switch it off, counting that in the anonymous network totals described under Insights, and in the totals of a group while you share your numbers with it), tailoring your own suggestions if you allow it, suggesting next steps and notes from your replies and answering your questions about them in the assistant if you allow it, writing the Insights reports you or your group ask for, and, if you press Import from Gmail, copying your Gmail signature.
• We do not use Gmail data for advertising, and we do not sell it.
• We do not transfer Gmail data to anyone else except our service providers as needed to provide those features (Anthropic, for classifying a reply’s sentiment, for suggesting next steps and notes from replies and answering your questions about them if you allow it, and for writing the Insights reports you ask for; our hosting providers), as required by law, or with your explicit consent.
• No human at Chirp reads your Gmail data unless you ask us to for support, it is necessary for security or to comply with the law, or it has been aggregated and anonymised.
• We do not use or retain Gmail data, or anything else we receive through Google Workspace APIs, to develop, improve, or train generalised or non-personalised AI or machine-learning models, and we do not transfer it to anyone for that purpose. Anthropic receives a reply’s text only to classify it for you, to suggest next steps and notes if you allow it, or to write a report you asked for, under terms that prohibit it from training its models on that text.

We hold mail from Microsoft and app-password inboxes to the same five rules.

We never sell personal information and never share it for cross-context behavioural advertising. We share it only with:

• The people you email receive the email you send, your name and address, and, if you choose, your resume.
• Other Chirp members see your community posts and profile. Members of a group you are in also see what is described under Groups above.
• Other Chirp users looking up the same person may be offered a work address from Chirp’s email directory, as described above. Nothing offered says who added it.
• Authorities when required by law, subpoena, or to protect the rights, property, or safety of Chirp, our users, or others.
• A successor if Chirp is acquired or merged, in which case this policy continues to apply and we will notify you.

Chirp is a tool; the person who emailed you chose to contact you and is responsible for that message. It was sent from their own email account. Reply to them, or ask them to stop, and Chirp automatically stops all further follow-ups from that sender to you and adds your address to their suppression list. If the sender turned on open tracking, the email also told Chirp when it was opened (see Outreach data above).

To find out what Chirp users stored about you, or to have it deleted, email contact@chirpmail.io from the address that received the email, or tell us that address. We will delete everything stored with that address (your details, the emails, and any meeting notes) from every Chirp account that holds it and from Chirp’s email directory, and keep only the address itself on those senders’ suppression lists so they cannot email you through Chirp again.

We keep your data for as long as your account exists so the service keeps working.

• Delete your account from Settings. This immediately and permanently deletes your profile, resume, prospects, meeting notes and uploaded files, campaigns, sent-message records, reply data, suppression list, community posts and replies and what you attached to them, group memberships, group discussions you wrote and campaigns you shared, notifications, Chirp’s cards, Insights descriptions and reports, sign-in records, and sessions, cancels any subscription, and revokes Chirp’s access to your Google account.
• Can’t sign in, or never had an account? Email contact@chirpmail.io with the subject “Data deletion request” and the email address concerned. We confirm the request comes from that address before acting on it and reply once it is done.
• Entries in Chirp’s email directory are not linked to any account, so deleting yours leaves the work addresses it contributed in the directory. The people those addresses belong to can have them removed as described above. Insights network totals are recomputed within a day, after which nothing of yours is in them.
• Sign-in records are deleted sooner: the hash of an address after 14 days without use, and a sign-in code after ten minutes.
• Backups and server logs that may contain your data are overwritten within 30 days.
• Stripe retains invoices and transaction records for as long as tax and accounting law requires.
• Emails already delivered to recipients stay in their inboxes, as with any email.

All traffic is encrypted in transit with TLS and our database is encrypted at rest. Google access tokens are stored only on the server and are never sent to your browser. We request the narrowest Google permissions the product needs, and Gmail permissions only if you connect Gmail. We store no passwords, ask for an emailed code when your account signs in from somewhere new, and enforce a strict Content-Security-Policy, cross-site request protection, and per-plan sending limits. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.

Depending on where you live (including the EU, UK, and California) you may have the right to:

• access the personal information we hold about you and receive a copy in a portable format;
• correct inaccurate information (most of it is editable in Settings);
• delete your information (use the delete button in Settings, or email contact@chirpmail.io);
• object to or restrict certain processing, and withdraw consent for Google access at any time;
• not be discriminated against for exercising these rights.

We do not sell or “share” personal information as those terms are defined under California law. To exercise any right, email contact@chirpmail.io. We will verify the request through your signed-in account and respond within the time the law requires. If you are in the EU or UK you may also complain to your local data protection authority.

Chirp is hosted in the United States and our providers may process data there and elsewhere. If you use Chirp from outside the US, your information is transferred to the US. Where required we rely on standard contractual clauses or equivalent safeguards offered by our providers.

Chirp is for people who are at least 18 years old. We do not knowingly collect information from anyone younger. If you believe a minor has created an account, contact us and we will delete it.

We may update this policy as Chirp changes. We will post the new version here with a new effective date and, for material changes, tell you by email or in the app before they take effect. Continued use after that date means you accept the updated policy.

Questions, requests, or complaints: contact@chirpmail.io. By post: Chirpmail LLC, Greek Leadership Village 975 S Rural Road, Building #6, Tempe, AZ 85281. Chirpmail LLC is the controller of the personal information described in this policy.