Privacy Policy

Dreamwork is a product of Ponder Labs, Inc. ("Ponder Labs," "Dreamwork," "we," or "us"). This policy applies to everything under dreamworkhq.com, the Dreamwork API at api.dreamworkhq.com, the @dreamworkhq/mcp npm package, the hosted Dreamwork MCP server at mcp.dreamworkhq.com, Dreamwork connectors and apps inside third-party AI assistants (such as ChatGPT, Claude, Meta AI and Muse, and Grok), and the Dreamwork Jobs Chrome extension.

The data we collect includes:

Account data. Your email, optional name, LinkedIn URL, phone number, mailing address and current location if you provide them. We also generate a private Dreamwork-managed relay address so employers can reach you without seeing your personal inbox.

Career data. Your uploaded resume (PDF or DOCX), its parsed text, an AI-generated analysis of your experience, and embeddings we compute to power matching. Your edits, added jobs, and application pipeline status.

Reusable application answers. Answers you choose to save so Dreamwork can prepare applications consistently, including country-specific work authorization and sponsorship, authorization type and expiration, citizenship, availability, compensation, work preferences, and qualifications. This can also include application screening answers such as transportation, workplace accommodation, security clearance, and foreign-government family ties. We use screening answers only to prepare or complete applications you request, and do not use these answers for job matching or ranking.

Voluntary self-identification. Optional answers to employer questions on applications Dreamwork identifies as US-based, including gender, Hispanic or Latino identity, race and ethnicity, disability, and veteran status. These answers are stored separately from your general profile. You can skip, decline, edit, or delete them, and we do not use these answers for matching, job ranking, fit scoring, advertising measurement, or recruiter matching. If an application form requires a response to a voluntary demographic question, Dreamwork may leave it blank or choose the form's own Prefer not to answer option when available instead of guessing.

Product usage. Which pages you visit, which jobs you view and add, which packs you generate, and anonymized extension telemetry (per-field fill outcomes — never the values).

Plan data. We store your current access tier and any legacy/imported entitlement identifiers needed to preserve account state. Stripe processes paid checkout and billing portal changes; Dreamwork stores Stripe customer/subscription identifiers, not raw card details.

Advertising measurement data. Limited campaign and ad-interaction identifiers, protected account identifiers where appropriate, device and network context, and subscription-event details such as value and currency. We use this narrow set to understand campaign effectiveness, not to build profiles from your browsing across unrelated sites.

We collect the minimum needed to run and responsibly measure the Service.

• Match your resume to relevant job listings.
• Generate tailored resumes, cover letters, answers, and interview prep.
• Autofill and, on request, submit applications.
• Reuse answers you saved to complete corresponding questions on applications you ask Dreamwork to prepare or submit.
• Use voluntary self-identification answers only to answer corresponding voluntary questions on applications you ask Dreamwork to prepare or submit.
• Route inbound recruiter emails from your relay address to your real inbox.
• Match your anonymized professional profile to roles that recruiters, hiring managers, and prospective employers are hiring for, and introduce you to them.
• Improve our autofill playbooks and matching models using anonymized, aggregated signals.
• Detect abuse, fraud, and protect the Service.
• Measure whether our advertising campaigns lead to subscriptions.
• Send you product updates and the occasional pack-ready email (you can unsubscribe).

We do not use your personal resume content to train public or third-party AI models.

The extension is a narrow tool with narrow access:

• It activates only on supported ATS domains (Greenhouse, Ashby, Lever, Workday, iCIMS, SmartRecruiters). On every other site it does nothing.
• It reads application form labels and field types so it can map them to your pack — not the rest of the page.
• It stores your Dreamwork API key in chrome.storage.local on your device. We never receive or sync it.
• When you invoke autofill, the extension sends the ATS name, the company slug, the field labels it attempted to fill, and whether each fill succeeded. It does not send the values entered into fields.
• The extension can optionally inject a content overlay to let you edit the generated resume before submitting. That overlay runs entirely on your device.

Uninstalling the extension removes all of its local storage. No residue.

You can connect Dreamwork to an AI assistant you choose, through our Model Context Protocol (MCP) server, a connector or app listing, or an API key. When you do:

• You authorize the connection yourself, by signing in to Dreamwork and approving it (OAuth) or by creating an API key. You choose what it may do: read your account, make changes, submit applications, or reply to recruiters as you. You can revoke it at any time under Profile, then MCP, and in the assistant's own settings.
• The assistant receives only what its requests return: for example job listings and matches, your preferences, application status, and, when it asks for them, your application materials and recruiter messages. It acts through the same API, checks and plan limits as the Dreamwork website.
• An assistant can submit applications or reply to recruiters only if you granted that permission, and both start switched off. Through a connector or the current MCP package, it also cannot do either, or change your plan, in one step. Dreamwork first answers with a summary of what would happen, for the assistant to show you, and acts only when the assistant returns a confirmation for that exact request. Payment details are entered only on the checkout page, never through the assistant.
• We log the requests connected assistants make on your account (which action ran, when, and its result) to operate, secure, and support the service. We do not receive your conversations with the assistant beyond the requests sent to us.
• Data you share with an assistant is also governed by that assistant provider's own terms and privacy policy (for example OpenAI, Anthropic, Meta, or xAI). We do not control how they store or use it, and we do not sell your data to them.

We provide a private Dreamwork-managed relay address so employers email you there instead of your personal address. We receive those messages via Cloudflare Email Routing, store them so your pipeline stays in sync, and forward a copy to your personal inbox.

You can disable the relay anytime. Stored messages are deleted on account deletion.

We share data with vendors needed to run, protect, bill for, and measure the Service and, as described in section 06b, with recruiters and hiring managers:

• Google (Gemini), Anthropic (Claude), and OpenAI: to compute embeddings, generate pack content, and operate application and autofill agents. For requested applications, inputs may include the application answers needed for a submission you requested. When supported self-identification is enabled for an in-scope US application, these providers may process those answers as application-agent context. These providers process API inputs under their commercial terms and do not use API content to train public models by default. Retention depends on provider and account controls.
• Resend — for outbound email delivery.
• Cloudflare — for DNS and inbound email routing.
• Railway: for hosting.
• Neon: for database storage.
• Application-fulfillment service providers — when you request Auto Apply, we may share the application information needed to prepare, fill, or submit that application, including saved reusable answers and the supported self-identification answers you chose to save. The selected fulfillment path may receive those supported answers for an in-scope US application before it encounters an individual form question. We share this information solely to complete your application request.
• Advertising and measurement providers — limited attribution, protected identifier, device/network, and transaction context used to measure campaign effectiveness. We do not send resume content, application materials, or other sensitive job-search content for this purpose.

We do not make your data public or share it with employers or recruiters beyond what you explicitly submit in an application, the anonymized profile summary described in section 06b, or an introduction to a recruiter or hiring manager. Introductions may be commercial as described in section 06b.

When you ask Dreamwork to prepare or submit an application, the employer, its applicant tracking system, and the application-fulfillment providers involved may receive the answers needed for that application. After submission, the employer’s notice and privacy practices apply to its copy of those answers.

Accounts on employer application sites. Some employer application sites, such as Workday and iCIMS, require a candidate account before you can apply. When one does, the account is created for that application by Dreamwork's application agent, by an application-fulfillment provider acting for us, or by a member of our team finishing the application by hand. Our agent and our team use the email address the application is sent with: your Dreamwork application address, or your own email if you connected it and chose to apply from it. For an account our agent or team creates, we do not save the password in our database; we generate it when it is needed from a secret key that Dreamwork keeps private. A fulfillment provider creates the account under an address on its own email domain, keeps the password, reads the verification emails sent to that address, and forwards the employer's emails on to the application address. We retrieve that login from the provider when you open it in Dreamwork or when our team opens that application to finish or check it.

Once we confirm the account, you can see its login on that application: open the application from your Dashboard and choose Portal login, or choose Portal login in its Messages thread. The password stays hidden until you choose Show password. So that you can sign in to the employer's site later, for example to reach an interview, the email we send to confirm an application you sent with Apply includes the login and password when our agent created and confirmed an account for it. If the employer's own confirmation email arrives first, we forward that to you instead, and the login stays in Dreamwork. For applications Autopilot sends, the login stays in Dreamwork and is not emailed.

We use a login only to complete and follow up on that application and to show it to you. Our agent uses it to fill in the employer's form, and the AI providers listed above process it as part of that work. Authorized members of our team can see it, and may read the emails sent for that application, including verification emails, when they open the application to finish or check it.

While our agent is working on an application, it reads the verification emails sent to your Dreamwork address so it can finish signing up and submitting. If you sign in to the employer's site yourself later and it emails a verification code or password reset link, we forward it to your personal email as long as it comes from that employer or its application system. While we are working on that application, or shortly after, we may hold a code instead; if one doesn't arrive, request a new one a little later. If the application was sent from an email account you connected, these emails arrive in that inbox directly. Verification codes are not shown in Messages.

Accounts on employer sites belong to those sites. Deleting your Dreamwork account does not delete them; afterwards you can no longer see their logins in Dreamwork, and mail to your Dreamwork application address no longer reaches you. Save any login you want to keep before you delete your account, and ask the employer if you want an account removed.

When you have an account, we may match your professional profile against roles that recruiters, hiring managers, and companies are hiring for. We judge fit using professional information such as skills, work history, role interests, location preferences, and how complete your profile is.

Recruiters and hiring managers may see an anonymized summary of a matching profile: a fit score, a short reason, skills, and work history described without employer names. It does not include your name, email address, phone number, links, school names, or employer names.

We may introduce you to a recruiter or hiring manager for a relevant role. When we do, we may share your name, direct contact details, professional summary, skills, work history, education, location or work preferences, portfolio or LinkedIn URL, resume, and other career-profile information you provide with that recipient.

Introductions may be commercial. Dreamwork may receive compensation or other consideration from recruiters, employers, or other recipients in connection with introducing you or showing them anonymized profiles. An introduction does not guarantee an interview, offer, or employment.

Recruiter introductions are on unless you turn them off. You can turn them off at any time in Profile, under Notifications, or by contacting us; this stops future matching and introductions, and it does not recall information already shared with a recruiter or employer. While they are off, recruiters searching Dreamwork do not find your profile, including in searches they saved before, and we make no new introductions. Recruiters and employers that receive your profile are independent parties, and their use of the information is governed by their own privacy practices.

We keep your account and career data while your account is active. Anonymized usage logs are kept up to 24 months for debugging and abuse prevention. Email relay messages are kept for the life of your account unless you delete them.

On account deletion, we remove personal data within 30 days. We may retain de-identified, aggregated statistics (for example, per-ATS field success rates) that can't be linked back to you.

Plan records. Access tier and entitlement history may be retained while your account exists so product limits and support decisions stay consistent.

Reusable application answers remain in your profile until you edit them, clear an optional answer group, or delete your account. Voluntary self-identification answers remain until you remove them or delete your account. Removing them stops future use by Dreamwork, but cannot recall answers already submitted to an employer, its applicant tracking system, or an application-fulfillment provider.

Regardless of where you live, you can:

• See what we store about you.
• Correct or update it.
• Delete your account and personal data.
• Edit reusable application answers, clear optional answer groups, and remove stored voluntary self-identification answers.
• Export your data in a portable format.
• Opt out of non-essential emails.
• Stop recruiter matching and introductions at any time by turning off Recruiter introductions in Profile, under Notifications, or by contacting us.

To exercise any of these, email hello@dreamworkhq.com with "Privacy" in the subject. We respond within 30 days. We may need to verify your identity before fulfilling certain requests, and we may retain limited data where required by law (see Retention, section 07).

For California residents (CCPA / CPRA). You have the right to opt out of a sale of personal information and of "sharing" for cross-context behavioral advertising, as those terms are defined under California law. Certain advertising measurement disclosures or introductions to recruiters may be treated as a sale or sharing depending on the facts and applicable law. Use the "Do Not Sell or Share" contact method in section 08b to exercise your applicable opt-out rights. You also have the right to know what we collect, request deletion, request correction, and designate an authorized agent to make requests on your behalf. We will not discriminate against you for exercising these rights.

For EU / UK / Swiss residents (GDPR / UK GDPR). Our legal bases for processing are: contract performance (matching your resume to roles and generating packs — i.e. delivering what you signed up for), legitimate interests (improving the Service, preventing abuse, measuring campaign effectiveness, matching your profile to recruiters' roles and introducing you to them, and sending product updates — only where they don't override your fundamental rights), consent (where we ask for it, including optional marketing emails), and legal obligation (tax records, fraud reporting). You can withdraw consent at any time; doing so doesn't affect prior lawful processing. You can lodge a complaint with your local supervisory authority.

We do not sell, rent, lease, license, trade, or otherwise transfer your personal information as a standalone data product. Limited advertising measurement disclosures or an introduction to a recruiter may nevertheless be treated as a sale, sharing, or another regulated disclosure under some laws. You may exercise applicable opt-out rights by emailing hello@dreamworkhq.com with “Do Not Sell or Share” in the subject line. We may need to verify and clarify the scope of your request, and a request cannot recall information already disclosed. We also honor Global Privacy Control signals for browser-based advertising measurement on devices that send them.

We use TLS for all traffic, encrypt resume files at rest, and keep API keys hashed. We scope access to production data to a small number of engineers. No system is perfectly secure — if we ever suffer a breach that affects you, we'll notify you promptly and walk you through the fix.

Dreamwork is operated from the United States, and our infrastructure providers (Railway, Neon, Cloudflare, Google, Anthropic, OpenAI, Resend) operate globally. If you use the Service from outside the US, your data will be transferred to and processed in the US and other countries that may not provide the same level of data protection as your home jurisdiction.

For transfers from the EU, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss Addendum where applicable), our vendors' equivalent transfer mechanisms, or other lawful bases (such as your explicit consent or the necessity of the transfer to perform our contract with you). By using the Service, you understand and agree to these transfers.

We use machine learning to rank job listings against your resume, score fit on six dimensions, and generate application materials (resumes, cover letters, answers). These outputs are recommendations and drafts — they don't make legally binding decisions about you, and an employer's hiring decision is theirs alone.

We do not use your personal resume content to train public, third-party, or our own general-purpose AI models. Google (Gemini), Anthropic (Claude), and OpenAI process API inputs under their commercial terms and do not use API content to train public models by default. Retention depends on provider and account controls. We do use anonymized, aggregated patterns (e.g. per-ATS field success rates) to improve our own playbooks.

Dreamwork is not intended for anyone under 16. We don't knowingly collect data from children. If you believe we have, email us and we'll remove it.

Dreamwork uses a small number of first-party cookies and local storage entries for core functions such as sign-in and preferences. We also work with a limited number of advertising and measurement providers to understand whether our campaigns are effective. Those providers may use browser or server-side measurement technologies. We minimize the information used for this purpose, protect identifiers where appropriate, and retain attribution data only as needed. We do not share resume content, application materials, or other sensitive job-search content for advertising measurement, and we do not use advertising measurement data to make employment-related decisions.

If we change this policy, we'll update the date at the top and — for material changes — email anyone with an active account. Continued use after the update means you accept the new policy.

Questions, requests, or concerns: hello@dreamworkhq.com. We read everything.