SixthacrePrivacy policy
Effective 31 October 2026. Sixthacre is a job-application service operated by Sash Stolba. Contact sashstolba@gmail.com about your information or this policy.
Information we use
We store your account identity, Profile, preferences, resumes and other documents, application answers, employer account credentials, job records and application history. We record browser observations, form screenshots, what the application assistant wrote, the tools it used with what went in and came back, errors and token usage to complete and explain your applications. What the assistant wrote, its tool calls and the screenshots it took are kept for 14 days, and passwords, verification codes and links are left out of them. If you sign in with Google, Google tells Sixthacre your Google account’s ID and its verified email address; signing in this way gives Sixthacre no access to your mail.
Your application address
Each account gets its own email address on a separate domain that Sixthacre uses only for applications. Applications and employer accounts use this address. Cloudflare receives mail sent to it for Sixthacre, which stores each message encrypted, shows it on the Email page, matches it to your applications and uses verification codes and links in it to complete the application they belong to. Mail that needs you, such as an employer's reply, an interview invitation or a decision, is forwarded to the email in your Profile, labelled as coming through your application address, with replies going back to the employer. You choose on the Email page between All mail, Only employer requests and Don’t forward. All mail forwards each message, holding one about an application up to ten minutes while it is read, so the forward can say whether it needs you. Verification codes and links are never forwarded: the assistant uses them, and you can read them on the Email page. The more selective option forwards mail identified as needing your attention. Replies you write on the Email page and applications an employer asks to receive by email are sent from this address through Cloudflare. The address and its mail are kept while your account exists and deleted with it, and an address is never given to anyone else.
Connected email
Accounts that connected Gmail or Outlook before application addresses existed keep that connection. New applications use the application address, and the earlier mailbox is read only for mail about applications and employer accounts that used it. Gmail access was authorized read-only through Google OAuth, and Outlook through Microsoft OAuth with read access; read-only access does not let Sixthacre send, modify or delete your messages. Sixthacre uses that mailbox for two purposes: to match employer confirmations and replies to your applications, and to complete email verification steps, such as a code or a password-reset link, while it is completing one of your applications. You can remove Sixthacre's access in your Google or Microsoft account permissions at any time.
Sync reads recent messages, up to 90 days back when you first connect and then new mail: the sender, recipients, date, subject, the provider’s short preview, and the copy, delivery, threading and mailing-list headers. Verification codes and verification or sign-in links are removed from subjects and previews before anything is stored. Messages that do not match an application are deleted within a day. Messages matched to an application are kept with it until you disconnect your mailbox.
Apart from a message you open yourself, described below, Sixthacre opens the full body of a message only during a verification step of an active application, and only when the message’s sender, subject or preview already identifies that employer or the application’s website. Other mail, such as a bank or shopping code, is never opened. The body is read in memory to take out the one code or link and to check that the message came from that website, and the browser service then enters the code or link on the employer’s page; the body and the code or link are not stored and are not given to the application assistant. Sixthacre records which message was used, and when, so the same code is never used twice.
The Email page lists the saved previews as a mailbox. When you open a message there, Sixthacre fetches its text from your mailbox to show it to you, including codes and links, whether or not it has been matched to an application. This explicit read uses your mailbox ownership. The fetched text is not stored and is not given to the application assistant; automatic reads retain their application scope and redaction.
If email application sending is enabled, you can separately authorize permission to send from your connected mailbox. This is used when an employer's posting asks for an application by email, and to send a reply that you write yourself on the Email page. Before sending, Sixthacre reads the original message’s Reply-To recipients, or its sender when Reply-To is absent, and shows the destination for you to review. Sixthacre does not write or send these replies on its own. It keeps the send identity, destination, a digest of your draft and the send time so an unclear response can be checked in Sent without repeating it. Reply text is read back from your mailbox when available; mail sent from the built-in application address is retained encrypted with that mailbox. Sixthacre sends the application text and selected attachments to that employer, records the outgoing application and checks the provider's Sent record when the result is unclear. It does not resend an uncertain attempt. Sending permission is optional and is not included in a read-only connection.
Use and service providers
Information is used to operate your account, find jobs, complete applications, verify employer accounts, display replies, troubleshoot failures and provide support. Employers receive the information included in applications you authorize. OVHcloud hosts the service and backups; Supabase provides account authentication; Cloudflare receives and sends mail for application addresses and checks that a person is behind sign-up and password recovery requests; Google and Microsoft provide their respective mailbox connections; OpenAI, Anthropic and Google process information needed to operate the application assistant. When purchases are available, Stripe processes payment details and supplies payment status and receipts; Sixthacre records the purchase amount and balance activity. The application assistant runs on OpenAI’s, Anthropic’s and Google’s models; Anthropic’s Claude Opus writes application material. If you connect your own ChatGPT plan, all of the assistant’s work for you runs instead on OpenAI’s models under your ChatGPT account, and OpenAI’s terms for that account apply to it. Your ChatGPT sign-in is kept on our servers only to run that work, and disconnecting deletes it. To complete an application it receives the sender, date, subject and preview of messages matched to that application, with codes and links removed, so it can see whether the employer received the application or asked for something. We do not sell mailbox data, use it for advertising or use it to train general-purpose AI models.
Sixthacre’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Storage and access
Mailbox tokens, mail sent to your application address and saved employer credentials are encrypted at rest. Account records are isolated from other applicants. Authorized service operators can access records to provide support and resolve failures. Service providers may process data outside your country.
Your controls and deletion
You can edit your Profile and preferences, export your records and request account deletion from Account and data. Disconnect your mailbox from Email, or revoke Sixthacre in your Google or Microsoft account, to stop future mailbox access. Disconnecting revokes Google access and removes the connection and cached mailbox messages; Microsoft does not let Sixthacre revoke its own access, so also remove Sixthacre from the apps with access to your Microsoft account. Records of which messages were used for verification hold no message content and are deleted within two days. Application observations already recorded in your job history remain until their records are deleted.
We retain account and application records while you use the service. We aim to remove active account data within seven days of a deletion request. Limited submission records may be retained for 30 days to resolve duplicate-send questions. Deleted data can remain in encrypted backups until they expire, for up to 90 days. Contact sashstolba@gmail.com for access, correction, deletion or a privacy concern.
Cookies and changes
We use essential session cookies for sign-in and connection security. We will update this page when our data practices change and explain material changes in the service.