Privacy Policy

Your acknowledgement

By joining the Tyche waitlist, requesting or receiving product access, or using Tyche, you acknowledge that you have read this Privacy Policy and agree to the Terms of Service. You understand that Tyche will process your information as described in this policy to manage the waitlist, provide product access, operate and secure the service, communicate with you, and comply with applicable law. When applicable law requires consent for a specific activity, we will request it separately, and you may withdraw that consent as permitted by law.

Who we are and how to contact us

Tyche is operated under the Zero Factorial Labs name. The operator is responsible for the personal information described in this policy. Where applicable law uses the term “controller,” the operator of Tyche is the controller. For privacy questions or requests, email [email protected].

Information we collect

We collect information you choose to provide and limited information created while operating the service:

• Waitlist information: your email address, verification status, and the dates you requested and confirmed waitlist access.
• Account information: your name, email address, password hash, acceptance records, and product-update choice.
• Career and application information: resumes, job-listing URLs and content, career history, goals, preferences, generated profile information, application materials, and related files you choose to provide.
• Companion and activity information: device and pairing identifiers, task status, onboarding status, generated outputs, and records needed to operate approved tasks.
• Feedback and support information: messages you send, the relevant product surface, app version, and viewport information.
• Technical information: essential cookies and request information such as IP address, browser or device type, and timestamps that may be processed to deliver and secure the service.
• Website analytics: when enabled, PostHog processes public pageviews and defined interaction events to help us understand website use. We send fixed categories for the public page, section exposure and engagement, button placement, coarse visible-page time, bounded repeat actions, and waitlist interaction and submission outcomes, along with broad browser or device categories, recognized referring sites, and explicitly approved campaign labels. Section visibility does not mean that someone read it. A waitlist request being accepted is not email confirmation. We exclude names, email addresses, other typed values, access codes, confirmation tokens, arbitrary URL queries, fragments, form contents, and raw error messages. We do not track activity inside the authenticated workspace.

Resumes and other materials may reveal sensitive information. Please do not provide sensitive information that is not needed for your job search.

How and why we use information

We use personal information to:

• validate that an email domain can receive mail, confirm that you control the submitted address, manage the waitlist, and send Tyche updates and private-beta invitations;
• create and secure accounts, provide onboarding, and operate requested product features;
• build evidence-backed profiles, find and assess opportunities, and prepare materials for your review;
• provide support, investigate feedback, prevent abuse, and protect Tyche and its users;
• comply with law and establish, exercise, or defend legal claims.

Depending on where you live, our legal bases may include your consent, steps requested before entering an agreement, performance of our agreement with you, our legitimate interests in operating and securing Tyche, and compliance with legal obligations. When we rely on consent, you may withdraw it at any time by contacting us.

AI processing and Tyche Companion

Tyche uses AI systems to organize career evidence, generate profile and application materials, and make recommendations. These outputs assist you; they do not determine whether an employer hires you. Nothing is submitted to an employer or sent to an external contact without your approval.

Sensitive AI-provider authentication remains on your Mac through Tyche Companion. When you authorize an AI provider through Companion, task context may be processed by that provider under your account and its terms. Tyche receives the task state and outputs needed for the workflow, not your AI-provider password.

How we disclose information

We do not sell personal information or share it for cross-context behavioral advertising. We may disclose information:

• to service providers that support hosting, storage, communications, security, and product operations under appropriate restrictions;
• to an AI provider you choose and authorize through Tyche Companion;
• when you direct or approve an application, communication, or other external action;
• to professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, or handle a business reorganization.

International processing

Tyche and its service providers may process information in countries other than the one where you live. Privacy protections can differ by country. Where required, we use contractual, organizational, or other lawful safeguards for international transfers.

Cookies and similar technologies

Public analytics is enabled on this deployment, subject to browser privacy signals.

Tyche uses essential cookies for private-beta admission, authentication, session security, and core product operation. We do not use third-party advertising or analytics cookies. When enabled, our PostHog integration does not set tracking cookies or store a persistent analytics identifier in your browser. Measurement context is held in memory for the current page and is not linked by us across pages, tabs or devices. PostHog receives network connection information needed to process requests. Its cookieless processing uses a server-side daily hash based on project, salt, IP address, user agent and hostname; this does not provide reliable cross-day or cross-device counts of people. Our SDK configuration disables person profiles, session replay and automatic interaction capture. Browser Do Not Track and Global Privacy Control signals suppress this implementation. Measurement may also be unavailable due to browser settings, blocking or connection failures. The SDK performs browser-storage capability checks and the wrapper clears SDK-owned toolbar state; this is not a claim of zero browser-storage API access. A dismissed waitlist dialog does not tell us whether someone later joined, and these events do not establish an identified visitor-to-confirmed-email funnel. We do not use this measurement for cross-context behavioral advertising. Cookieless processing is not itself a consent exemption. We will provide any choices required by applicable law before enabling collection.

Retention

We keep information only for as long as reasonably needed for the purposes described above:

• waitlist information is kept while invitations and product updates remain relevant, or until you ask us to remove it;
• account information, uploaded materials, task records, and generated outputs are generally kept while your account or pilot participation remains active;
• some records may be kept longer when reasonably necessary for security, fraud prevention, dispute resolution, or legal obligations.

You may request deletion at any time. We will delete or de-identify information unless continued retention is permitted or required by law.

Your privacy rights

Depending on where you live, you may have rights to know about and access your personal information; correct inaccurate information; request deletion or a portable copy; restrict or object to processing; withdraw consent; and complain to a privacy or data-protection authority. You may also opt out of Tyche product updates at any time. To exercise a right, email [email protected]. We may need to verify your identity before completing a request. We will not discriminate against you for exercising applicable privacy rights.

Regional disclosures

If European Economic Area or United Kingdom data-protection law applies, you may lodge a complaint with your local supervisory authority. If Canadian privacy law applies, you may challenge our compliance and complain to the appropriate privacy commissioner. If California privacy law applies, the categories described above also describe the information we have collected and disclosed for business purposes; we do not sell or share personal information as those terms are defined by California law. If Türkiye’s Law No. 6698 applies, you may exercise the data-subject rights available under Article 11 by contacting us.

Children

Tyche is intended for adults conducting a job search and is not directed to anyone under 18. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information.

Security

We use technical and organizational safeguards designed to protect personal information, including access controls, restricted local state, secure password hashing, and encrypted transport in production. No system is perfectly secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy as Tyche changes. We will post the revised policy with a new effective date and provide additional notice when required by law or when changes are material.