Privacy notice

Who we are

Jobsearch, a job-search service. The operator's legal name and postal address are added before public launch. Write to the contact address below for anything this notice does not answer.

What we store

• Your account: your email address; the name Google gives us when you sign in with Google; when you signed up and last signed in; your three mail switches; your referral code, and when you entered someone else's.
• Sign-in sessions: when each one started, was last used and expires, and your browser's user-agent string. The session key itself is kept only as a SHA-256 hash.
• Your CV: its text after we remove the categories listed under "What we never store"; the file's name, type, size, page count and SHA-256 fingerprint; whether it was a scan; how many images it held; and the names of the categories we removed (for example "your date of birth"), never what they said. One CV per account: a new upload replaces the old one.
• Your consents: each consent you give or withdraw, with the privacy notice version it was given on, when, and where (see "Consent").
• Your profile: the résumé read from your CV or written by you; the facts ledger, each fact with the passage of your CV it comes from (or marked as your own interview answer or as read from your LinkedIn profile PDF); the items a model proposed that your CV does not support (left out, and listed on the Profile page); your preferences, target roles and target sectors; and a vector (embedding) of the pseudonymised search text described below.
• Your interview answers and your LinkedIn profile PDF's text: described in the sections of those names below.
• Your searches: the briefs you save, with the words you typed; each deep search's run (status, counts, cost and its brief) and the results it showed you.
• Matching: your matches with their scores, odds and reasons; your votes on jobs; the companies you hide; the Fit reports of the jobs you open.
• Watchlists: the companies you follow and the searches you save, the alerts they raise, and your daily digests.
• Your applications: each job you track (its title, employer and address, how you added it, its stage, the channel you applied through, the dates you applied, heard back, interviewed and closed, the outcome you confirmed, your notes, and which tools you used for it, such as an adapted CV or a note to a contact); its activity (stage moves, reminders mailed, messages marked sent); your reminders (a due time and a short note); and your weekly reviews (the counts, rates and suggestions of each week). A job address you clip is read by us (below); a LinkedIn job address is never opened. A posting you paste is described under "Pasted postings".
• Your documents, your connections, the contacts you look up, your credits and payments: described in the sections of those names below.
• Usage: one record per model, embedding, search, email-verification or email-finder call made for you (provider, model, tokens or calls, cost, status, the feature it served, the version of the prompt, and the application when the call was made for one), never the prompt, the answer or the address checked.
• Product events: counts of what happens in the product, linked to your account only with the optional consent (see "Product events and the admin view").

What we never store

• The CV file. It is read in a separate process and discarded once its text is out. An upload larger than 1 MB sits in a temporary file for the length of the upload request. The same holds for your LinkedIn profile PDF.
• A refused upload. Nothing is kept from a file the upload checks refuse (see "Upload checks").
• A photo, or any other image from your CV.
• What the removed categories said: your date of birth, age, marital status, religion, health or disability data, ethnic origin, political affiliation, trade-union membership and sexual orientation. The remover finds labelled fields ("Date of birth: ...", "Familienstand | verheiratet") and dates after a birth verb, in English, German, French, Spanish and Turkish. A mention without such a label can stay in the text: check your CV before you upload it.
• Card details. Payments are made on Stripe's own checkout page; no card number reaches us.
• Your connections' email addresses and profile links in clear, and the connections file itself (see "Your connections").
• Search-engine results. What a search engine answers lives in memory for one run; a page it pointed to is stored only as our own reading of that page.
• Rendered files. Your CV and letters are built as DOCX, PDF or text each time you download them, from the stored content, and never kept as files.

Where your data goes

• The privacy tier, Anthropic. Anything personal reaches a language model only through Anthropic's Claude, and the code refuses any other route for it. Haiku 5.5 (Sonnet 5.5 as the fallback where one is set) reads your CV into the résumé and facts ledger (the CV text after removal; for a scanned CV also up to six page images, sent as the pages show them, so a photo or a date of birth on a scanned page reaches the model although neither is stored); proposes target roles from your résumé (your contact details and web addresses removed first, and your name from its employer and summary lines); writes the Fit report (your ledger's facts, your name removed, beside the job's requirements); and turns a search you type into a brief (your words). The design requires a data-processing agreement that rules out training on these inputs; that it is in place for this service is pending (see "Open before public launch").
• The privacy tier for applications. Sonnet 5.5 (Opus 5.5 as the fallback) proposes your adaptation plan and the adapted CV's new wordings from an outline of your CV with your name, contact details, personal web addresses, LinkedIn and GitHub addresses and employers' domains removed, your facts, the Fit report and the company's profile; a premium draft asks Opus 5.5 first. Sonnet 5.5 chooses the sentences of your cover letter, outreach note, two screening answers and outreach messages from your facts, the posting and the company's profile; for a message to a contact or a connection it also sees that person's name and title, never their address. Haiku 5.5 (Sonnet 5.5 as the fallback) rewrites your weekly review's counts and suggestions as one paragraph; it sees no employer, job title or note.
• The privacy tier, since 2026-10-28. Haiku 5.5 (Sonnet 5.5 as the fallback) chooses the order of the guided interview's questions: it sees the bullets of your CV it may ask about (contact details, your name, web addresses and domains removed), their role titles or project names and the job's requirements; never your answers, and an employer only where a bullet itself names one. It also reads a posting you paste (see "Pasted postings"). Sonnet 5.5 chooses the sentences of a follow-up message and of an interview preparation sheet from the same kinds of input as your letters and messages. Your interview answers and the facts read from your LinkedIn profile PDF are facts of your profile: they reach the privacy-tier model with your other facts (in a Fit report; of the LinkedIn facts, only skills and languages when it chooses sentences).
• Embedding and rerank providers. For matching we build a pseudonymised search text from your profile: your target roles (every role on your profile, switched on or not), seniority, skills and summary, with your name, contact details, web addresses, employers and dates removed. This is a best effort: an employer written otherwise than its name (an abbreviation), your name in the summary when the CV has no name line, or an employer whose name is a common word can slip through or take an ordinary word with it. The text goes to the embedding provider the deployment is configured with (DeepInfra, OpenAI or OpenRouter, or a model running on our own server), and to Voyage AI's rerank service when a Voyage key is set; without one, reranking uses the same embedding provider. A data-processing agreement and standard contractual clauses are required before real people's data reaches an outside provider: pending. On our staging server the embedder runs on the server itself, so nothing personal leaves it for embeddings; reranking there uses that same local model unless a Voyage key is added.
• Search engines. A deep search sends queries built from its brief to Exa and Brave when their keys are set: job titles, places, seniority words and site filters, never your CV's sentences, your name or your contact details. The titles of a brief made from your CV are your target roles and the role titles in your CV. The brief's first title also goes, as a keyword, to the Hacker News search (Algolia) and, when a USAJobs key is set, to USAJobs for a search in the United States or one that names no place. A clipped job address that we cannot resolve otherwise may start up to four searches bound to the employer's name and the job's title. A Connection Map sends up to eight queries (by default) built from the employer's name and the job's title, never anything about you. They receive these from our server, never with your email address or your network address.
• Public data. Job postings, clipped job pages and company pages are read by cheaper models (reached through OpenRouter, DeepSeek, Alibaba or DeepInfra, and Anthropic's Claude Haiku), with recruiters' emails, phone numbers and profile links masked first. The pages a Connection Map reads to find people go to Anthropic's Claude Haiku only, the same masking first. None of your data goes to them.
• Payments: Stripe. When you buy credits (see "Payments and credits").
• Email verification and finding. When a deployment configures them, a contact's business address goes to the email verifier (MillionVerifier) and a contact's name with the company's domain to Hunter (see "Contacts we help users find"). Nothing about you goes to them.
• GitHub. With a GitHub token configured, a Connection Map reads the public member names of the employer's GitHub organisation. Nothing about you is sent.
• Google. If you sign in with Google, we ask for openid email profile, keep your Google account id, address and name, and keep no Google token. We refuse a Google account whose address Google has not verified.
• Mail. When a deployment sends mail, its mail provider receives your address and each mail's content (sign-in links, alerts, digests, reminders). The provider is configured per deployment; our staging server sends no mail (its sender only logs).

Consent

• Two consents. The required one lets us read your CV, build your profile, match jobs and prepare applications. The optional one links your product events (counts of the features you use, never content) to your account (see "Product events and the admin view"); without it events carry no account id, though their times could still be matched against your account's own records. With or without it, the operator's admin view shows figures computed from the service's records of every account (same section). No one but you reads your CV, documents or answers, and they are used only for your own service.
• What we record: the kind, the version of this notice you gave it on (2026-10-25 for this version), when, and where (at sign-up, at a later sign-in, or in Settings); a withdrawal keeps the record and adds its time. A new consent is a new record. When this notice changes materially, its version changes and everyone is asked again at their next visit.
• Before you give the required consent the CV upload, the LinkedIn upload, edits to your résumé, preferences and target roles, interview answers, and changes to your answer bank and writing preferences are refused. Reading, exporting and deleting your data never need it.
• Withdrawing: Settings, "Consents". Withdrawing the optional consent takes your account's id off your product events at once. Withdrawing the required consent deletes, at once and in one step, the following: your CV, your profile (the résumé, your saved preferences and your target roles) and its facts, Fit reports, matches, the Studio's plans and documents, the answer bank, the writing preferences learned from your edits, your interview answers, your LinkedIn import, and your unsent message drafts. What stays: your applications with their activity and reminders, weekly reviews, contacts, sent and replied messages, connections, Connection Map lookups, credits and purchases, search briefs (a brief made from your CV keeps the titles taken from it), deep-search runs (with their briefs) and the results they showed, your votes on matches, hidden companies, watchlists, alerts, daily digests (which list the jobs picked from your matches), pasted postings, the usage records of model calls, and the consent records themselves. Deleting your account deletes those too (the usage records stay without your id). To use the service again, give the consent and upload your CV.
• Consent records go with your account: deleting your account deletes them (whether an anonymised record should be kept instead is open for counsel).

Your documents

• What: your adaptation plans (the changes proposed for a job, which you edit and approve), the adapted CVs, cover letters, outreach notes, screening answers and interview preparation sheets, stored as structured content, never as files. Each document keeps the changes from your CV (the diff), its coverage of the job's requirements, the ATS checklist, the tone you chose and whether you edited it; since 2026-10-28 also the text as it was first generated, how much you changed it (a ratio), and the versions of the prompts that wrote it. Your screening answer bank holds the answers you keep for common questions.
• Every claim traces to your CV. Each line a model helped write cites the facts of your ledger it rests on, and a check refuses a line whose words or numbers those facts do not hold before it is stored or shown. Employers, job titles and dates are copied from your résumé, never generated. In letters, notes, answers and messages the model only chooses sentences from a fixed catalogue and the code writes them from your facts. A line you type yourself is kept as yours.
• What your edits teach: the tone you chose last, the facts and phrases you removed and the words you replaced, so later drafts avoid them. Phrases are kept without your name, contact details or web addresses.
• The AI-assistance marking. Each DOCX and PDF file carries a machine-readable note that it was AI-assisted (or that no model wrote any line), the version of your facts it cites and an opaque document reference, never your account id (docs/legal/ai-disclosure.md). Plain-text files carry none.

Pasted postings

• What: the text of a job posting you paste into the tracker (control characters removed; a text longer than 30,000 characters is refused), and the title, employer and job address you type with it. It is stored as a job only you can see, with an application for it.
• For you alone: it is never in anyone's search, matches, alerts or digests, and no other account can open it. Its job address is never opened. A Job Intelligence Report is not offered for it.
• How it is read: by our own rules, and, when models are switched on, by our privacy-tier model (Anthropic's Claude Haiku 5.5, Sonnet 5.5 as the fallback: the provider that reads your CV, never the cheaper models that read public postings), on up to 12,000 characters of it. Sentences that read like instructions to a model are taken out first, and the reading is never cached or shared with anyone else's. The cost record of that call carries your account. The requirements read from it then reach the privacy-tier models that write your Fit report, plan, letters and interview preparation, as any job's requirements do.
• Not passed on: a Connection Map for a pasted posting searches only with the words of your title that are in a fixed vocabulary of job words, never the title as typed, and takes no name or address out of the pasted text, so nothing else of it reaches a search engine, an address finder or the email verifier. A recruiter named only in the pasted text therefore does not appear on the map.
• How long: until you delete its application (the posting goes with it) or your account. Withdrawing the required consent does not delete it.

Your LinkedIn profile PDF

• What: your own "Save to PDF" export of your LinkedIn profile, uploaded on the Profile page. It is optional, it is checked like every upload (see "Upload checks"), read in the separate process that reads CVs, and the same categories are removed from its text as from a CV's.
• What we keep: the file's name, size and SHA-256 fingerprint, never the file; its text without the page footers, without the Contact, Honors-Awards, Publications and Patents sections and the sections LinkedIn prints after your education (volunteering, projects, courses, recommendations and the like), without the name, headline and location LinkedIn prints at the top (best effort), and without any line that reads as an email address, a web address, a handle, a phone number or a street address; what was read from it (roles, education, skills, certifications and languages); and where it disagrees with your CV.
• Your CV wins. Where the two disagree, the CV's value stands and the Profile page shows the difference. What your CV lacks becomes facts of your profile marked as coming from LinkedIn, never written into your CV unless you add them yourself. Its skills and languages can ground "I work with" and "I speak" sentences in letters, answers and messages; nothing of it is ever called "my CV".
• Nothing is fetched from LinkedIn, and no address in the file is ever opened or kept.
• How long: until you remove it on the Profile page or upload another (which replaces it), withdraw the required consent, or delete your account.

Interview answers

• What: the guided interview on the Profile page asks, from a fixed list of questions, about bullets of your CV that state no number: how much, how many, what changed, and for whom. You can skip any question. We store the bullet asked about (its text and a fingerprint of it), the question, your answer as you wrote it (at most 600 characters) and the numbers in it, or that you skipped it.
• Your own words: each answer becomes a fact of your profile marked as yours and shown as yours. It is used to write your documents only as your words: a number you give can be added to that bullet's wording in an adaptation plan; a cover letter, outreach note, screening answer or follow-up message can quote the first sentence of an answer ("A result of my role at ...: ..."); and an interview preparation sheet shows it as "In my words". It is never presented as written in your CV. It counts as evidence in your Fit report.
• Models: see "Where your data goes": the model that orders the questions never sees your answers; your answers reach the privacy-tier model as facts of your profile.
• How long: until you delete the answer (Profile page, at any time), withdraw the required consent, or delete your account. An answer whose bullet is no longer in your CV is kept, unused, until you delete it.

Upload checks

• Every upload is checked on our server before anything reads it: your CV, your LinkedIn profile PDF and a connections file. PDF and Word files get a structure check: a PDF is refused when it holds JavaScript, a launch action or an embedded file, or when parts of it cannot be checked; a Word file when it holds macros, embedded or ActiveX objects, or a template fetched from elsewhere, or when parts of it cannot be checked. Other files (an image, a text file, a connections CSV) are checked only by the malware scanner, when it is on.
• The malware scanner, when it is switched on, is ClamAV running on our own server: the file's bytes are scanned there and never sent anywhere else. A file it flags is refused; while a configured scanner does not answer, uploads are refused and nothing is read until it is back. Our staging server runs only the PDF and Word checks until ClamAV is installed there.
• Nothing is kept from a refused file. The refusal is logged with its reason (and, for a file the scanner flags, the name of what it found), never the file or its name.

Your connections

• What you give us: your own export, LinkedIn's Connections.csv ("Get a copy of your data") or a Google Contacts CSV (Outlook's contacts export works too). The file is read once and not kept.
• What we keep: each connection's name, employer, position and connection date, and up to five earlier employers when a later import shows a change. Their email addresses and profile links are kept only as keyed one-way hashes (HMAC-SHA256 under a key derived from the server's secret), never in clear, so we can recognise a person again but cannot show or use their address. A row with no name is skipped.
• What it is for: your warm paths (the connections who work or worked at a company you apply to) and the referral asks you draft to them. A connection's name and position reach the privacy-tier model only in a referral ask you draft. Your connections are never shown to another account or used for anyone else.
• Replacing and deleting: an import replaces your previous import of the same source. Settings, "Delete imported connections", deletes them; so does deleting your account. Referral asks you drafted keep their text.

Contacts we help users find

The Connection Map helps a user find the people who hire for one job they chose to apply for. This section is for those people as much as for our users.

• What we store about a contact: their name, job title and employer; a business email address on the employer's own domain, whether it was verified and how it was found; the evidence (a quote of at most 200 characters with addresses and phone numbers masked, and the address of the employer's own page, or only the host name of a press or conference page); a confidence; and a LinkedIn people-search link built from their name and employer (a search the user clicks, never a profile address). At most three contacts per user and employer, across that user's applications. A contact belongs to one user's application: nothing found for one user is shown to another, and there is no shared contact database.
• Where we find them: the job posting's own labelled lines ("Hiring manager: ...", "Recruiter: ..."); the employer's own pages (team, about, leadership, people and company pages; never its careers page, never its forum, help or documentation sites); press and conference pages on a fixed list of news and event sites that a search engine pointed to, read by us with robots.txt honoured; never people-data broker sites; never LinkedIn. A LinkedIn profile that appears in a search engine's results is shown to the user in that answer only (the name, the title and the link) and is never opened or stored; the user may keep the name as their own entry. With a GitHub token, the public member names of the employer's GitHub organisation (kept in memory for a day) only raise the confidence of a person found elsewhere; GitHub alone never adds anyone, and no address is taken from it.
• Addresses: only on the employer's own domain, never a free-mail address. An address written next to the person's name in the posting or on the employer's site, else one inferred from the employer's address format, else (when the deployment uses it) one found by Hunter. Inferred and found addresses are checked by the email verifier when one is configured: at most three checks per person and nine per map. An address the verifier answers invalid or disposable is never drafted to.
• Why: the user's legitimate interest in applying for the job, and the contact's professional role in hiring for it, weighed in our legitimate-interest assessment (docs/legal/lia-connection-map.md; its approval is for counsel).
• How long: a contact is deleted 90 days after it was found, or 90 days after the last message the user marked as sent to them; at once when the application is closed (rejected or withdrawn) or deleted, or when the user removes the contact; and with the user's account. A daily job enforces this. The record of a lookup (its sources, counts and legitimate-interest record, no names) is kept 120 days. A message the user drafted keeps its text, which can hold the contact's name in its greeting, until the user deletes it, the application or their account.
• The Art. 14 line: every email the user drafts to a contact found this way ends with a line saying where the name and work email were found and that a reply "not interested" stops the sender writing again. The user cannot edit it out of the draft in the app; what they finally send from their own mailbox we cannot see. LinkedIn notes and referral asks carry no such line. Both points are open for counsel (see "Open before public launch").
• How to object: a reply "not interested" reaches the user who wrote, not us. To have us remove you, write to the contact address below with the address you were written to and, if you like, your name. We then block your address and your name at that employer, delete every contact row about you at that employer across all users (with the unsent drafts to you), remove your address from the messages users keep, and never store, verify or show you again for that employer. What we keep is a keyed hash of your address and of your name (and its initial forms) at the employer's domain, with no time limit, so the block holds. We aim to do this within 72 hours of your message (a commitment the operator confirms before public launch; the removal itself runs at once).
• What we never do: keep a shared contact database; store or infer personal addresses or phone numbers; send any message (the user sends from their own mailbox or account, through a mail link or a copy); take anything from LinkedIn or send anything to it.

Payments and credits

• Credits: each month you get free credits (4 by default) that reset and do not carry over; paid credits from packs, referrals and confirmed interview or offer outcomes do not expire. A paid unit (a deep search beyond the free ones, a Job Intelligence Report beyond the free ones, an adapted CV, a premium draft, a cover letter and note pair, an application packet, a Connection Map, an interview preparation sheet) is charged when it starts and given back when it fails, or (a Connection Map) finds no one new.
• Your credit ledger: every grant, charge, refund and expiry, with the unit and what it was for (for example the application or the lookup), and the Job Intelligence Reports you opened. It is your record and part of your export.
• Stripe is the payment processor. You pay on Stripe's own checkout page. Stripe receives from us your account email (to fill in the checkout), your account id, the purchase's id, the pack and its price; the card details go to Stripe only. We store the pack, its credits, the amount and currency, the status, Stripe's references to the checkout, the payment and any refund, and the times; no card data. Stripe keeps its own records of the payment under its own terms.
• Refunds: the unused credits of a purchase can be refunded to your card within 14 days of the payment, in proportion to the price (rounded down to the cent; a pack's last refund makes up the cents). The wording of the refund terms is open for counsel.
• Referrals: a new account can enter another person's code within 7 days of signing up; both get credits once. The other person's id is never shown to you or exported with your data.
• Our staging server sells nothing yet (payments are not set up).

Product events and the admin view

• Product events: one record each time something countable happens: a sign-up, a CV or LinkedIn upload, a plan, CV, letters, packet, interview preparation or Connection Map built, a posting pasted, an application reaching "applied", "interviewing" or "offer", a purchase paid. Each holds the event's name, a time, a count and at most a closed label (such as the pack bought), never text you wrote or anything from your CV, documents or applications.
• Linked to your account only with the optional consent. Without it an event carries no account id, though its time could still be matched against your account's own records while they exist. Withdrawing the consent or deleting your account removes your id from every event of yours at once; the counts stay. A sign-up event never carries an account id, since the consent can only be given after the account exists.
• Kept 13 months (395 days), then deleted by a daily job.
• The admin view is read-only and open only to the operator's own sign-in addresses (the ADMIN_EMAILS setting); to anyone else it does not exist. It shows counts and shares (sign-ups, activation, how much generated documents were edited, interview and offer outcomes, purchases, model cost per feature and per prompt version), and per account only its number, its sign-up and last sign-in dates, whether it has a profile, has been activated or has bought credits, its number of applications and its model cost. It never shows an email address, a name, a CV or anything a person wrote.

What we never do

• Fetch anything from LinkedIn or send anything to it. The deep search, the clipper and the Connection Map never fetch pages of LinkedIn, Indeed, Glassdoor or job aggregators such as StepStone or Monster.
• Sell your data, or share it with employers or recruiters.
• Build profiles of you for employers. Matching works for you only; when you apply, you do it yourself on the employer's page.
• Send anything in your name. Drafts are yours to send from your own mailbox or account.
• Train models on your data.
• Load analytics, advertising or tracking scripts in the web app.

How long we keep it

• Your account and everything under "What we store": until you delete your account, unless a line below says otherwise. There is no automatic deletion after a period of inactivity yet; after 30 days without a visit we stop building your daily digest.
• Sign-in sessions: 30 days after your last use. When you use the app, the server moves the session's expiry to 30 days later (at most once an hour) and renews your browser's session cookie with it, so a session ends 30 days after your last use. A clean-up that runs at every sign-in deletes signed-out sessions and sessions that expired more than 30 days before.
• Sign-in links: valid once, for 15 minutes. The record (your address and the link's hash) is deleted by a clean-up that runs whenever a link is requested, once a day has passed since the link was used or expired.
• Alerts: 90 days. Daily digests: 180 days.
• Fit reports: until your profile changes; reports of an earlier profile are deleted when the next one is built.
• What the required consent covers (the list under "Consent": your CV, profile and facts, Fit reports, matches, plans and documents, the answer bank, what your edits taught, interview answers, the LinkedIn import and unsent drafts): deleted at once when you withdraw it, otherwise kept as the lines below say.
• Applications, their activity and reminders, and sent messages: until you delete the application or your account. Documents, plans and unsent drafts: until you delete the application or your account, or withdraw the required consent. Weekly reviews, credits and purchases: until you delete your account. The answer bank and what your edits taught: until you delete your account or withdraw the required consent.
• Pasted postings: until you delete the application or your account. The LinkedIn import: until you remove or replace it, withdraw the required consent, or delete your account. Interview answers: until you delete them, withdraw the required consent, or delete your account. Consent records: until you delete your account.
• Product events: 13 months (395 days); your account's id on them only while the optional consent stands.
• Connections: until your next import of the same source replaces them, you delete them, or you delete your account.
• Contacts found by a Connection Map: 90 days after they were found or last written to, and at once when the application closes. Lookup records: 120 days.
• An objection: the keyed hashes that block a person are kept with no time limit.
• After you delete your account: the cost records of the model calls made for you stay, with no link to you, and so do product events (until their 13 months are up).
• Backups: our staging server backs up its database every night and keeps the newest seven, so deleted data can remain in a backup for about a week.
• Logs: they never hold your CV's text, your name, your full email address (at most its domain), a contact's name or address, a pasted posting, an interview answer, your LinkedIn PDF's text, an uploaded file's name, a card detail, a payment reference (one exception: Stripe's id of a refund we could not record, for the operator to settle) or a token. The web server's access log records each request's path and the network address it came from, and is not deleted per person.

Cookies and browser storage

• js_session: the session cookie (HttpOnly, SameSite=Lax, Secure outside development), for 30 days after your last use.
• js_oauth: during a Google sign-in only, for 10 minutes, to tie Google's answer to this browser.
• The sign-in you started (your address and the page to return to, never a token), kept in the browser's local storage for up to 120 minutes and removed when you sign in, choose "Continue as ...", or sign out. On a shared computer it stays until then if nobody completes the sign-in.
• Your light or dark theme, in local storage.

There are no other cookies.

Your rights: export and delete

• Export, at any time: Settings, "Download my data", gives one JSON file of everything under "What we store", your documents, connections (with their hashes), contacts, messages, lookups with their legitimate-interest records, your credits, your consents, your interview answers, your LinkedIn import with its text, your pasted postings, and the product events that still carry your account's id. It leaves out your Google account id, the embedding vector of your profile, the hashes of your session keys, the records of sign-in links sent to your address, Stripe's payment and refund references, and the id of anyone who referred you.
• Delete everything, at once: Settings, "Delete my account and data", deletes your account, everything under "What we store" and the sign-in links sent to your address. The cost records of model calls and the product events stay without your id. A deep search still running when you delete ends on its own and stores nothing of yours. Objection blocks are not your data and stay.
• Correct: edit your résumé, facts, preferences, target roles and target sectors on the Profile page, delete interview answers and your LinkedIn import there, and edit your documents in the Studio.
• Withdraw a consent: Settings, "Consents" (see "Consent").
• Export and delete are self-service: you need not ask us. For any other request, write to the contact address.

Mail

• Three switches in Settings: "Daily Top 5 by mail", "Watchlist alerts by mail" and "Application reminders by mail". All three are on for a new account. Alerts and reminders stay in the app either way.
• Every alert, digest and reminder mail has a link that stops that kind of mail in one click, without signing in, and carries the List-Unsubscribe headers mail clients use for one-click unsubscribe. The link can only turn a mail off and does not expire.
• The daily digest is built once a day, after 07:00 UTC by default, for the UTC day: in UTC+10 it arrives in the late afternoon.
• An alert mail names each job's title, employer and place, and the kind of watchlist (a company you follow, a saved search), never a saved search's name. A digest mail names each job's title, employer, place and odds; it never says how much of a job's requirements your CV covers. A reminder mail names the application's title and employer, your reminder's note and its due time, never the application's notes; its subject is the same for every reminder.
• We never mail the contacts or connections you write to.

AI systems

The sign-in page and Settings say, as the EU AI Act's Article 50 asks: "You are interacting with an AI system." In this version models read your CV into the résumé and facts ledger, propose target roles, turn a typed search into a brief, write the notes, gaps and summary of a Fit report, write the narratives of job and company reports, propose adaptation plans and CV wordings, choose the sentences of letters, notes, answers and outreach messages, read names and titles off public pages for the Connection Map, and rewrite your weekly review as a paragraph; since 2026-10-28 they also choose the order of the guided interview's questions (never the questions' wording), read a posting you paste, and choose the sentences of follow-up messages and interview preparation sheets. Odds, scores, ghost scores and a contact's confidence are computed estimates; the triage verdict (apply, referral first or skip, with its reasons) is decided by fixed rules and tables and no model writes it, though one of its inputs is the Fit report's coverage, which a model assesses when models are on; the ranked ways in to a job and a job's sector are computed by fixed rules and tables, without a model. Every fact read from your CV points to the passage it comes from, and what a model reads into your résumé that your CV does not contain is dropped; every line a model helps write for an application cites those facts; the notes, gaps and summary of a Fit report are the model's own words. Generated DOCX and PDF files, the interview preparation's DOCX included, are marked as AI-assisted. Review all of it before you act on it.

Contact

CONTACT_EMAIL: the monitored mailbox the deployment is configured with, the same address our crawler names to every site it reads. This draft names the setting, not an address; the operator fills it in before public launch.

Open before public launch

• Counsel reviews this notice, the Article 50 wording and the legitimate-interest assessments, and signs the Connection Map's (docs/legal/lia-connection-map.md).
• Counsel: the wording of the Art. 14 line in email drafts, which names neither us nor this notice, and whose "not interested" reaches the user, not us.
• Counsel: LinkedIn notes and referral asks carry no Art. 14 line.
• Counsel: the refund terms shown on the Credits page.
• Counsel: whether payment records must be kept for tax or accounting law after an account is deleted (the code deletes them with the account).
• The operator: the 72-hour promise for objections (handled by hand through the contact address; no code enforces a deadline).
• Data-processing agreements: Anthropic, and the embedding and rerank providers (Voyage AI, and the embedding host when it is not our own server) with standard contractual clauses; Stripe, the email verifier and Hunter when they are configured. Pending.
• The mail provider: chosen per deployment; its terms and data-processing agreement are checked when one is configured.
• The operator's legal name and address, the legal basis of each use, and the supervisory authority.
• Counsel: the wording of the two consents; what withdrawing the required consent deletes and keeps (search briefs, including those made from a CV, digests listing jobs picked from the matches, and pasted postings stay); whether consent records are deleted with the account (the code) or kept anonymised; the optional consent's scope; the 13-month retention of product events; whether adding the 2026-10-28 sections calls for a new notice version (which asks everyone to consent again).
• The operator: the malware scanner (ClamAV) on the server; until it runs, uploads get only the PDF and Word checks.
• Deletion after a period of inactivity: not built.
• Processing locations: these providers may process data outside the EU; the code calls Anthropic's API directly, not an EU region.