← Back to app

Privacy & Data Handling (Technical Summary)

Core Policy

  • No persistent storage of your content (recruiter messages, pasted URLs, resume text, PDF uploads, parsed offers) on our servers.
  • Requests are processed statelessly; content is discarded post-processing.
  • Local state (edits, preferences) is stored in your browser only.
  • Account and sign-in data is the one exception to this — see "Account & Sign-in Data" below.

Processing Flow

  1. Your browser sends input to our API over HTTPS.
  2. Our API forwards relevant content to AI providers for generation.
  3. Response is streamed back to your browser.
  4. Temporary payloads are discarded; we do not retain them. Any PDF you upload is written to a temp file only for the duration of parsing and is deleted immediately after, on both success and failure.

Account & Sign-in Data

Unlike the content above, some account-level data is stored server-side:

  • If you sign in with an email magic link, NextAuth stores your account, session, and sign-in-token records in our Redis database, including your email address. This is kept indefinitely — we do not currently expire or delete it automatically.
  • If you use a shared demo link instead of signing in, we store that link's metadata (a name, its usage limit, and creation/expiry dates) in Redis. This is tied to the link, not to you personally, and expires automatically with the link (30 days by default, configurable per link).
  • Demo links are metered with a usage counter stored in Redis. Unlike the link metadata above, this counter has no automatic expiration and is kept indefinitely.

Third‑Party Processors

We share data with these providers as part of normal operation:

  • Google (Gemini) — the default AI provider for generating replies and parsing offers/resumes. Privacy: https://policies.google.com/privacy
  • OpenAI — used instead of Google when the server is configured for it. Privacy: https://openai.com/privacy
  • browserless.io — fetches the page text of any URL you paste in, so it receives that URL. Privacy: https://www.browserless.io/privacy-policy
  • Resend — sends the email magic link when you sign in, so it receives your email address. Privacy: https://resend.com/legal/privacy-policy

These providers process data under their own terms. We do not control their retention.

Client Storage

  • localStorage: resume edits, preferences, small flags.
  • Clear via browser settings or use private/incognito mode.

Security

  • Transport: HTTPS for all network calls.
  • Auth gating for file uploads and protected actions.
  • No cookies for tracking; no analytics beacons.

Contact

Questions about privacy or data handling? Reach out via the repository issues or the website contact link.