Privacy notice

Who is responsible for your data: operator to be added. Questions and requests: contact address to be added.

We don't sell or rent your data, and there is no advertising. The site loads no analytics, no third-party scripts, fonts or trackers.

What we keep and why

Your account

Email address, a name if one was given, when you signed up and last signed in, and when you confirmed your email. Your password is stored only as a salted hash (PBKDF2-SHA256). Used to sign you in and to send the emails you ask for.

What you save

Saved searches, starred jobs, notes, application status, the jobs you marked “I applied”, jobs and companies you hid, and your “not relevant because…” answers. Used to show them back to you and to leave hidden jobs out of your results and emails.

Apply clicks

When you follow a job's Apply link through this site, we record which job, the first and last time, and how often. A click is kept apart from your “I applied” marks: we never conclude from it that you applied.

Alerts

Which searches are emailed, how often and at what hour, and which jobs were already sent to you (so none is sent twice). If your mail server refuses an email we record the address, the error code and the time; after one permanent refusal or 3 temporary ones within 7 days, alerts to that address stop until it is cleared.

Sign-in sessions

A hash of each session's token, when it started and when it was last used.

Your IP address

Used in memory to limit repeated sign-in, sign-up and password-reset attempts; not written to the database.

Server logs

Errors and operational events (emails sent or failed, account changes). They can name your account and, for delivery problems, your email address. log retention to be set

Job postings are published by employers. A posting can name a recruiter or contact person; if that is you and you want it removed from our index, write to us.

Cookies

jr_session

Keeps you signed in. Ends when you sign out, 30 days after sign-in, or after 14 days without use.

jr_device

Sent only to the sign-in page. It marks a browser that signed in to your account before, so someone else's failed attempts can't lock you out. Lasts 365 days.

Both are needed to sign in; there are no others. Forms are protected against cross-site requests with a token in the page, tied to your session, not with a separate cookie.

Who else sees it

• Email delivery: alert and account emails go through our email provider provider to be named.
• Hosting: hosting provider and location to be named.
• Employers: nothing. The Apply link takes you to the employer's site, and our pages ask your browser not to tell other sites which of our pages you came from. What you do on the employer's site is covered by its own privacy notice.

How long

• Your account and everything saved with it: until you delete the account.
• Password-reset links: 1 hour. Email confirmation links: 24 hours. Unsubscribe links: 90 days. Only a hash of each link's token is stored.
• Deleting your account removes its rows from every table in one step, at once. Database backups are made daily and the newest 2 are kept, so a deleted account leaves the backups within a few days.

Your rights

• Access and portability: download everything stored for your account as one JSON file from your account page, at any time.
• Correction: change your email address and password on the account page; for anything else, write to us.
• Erasure: delete your account on the account page. Unsubscribing from alerts needs no sign-in.
• Objection, restriction, questions: write to us.
• You can complain to the data protection authority where you live.

Still to be set in legal review: the legal basis for each use (we expect: providing the service you signed up for; security and abuse prevention as a legitimate interest), and international transfers once hosting is chosen.