Privacy notice

JobHunt ranks real job openings against a profile you write, and keeps track of the ones you applied to. Doing that means holding your career history, so this page says exactly what is held, who else sees it, and how to have all of it removed.

JobHunt is run by Ghaly Nicolas Jules, an individual resident in the United States, who is the person responsible for this data and the person you reach at the address below. There is no company behind this and no team: one person built it and one person answers your mail.

This is the complete list, and it is generated from the database itself rather than written out by hand, so a change to what is stored cannot quietly leave this page behind.

When you sign in with Google or GitHub, that account hands over:

• your email address
• the display name on that account
• the address of that account's picture

Nothing else is collected. There is no resume upload, no browsing history, no contact list, and nothing bought from anybody.

Under the UK and EU General Data Protection Regulation, every purpose needs a lawful basis. There are two here, and each is named with the purpose it belongs to rather than listed on its own.

• Your sign in details, profile, work history, resume, preferences and applications are processed because the service cannot be provided without them. This is contract necessity: you asked for a tool that ranks jobs against your career history, and there is no version of that which does not process your career history.
• Error and performance events are processed to keep the service working, on the basis of legitimate interest. Nobody should be asked to opt in to a product noticing that it broke, and the events carry no personal data, which is the point below about Sentry.

The other companies involved in running this service are named here, with what each one actually receives, and this list is generated from the same registry the codebase uses, so a new one cannot be added without appearing here.

Supabase

Receives everything listed above, since it holds both the database and the sign in records. It is where the data is stored. Nothing about the service works without it.

Vercel

Receives the IP address a request arrives from, and location data derived from it. It serves the site, so every request reaches it before it reaches anything else.

Sentry

Receives error and performance events: what broke, where in the code, and how long an operation took. It is how a failure gets noticed and fixed rather than silently affecting people.

Google

Receives the sign in handshake alone, and only if Google is the account chosen to sign in with. It confirms the account belongs to the person signing in, so there is no password here to lose.

GitHub

Receives the sign in handshake alone, and only if GitHub is the account chosen to sign in with. The same job as Google, for people who would rather use their GitHub account.

Adzuna

Receives the search terms a user types (a title and or a location). It is the job board this app searches against, so a search has to reach it to answer anything.

OpenAI

Receives nothing yet. It is configured for a scoring feature this app has not built yet, so nothing reaches it in the meantime.

Google (Gemini API)

Receives nothing yet. It is configured for that same not yet built feature, on a second, different vendor, so nothing reaches it in the meantime either.

Sentry deserves a sentence of its own, because error reporting is the usual way personal data leaks into a third party without anybody deciding it should. It is switched off here on purpose: no user identity is attached to an event, no request body is collected, which is where profiles and resumes travel, and no cookies are sent. A change that made any of that false fails the test suite, so this sentence cannot go stale in silence.

Some things are worth stating as plain negatives rather than leaving to be inferred from what is above.

• Your data is not sold, and never has been.
• It is not used for advertising, and there is no advertising on this service.
• It is not shared with data brokers or any other party beyond the companies named above.
• It is not used to train machine learning models, by anyone.
• It is not read for any purpose other than running this service for you.

Signing in with Google gives this service your email address, the display name on that account, and the address of its picture. Nothing more is requested: no access to your mail, your files, your calendar or your contacts.

That data is used for one thing, which is knowing which account you are so your own profile comes back when you return. It is stored in the sign in records held by Supabase, described above, and it is shared with nobody. It is removed along with everything else when you ask for your account to be deleted.

Three cookies are set while you use this service, and each one is strictly necessary: none of them are used to follow you, and none of them mean anything to any other website.

The first keeps you signed in as you move between pages. Without it, signing in would not survive a single click.

The second exists only for the few seconds it takes to hand you off to Google or GitHub to sign in, and is gone again the moment that finishes. It is part of how that handoff is done safely.

The third exists only if you followed a link to a page that needs signing in while you were signed out. It remembers where you were headed, for a few minutes at most, so signing in returns you there instead of somewhere generic, and it is removed the moment it has done that job.

There is no analytics, no tracking, no advertising pixel, and no third party script on any page of this service. That is not a promise about intentions, it is a test: adding an analytics package or a script tag from another origin fails the build.

There is no fixed retention period. What you enter is kept for as long as you want it kept, and it is removed when you ask for it to be removed.

Accounts that go quiet are not deleted automatically. Somebody who stops looking for work for a year and comes back should find their profile where they left it, so nothing here expires on its own. The other side of that is worth saying plainly: if you want your data gone, you have to ask, because time alone will not do it.

Write to the address below and ask, from the email address you signed in with, and your account record is removed by hand.

Removing that record removes everything: the profile, the skills, the work history, every saved version of your resume, the preferences, every application and every answer you wrote all fall with it, because each is tied to the account record and the database is built to delete them alongside it. Nothing is kept back, anonymised and retained, or archived somewhere else.

Two honest caveats. This is done by a person reading mail rather than by a button you press, so it takes as long as it takes somebody to read it, and there is no way to do it yourself yet. And error reports already sent to Sentry cannot be pulled back, though they carry nothing that identifies you, which is why they are safe to leave.

If you are in the United Kingdom or the European Economic Area, the law gives you the following rights over your data. Every one of them is exercised the same way, by writing to the address below from the email address you signed in with.

• Access: ask for a copy of everything held about you, and it is sent to you.
• Correction: tell us anything that is wrong, and it is fixed. Most of it you can also edit yourself once you are signed in.
• Deletion: ask for your account to be removed, as described above.
• Portability: ask for your data in a machine readable file, and it is sent to you in one.
• Objection: object to processing based on legitimate interest, which here means the error monitoring.
• Restriction: ask for processing to be paused while a dispute about accuracy or lawfulness is worked out.

None of these costs anything, and using one is never a reason to treat your account differently. If you think your data has been handled wrongly, you can also complain to your national data protection authority, which in the United Kingdom is the Information Commissioner's Office.

The person responsible for this service lives in the United States, and the companies named above run infrastructure in several countries, so data about somebody in the United Kingdom or the European Economic Area is processed outside it. That is a transfer, and you should know it is happening.

One thing worth naming rather than glossing over: no representative has been appointed in the European Union or the United Kingdom. A larger operation would be required to appoint one. This is a free project run by one person, and that gap is a knowing choice rather than an oversight, recorded here so you can weigh it.

This notice is updated in place when it needs to change, and the effective date at the top is moved when the change is a real one rather than a wording fix. There is no mailing list to announce it on, because this service sends no email.

So the version published here is the version that applies, and continuing to use the service after a change means the current version is the one you are accepting. If a change matters to you and you would rather leave, the deletion route above is how you go.

Every request above goes to the same place, and a person reads it: contact@usejobhunt.dev.