What is held about you
Version 2026-09-10. This is the version your account records having accepted, alongside the terms.
Written by the person who built the service, accurate about what the software does, and not reviewed by a lawyer. Still to come, and named so the gap is not silent: the operator's full name and service address in a legal notice, a signed data processing agreement with OpenAI and a decision on whether they may retain what is sent, a formal record of processing, and a breach procedure. Until those exist, treat this as a truthful description rather than a finished legal document.
Who is responsible
One person, operating from Germany, who also administers the server. There is no company, no data protection officer and no team. The name and a service address belong in a legal notice that does not exist yet; until it does, the contact route is the address you signed up with.
What is held, and why
| Your account | Email address, a scrypt hash of your password (never the password), a display name and handle, your language and time zone, and the version and date of the terms you accepted. Sign-in timestamps. Needed to run the service you asked for. |
|---|---|
| Your CV | The file you upload, the text extracted from it, and the structured facts read out of it — employment history, education, skills and languages, plus a date of birth, citizenship and phone number where your CV carries them. This is the most sensitive thing here, and it is what the whole service works from. |
| What you are looking for | Countries you would move to and countries you would not, your seniority band, how old a posting may be, a home city and a radius around it, and whether you would relocate. |
| Judgements | For every posting in the shared collection, whether it passed your filters and the reason it did not. This is the largest thing held about you by row count — tens of thousands of rows per account — and it is entirely derived from the two rows above. |
| Applications | Which postings you marked as sent, when, the outcome you recorded, and any note you wrote to yourself. |
| Sessions | A hash of your sign-in cookie and its timestamps — not the cookie itself, so a copy of the database cannot be used to sign in as you. No IP address and no access log. |
| Messages sent to you | Which messages about your own account were sent, when, and what the mail provider said about each. Deliberately not a second copy of your address. |
| Sign-up and reset attempts | The network address an attempt came from and which action it was, kept for one hour, to stop someone hammering the sign-up form. No email address is recorded here — the address attempted is the thing being protected, not the thing being limited. |
The lawful bases are: performing the service you asked for (account, CV, preferences, judgements, applications); a legitimate interest in keeping the service standing (sessions, delivery log, rate limits); and your consent where you have given it.
Who else can see it — including the part that is uncomfortable
The operator can read everything. This is one database and one directory tree on one server, with no encryption at rest and no per-account separation on disk. The application itself keeps accounts strictly apart — no page accepts an account identifier, no screen shows one person's CV or decisions to another, and there is no "view as" — but anyone with shell access to the machine reads all of it, and the operator is that person by definition. That is a property of running this cheaply on one box, not an oversight, and you are entitled to know it before you upload a CV.
OpenAI (United States) receives CV text and job-posting text when the service reads a CV, scores a posting or drafts an application. A data processing agreement and a decision on whether they may retain what is sent are still outstanding — the honest state today is that no such call has ever been made by this system, and this paragraph exists before the first one rather than after it.
netcup GmbH (Germany) hosts the server, and the machine is in their Vienna, Austria data centre — inside the EEA. An earlier version of this notice said Nuremberg. That was the plan; Vienna is the machine.
Resend (United States) sends the verification and password-reset messages, and so receives your email address and what those messages say. Their delivery logs and message metadata are held in the United States whichever region mail is dispatched from. An earlier version of this notice promised a provider with data residency in the EU. That promise was not kept, and correcting it is better than quietly dropping it. Mail is the only part of this service that leaves the EEA today.
Backblaze stores the nightly backups, in a bucket in their Amsterdam region. What they hold is encrypted on the server before it is uploaded, with a key that exists only on the operator's own computer and has never been on the server or given to Backblaze — so they store a file they cannot read. This is the only copy of the database that exists off the machine.
Nobody else, and nobody at all while you are browsing. No analytics, no advertising, no error reporting service, and no fonts, scripts or stylesheets loaded from anyone else's server — every page here is served whole from this machine, so browsing the service tells no third party what you are looking at. Employers' pages are linked with the referrer suppressed, so opening a posting does not tell that employer you found it here.
Cookies
One, and it is the sign-in cookie. It is what keeps you signed in and it is not shared with anyone. There is no tracking cookie, so there is nothing to consent to and no banner.
How long
Almost everything is kept until you delete your account, and nothing expires on its own. Said plainly because the opposite is the usual claim: there is no timer that ages out your CV, your preferences, your judgements or your application history. Deleting the account is what removes them.
- Sign-in sessions — at most 30 days, and sooner if you do not come back for 14. Expired rows are checked on every request and swept hourly.
- Sign-up and password-reset attempt records — 1 hour. Every new attempt deletes the expired ones before counting, so the table cannot outlive its own window.
- Your uploaded CV file — deleted when you delete your account, along with everything read out of it. That part is implemented and tested.
- A superseded CV's uploaded file — intended to be deleted some months after you replace it. Still not implemented: replacing your CV supersedes the old version's rows, and the old file stays on the server until you delete your account. Nothing ages it out on a timer, and this notice will not describe a deletion that does not run.
- Backups — fourteen nightly copies, so anything deleted is still in the encrypted backups for about a fortnight afterwards, a deleted account included. The oldest copy is dropped each night as a new one is made, and nothing is ever edited inside a backup — a backup you can reach into and alter is not one.
- Employers' job ads — these are not personal data about you, though your judgements on them are. Old ads are removed from the shared collection when the operator prunes it, at a multiple of the freshness window; it is a command someone runs, not a timer, and this notice will not pretend otherwise. Removing an ad removes your judgements on it with it — except where you applied, because your own application record points at it.
What you can do
You can download everything held about you as one file, at any time, without asking. You can delete your account from the same page — that removes your profile, your CV and everything read out of it, your preferences, your judgements and your applications, and it is not reversible once the grace period ends. It stays in the encrypted nightly backups for about a fortnight after that, and then ages out on its own.
You also have the rights the GDPR gives you against any controller: to see what is held, to correct it, to have it erased, to restrict or object to processing, to take it elsewhere, and to complain to a supervisory authority — in Germany, the authority for the state the operator lives in.
Changes
A change to this notice is a new version, and it carries the same version as the terms. You will be asked to accept the pair the next time you sign in, and what you accepted is recorded against your account with the date.