1. Information collected
Email registration collects an email address and password. The server stores a salted password hash, rather than a readable password. Your application includes your name, phone number and calling-code country, country of residence, state or region, LinkedIn profile URL, primary domain, prior platform experience and screening critique, along with review status and account identifiers. You can optionally provide a LinkedIn URL and a PDF resume, including any personal information contained in that file. These optional sources can also be added or updated later from your dashboard. Optional professional information includes job function, industry, seniority, education and work history, preferred hourly rate in USD and weekly availability.
If enabled and selected, Google sign-in supplies a verified email address and a stable Google account identifier. The integration does not request access to Gmail, Google Drive or your contacts. Authentication also processes an IP-based rate-limit key and temporary session/security identifiers.
2. How information is used
Information supports authentication, draft recovery, application review, application-related contact, service security and aggregate platform statistics. This onboarding implementation does not automatically send critiques to an AI model or train a model on them.
3. Storage and service providers
Account and final application records are stored in PostgreSQL. Redis stores drafts, queued submissions, optional profile-source metadata, sessions and aggregate counters. Resume files are stored privately on the API server’s configured persistent storage; the current implementation allows an authenticated user to download their own file. Readable PDFs are processed locally to suggest education and work details in empty profile fields. Suggestions remain editable; extraction is not guaranteed for every layout and no external AI service is used. Authorised reviewers and infrastructure providers may need access to operate the service. Google processes information under its own policy when its sign-in service is loaded or used. Resend processes recipient email addresses and transactional message contents to deliver verification codes, password-reset codes and application confirmation emails. Temporary code digests and limits are held in Redis. Encrypted email events and delivery state are held in PostgreSQL; message payloads are cleared after sending or skipping, while failed payloads remain for operational recovery. Hosting providers may also process connection and operational logs.
4. Retention
With the default configuration, unfinished drafts expire after seven days without a save, login sessions expire after 24 hours, and completed queue jobs expire after seven days. These periods are configurable. Final applications and account records currently have no automatic deletion schedule; failed queue jobs can remain available for investigation. Resume files and optional source metadata currently have no automatic deletion schedule. Uploading a replacement overwrites the active resume file; backups may retain older copies. Backup retention depends on the deployed infrastructure.
5. Your choices and requests
You can use email authentication instead of Google and sign out to revoke your current session. Do not submit sensitive or third-party personal information in free-text answers. This version has no self-service account deletion, export or correction of the core fields of a final submission. Optional LinkedIn and resume details remain editable from the dashboard, and professional information and preferences can be updated in settings. Rights to access, correct, delete or otherwise control information depend on applicable law; their handling requires an identified operator and a published contact channel.