Privacy

You can use most of it without telling us anything

Searching, filtering, reading a posting and following it through to the employer all work with no account and no sign-in. Nothing is written about you until you do something that needs to be remembered — saving a job, saving a search, tracking an application, or uploading a document. At that point the browser is issued an anonymous identifier so those things can be yours; it is not linked to a name or an address unless you create an account.

We do not create that identifier just because you visited. A page view leaves nothing behind.

What is stored, and when

Without an account, once you act: an anonymous identifier for this browser; the jobs you save or hide; the searches you save; which postings you have opened and how many times; applications you choose to track, with their status, your notes and the dates you set; documents you upload and the structured reading of them; and anything you enter in your profile.

With an account: your email address and a one-way hash of your password. The password itself is never stored and cannot be recovered from the hash — a reset sets a new one. Signing in on a browser that had been used anonymously moves that browser’s saved work onto your account.

Your profile, if you fill it in: the roles and skills you are looking for, seniority, years of experience, contract types, pay expectations, the countries you are in, want to work in, or may already work in, whether you need visa sponsorship, and industries you want or want to avoid. Every field is optional and the product works with all of them empty.

Usage: a small set of named events — the app being opened, a list being viewed, which postings appeared, and the actions above. There is no behavioural profiling and no data is sold or shared for advertising.

Server logs: the web server records each request with its IP address, path, status and user agent, as any web server does. Those logs are kept for seven days and then deleted. They are read only in aggregate, to see which pages are used and roughly where visitors are. Rate limiting uses a deliberately coarsened form of the address — the last part is discarded, so it identifies a network rather than a device — and that coarsened value is never written down.

Cookies, all four of them

There are no advertising cookies, no third-party cookies, and no consent banner, because there is nothing to consent to beyond what makes the site work.

• Three session cookies, set only once you sign in or take an action that needs an identity. They hold access and refresh credentials and the browser’s installation identifier. They are HttpOnly and Secure, so no script on the page can read them, and they last as long as the session does — up to ninety days.
• One preference cookie recording whether you chose the light or dark theme. It holds one word and lasts a year. Leaving the theme on “Auto” stores nothing.

Nothing on the page loads from another company. The typeface is served from this site rather than from a font provider, and there is no analytics script, tag manager or tracking pixel anywhere in it.

Who else sees it

Five suppliers, each doing one job and each receiving only what that job needs:

• DigitalOcean hosts the service and stores uploaded documents and database backups, in Amsterdam.
• OpenAI receives the text of a document and of a job posting, and only at the moment you ask for something to be generated — reading a resume into fields, tailoring it to a posting, drafting a cover letter, suggesting a summary or keywords. Nothing is sent unless you press the control that sends it.
• Stripe handles payment if you subscribe. Card details are entered on Stripe’s own page and never reach us; they receive your email address so they can send you a receipt, and we keep only their identifiers for your customer and subscription plus its status and renewal date.
• Google (Gmail) delivers the one kind of email this service sends: a password reset. There are no newsletters and no marketing email.
• Let’s Encrypt issues the certificate that encrypts the connection.

Country-level location in our own usage reports comes from an offline database (DB-IP Lite, CC BY 4.0). No address is sent anywhere to resolve it.

How long it is kept

• Server logs: seven days.
• Everything tied to your account or your browser’s identifier: for as long as you keep it, or until you delete it.
• Job postings themselves are not personal data — they are public listings, kept while they are open and for a period afterwards so a link you saved does not simply vanish.

What you can do

Everything the product holds about you is visible in it: your saved jobs, saved searches, applications, documents and profile are each on their own screen and each can be changed or removed there.

Deleting your account is on the account page. It releases your email address so it can be used again, clears your password, and ends every session on every device immediately.

One limit worth stating plainly: deleting your account does not yet remove documents you uploaded or applications you tracked. Those are kept, no longer reachable by anyone signing in. If you want them removed as well, write to privacy@jobee.pro and we will do it by hand. We would rather say this than claim a deletion that does not happen.

If you are in the UK or the EU you have rights of access, correction, erasure, restriction, objection and portability. There is no automated export yet; the address above is how to ask.

Children

This is a job-search service for people old enough to work. It is not intended for children and we do not knowingly keep information about them.

Changes

If this page changes, the date at the top changes with it. A change that affects what is collected or who sees it will be flagged in the product rather than only here.

Getting in touch

privacy@jobee.pro. If you found us in your server logs because our crawler read your job board, that page is the one you want.