Privacy Policy — jobhunt

What we collect

Account details. A username, an email address, and a password (stored only as a salted scrypt hash — we never store your plaintext password). Your email is used for registration, email verification, password reset, and transactional account notices such as an eligible subscription-renewal reminder.
Job-search content you provide. Resumes you upload, the profile and interview answers you build with Coach, job descriptions you paste or link, application status, notes, referrals, and next steps.
Generated artifacts. The tailored résumés, cover letters, fit analyses, and interview-prep materials Coach produces, including the compiled PDFs.
Feedback attachments and selected chat logs. A feedback report may include images, PDFs, and only the chat messages you explicitly select. For selected chat messages, we store the visible role and text, not private activity data.
Optional voice input. If you choose to dictate, the audio you record is sent for transcription (see Voice transcription below).
Usage records. We record per-account language-model token usage for cost accounting and abuse prevention.
Aggregate site analytics. The public pages (the landing page and blog — not the app) load Cloudflare Web Analytics, a cookieless page-view counter with no cross-site tracking and no persistent identifiers; it provides aggregate page, path, and referrer reporting. Separately, our edge records route class, path without the query string, country, a coarse browser-family or bot bucket, and response status for traffic monitoring. Known private resource-ID segments in that edge path are replaced with :id; public blog article and article-link slugs remain so we can compare aggregate content traffic. The edge record deliberately leaves its referrer field blank and does not include referrer hosts or URLs, full request URLs, query strings, IP addresses, cookies, persistent identifiers, full user-agent strings, or a separate Coach account-ID field. We do not perform a person-level join between these traffic records and Coach accounts.
First-party campaign attribution. When a public-page URL contains named campaign parameters (source, medium, campaign, or landing variant), we keep only those bounded values in first-party browser storage for up to 30 days. If you join the waitlist or register, that first-touch metadata is stored with the signup so we can compare aggregate acquisition channels. We do not fingerprint your browser, use an advertising pixel, or track you across sites.
Display preference. If you choose light or dark mode on a public page, that choice remains only in your browser until you change it or clear your browser storage. The theme preference is not sent to us or linked to an account.
First-party landing engagement. On the main landing page, we assign a bounded whole-page variant in a first-party cookie for up to 30 days and send one small event when the page is left. It records the named sections reached, visible time on the page, and whether a named CTA was clicked. The event does not contain free text or PII, does not store your IP address, and is not linked to an account. If you later register, the separately stored first-touch variant lets us compare aggregate signup and current-paid cohorts; it does not join an anonymous page view back to a named person. Experiment reporting includes only accounts whose first-touch record names the current experiment version; older or missing first-touch variants remain stored but are excluded from that comparison. These aggregate event rows currently have no automatic deletion schedule; the operator can delete them from the application database.

We do not run advertising trackers, we do not use analytics that identify or profile you across sites, and we do not sell your data.

Where your data is stored

Your account, job-search content, generated artifacts, feedback, and feedback uploads are stored server-side on infrastructure the operator controls. The application database, generated PDFs, and uploaded feedback files live on a hosted server volume. Database snapshots are kept for disaster recovery; local snapshots can be plaintext, while off-site database backups can be encrypted when backup encryption is configured. Stored data stays on our servers except where it is transmitted to the specific third-party processors described below to perform a function you requested.

Feedback review, retention, and deletion

Feedback reports, attached images and PDFs, and attached chat excerpts can be viewed by authenticated operators/admins to understand and triage the report. They are not available for other ordinary users to browse. Submitting a feedback attachment does not, by itself, send that file or selected chat log to a language-model provider, and we do not forward it to one solely because it was attached to feedback. If you separately provide the same material to a model-powered feature, the language-model processing rules below apply to that separate use.

We currently keep feedback and its attachments with your account until you delete the account or ask us to delete a particular feedback submission; there is no shorter automatic retention window for feedback. Account deletion removes the feedback and selected chat excerpts from the live application database and makes a best-effort attempt to remove uploaded feedback files from the live server volume. You can request deletion of one report and its attachments without deleting your account by emailing hello@jobhunt.coach.

Feedback text and selected chat excerpts are database records and can appear in database backups. The backup process attempts to keep seven local daily database snapshots and delete off-site database backups older than 30 days. That cleanup is best-effort, so a backup copy may persist longer if rotation or remote deletion fails. Uploaded image and PDF bytes are not included in those backups; the current restore process recovers their database metadata but not the uploaded files themselves.

Configurable hosted AI providers

Coach does not run every model locally. Its AI roles are independently configurable and call hosted third-party APIs. At this policy’s July 11, 2026 update, the committed baseline uses models from Anthropic, OpenAI, Google Gemini, and NeuralWatt across primary and fallback roles. The app also supports configured API routes from Cerebras, OpenRouter, Synthetic, Lilac, DeepSeek, and Z.AI. Support does not mean every provider receives every request.

The operator can change a role’s provider or model, including through an admin override, without a product-code change. The provider that handles a request therefore depends on the feature, current configuration, and availability. If a primary provider fails and a provider fallback is configured, the fallback can receive the same task context. Some hosted models are proprietary frontier models and others may be open-weight models served by a third party; either way, processing occurs on external provider infrastructure.

Text generation

The interview, ordinary Coach chat, profile composition and audit, fit analysis, résumé and cover-letter authoring, interview prep, suggestion chips, and factual validation use hosted text models. Depending on the task, a request can include chat messages and retained conversation context; résumé and profile content; source-document text; job descriptions and application context such as notes or status; your instructions; generated drafts; and the prompts and tool definitions needed to perform the task.

Contact information may be part of that task context. A résumé, profile, chat, or generated document may contain your name, email address, phone number, location, and links. Coach does not add the account password collected for sign-in or full payment-card details to model requests. The password is handled only as a salted hash by the app, and full card details are collected by Stripe rather than Coach. Text you deliberately enter into an AI feature becomes task context, so do not paste passwords, payment-card details, or other secrets there.

Image and vision processing

If you attach an image in chat, its bytes are sent to the configured vision provider to transcribe visible text. A generated résumé or cover letter can also be rasterized and sent to a vision provider for an automated layout check. If you enable image résumé rendering, the tailored résumé page text — including any contact details it contains — and a bundled visual reference are sent through OpenAI’s Responses and image- generation APIs to render the page; rendered output may then be checked by a model for visible-text fidelity. Ordinary document uploads are text-extracted by the app, but that extracted text can later enter text-model context when you use it in an AI feature.

A file attached only to product feedback is not sent to an AI provider merely because it was attached; the separate feedback rules above continue to apply.

Voice transcription

If you use optional dictation, the audio bytes, filename, and media type are sent to the configured OpenAI-compatible transcription API. The current default is OpenAI’s gpt-4o-transcribe, but the configured compatible provider can change. The returned transcript is then handled like text you typed. If you do not use dictation, no audio is sent for transcription.

Provider data handling and our limits

Model requests and responses are handled under each provider’s own API and privacy terms. Providers may have their own logging, abuse-monitoring, retention, location, and training practices. We do not control those systems, do not promise that every provider offers or is configured for zero data retention, and do not make a blanket promise that provider-submitted data is never used for training.

Deleting your account or asking us to remove data deletes the corresponding live copy under Coach’s control as described below. It cannot recall a request already processed by a provider, and we cannot guarantee that a provider will delete its own logs, caches, backups, or other copies. Questions or requests about provider-held data may be subject to that provider’s controls and terms.

Transactional email

We send transactional email — including account verification links, password-reset links, eligible subscription-renewal reminders, and a one-time question after an observed subscription cancellation — through Resend, an email delivery provider. To send these messages, your email address and the message contents are transmitted to Resend. We do not send marketing email to your account address through this path. (If you joined the public waitlist on the landing page, that is a separate list used only to notify you at launch.)

The cancellation message sets its Reply-To address to the configured support/operator inbox. If you reply, your email provider sends that reply to the operator’s mailbox; the reply is not automatically copied into Coach’s in-app feedback database.

Billing

Paid subscriptions, when enabled, are handled by Stripe. Stripe collects and processes your payment details directly under its own privacy policy; we do not receive or store full card numbers. We retain Stripe customer and subscription identifiers, subscription status, current-period start and end, fixed period amount, currency, and recurrence when safely available, cancellation-at-period-end and cancellation timing, and signed-event ordering fields needed to prevent delayed webhooks from replacing newer billing state. These immutable subscription snapshots support an operator-only inventory and renewal/cancellation cohorts at observed period boundaries; missing, conflicting, or incomplete evidence remains unavailable rather than being inferred. We also retain signed invoice and InvoicePayment identifiers, related PaymentIntent and charge identifiers, and refund identifiers, amount, currency, and status. For a first strictly-positive subscription payment, we also retain the invoice/customer identifiers, exact Stripe paid and event-ordering timestamps, amount/currency, and bounded first-touch acquisition source, plus an operator-account exclusion flag so internal operator payments do not enter customer cohorts, to calculate partial initial-payment customer-acquisition cost from the date collection begins. This prospective evidence also retains complete signed subscription-create and subscription-cycle invoice amount, currency, collection method, invoice period, paid/failure timing, ordering, and conflict fields. It supports an operator-only observed cycle-invoice paid-share diagnostic separate from the boundary-based renewal/cancellation cohorts; an observed payment failure may later be paid after retry. The local user link is removed on account deletion, while the non-profile subscription snapshots, invoice outcomes, and snapshotted operator-account exclusion remain so historical aggregates do not change. This evidence is used to associate refunds with the correct account and produce an operator-only unit-economics readout; it does not include full payment-card details. Deleting your Coach account removes its profile and product data and unlinks the local user id from the retained first-payment acquisition fact, but that non-profile financial/acquisition record remains so historical aggregate economics do not change when an account is deleted. Stripe may retain its own payment and refund records under Stripe’s privacy policy, legal obligations, and retention practices. Billing enforcement and renewal reminders are separately operator-controlled and are not active for all accounts.

Referral and affiliate acquisition

When the operator enables promotional programs, the first valid promotional link captured in a browser can be retained for up to 30 days. If an account is created in that window, the server records one first-touch source and its expiry. A later link does not overwrite it. An hourly local cleanup deletes expired browser captures and unreserved live attribution without waiting for later customer traffic. If checkout was reserved, its attribution and pending checkout records can remain for up to 30 additional days so delayed, signature-verified payment notices can prove a payment made within the original window; this does not extend the time to make a qualifying payment. After that reconciliation period, unresolved records are deleted. Ownerless signed payment and dispute receipts are also kept only in bounded 30-day inboxes. Privacy-minimal ambiguity reviews are deleted after 90 days. Unconverted attribution and pending checkout state are also removed when the account is deleted.

A customer referrer sees only anonymous lifecycle statuses: signed up, pending, earned, paid or credited, or reversed. The referrer does not see the referred person’s identity, plan, invoice, or Stripe identifiers. Customers do not see affiliate names, commissions, tokens, or fulfillment records. Stable referral-link copy is stored encrypted when the program is configured; public lookup uses an irreversible digest rather than a sequential account or link identifier.

A qualifying first payment creates an immutable offer snapshot and append-only reward or commission ledger. Account deletion removes the recoverable link copy and live account links. In other words, live account links are removed, while conversion snapshots and append-only financial ledger evidence are retained in de-identified form for accounting, refunds, disputes, and incident recovery. Stripe retains its own records under its privacy policy. An operator completes any external payout or account credit manually. For a customer referral, the operator can see the referrer account username needed to deliver that reward, but not the referred customer’s identity in the reward-reconciliation view. The app records the completed action but does not move money itself.

Third parties who process your data

Hosted AI providers and routing services — currently configurable among OpenAI, Anthropic, Google Gemini, NeuralWatt, and the other supported providers described above, for text, vision, image-generation, and provider fallback processing.
Transcription provider — only if you use optional voice dictation; the current default is OpenAI’s gpt-4o-transcribe.
Resend — sending verification, password-reset, and eligible subscription-renewal and one-time cancellation-question email.
Stripe — payment processing, when billing is enabled.
Hosting and edge infrastructure — the providers that run the application server, database storage, and the public site/CDN.

Each processor receives only what is needed for its function, and acts under its own privacy terms.

What we promise — and what we don’t

We promise to:

Send your job-search content to third parties only to perform a function you asked for (generation, transcription, email, billing), as described above.
Explain the categories of content that hosted AI features can send and distinguish text, image and vision, and optional voice processing.
Store your password only as a salted hash and never sell your data.
Delete the corresponding live application data on request; existing database snapshots age out through the backup rotation described below.

We do not promise:

That any third-party processor’s practices match ours — their handling is governed by their own terms.
Uniform provider retention, training, processing-location, or deletion controls, or deletion of a request after a provider has already processed it.
That generated documents are accurate or complete; Coach is built to avoid inventing claims, but you are responsible for reviewing anything you send to an employer.
That the service is free of bugs, downtime, or data loss beyond what reasonable backups protect against.

Your choices and data deletion

You can clear your chat transcript and reset your data from within the app. To request export, deletion of a particular feedback submission, or full deletion of your account and its data, email hello@jobhunt.coach. Account deletion is also available in the app. We remove the corresponding live application data under our control; existing database snapshots are not rewritten and instead age out through the best-effort backup rotation described above. Copies already transmitted to a processor (for example, an email already delivered by Resend or a payment record held by Stripe) are subject to that processor’s retention.

Changes to this policy

If we change how data is handled, we will update this page and its effective date. Material changes that affect what is collected or who processes it will be reflected here before they take effect.

Contact

Questions about this policy or your data: hello@jobhunt.coach.