This policy explains what [Legal entity name] (“Jobly”, “we”) collects when you use our job search service, why we collect it, and who we share it with. We have tried to write it plainly rather than defensively.
Information we collect
Account information. We use Google or GitHub for sign-in. When you sign in, we receive your email address, name, and profile picture from that provider. We never see or store your password.
Profile information you give us. Skills, years of experience, current title, seniority, preferred locations, work types, departments, salary expectations, relocation preference, and any links you add (LinkedIn, GitHub, portfolio, phone number). If you choose to answer, also the main country you are looking for work in and whether you need visa sponsorship there. We use that to match you with suitable roles. To suggest a country during sign-up we look at the country your connection appears to come from; that guess is shown to you to confirm and is not stored.
Resumes. If you upload a resume, we store the file, the text extracted from it, and the skills and experience we parse out of that text. Resumes typically contain personal information such as your name, contact details, employment history, and education.
Profile imports. During onboarding you can choose to import your background. If you paste a summary written by an AI assistant (such as ChatGPT, Claude or Gemini), we send that text to our AI provider to turn it into profile fields, then discard it. If you give us a GitHub username, we read that account's public profile and public repositories from GitHub. If you upload a LinkedIn data export, it is read in your browser and only your positions, education and skills are sent to us. In each case we keep the structured result (for example your title, skills and highlights) and nothing is added to your profile until you review it and finish onboarding.
Activity on the service. Jobs you save, dismiss, or mark as applied; application status and notes; cover letters you write or generate; and your conversations with the AI assistant, including every message you send it.
Technical information. IP address, browser and device information, and error diagnostics. We use these for security, abuse prevention, rate limiting, and debugging.
How we use your information
- To operate your account and keep you signed in.
- To match you to job listings and generate recommendations.
- To answer your questions through the AI assistant.
- To parse your resume into structured skills and experience.
- To prevent abuse, rate limit requests, and block automated traffic.
- To diagnose errors and improve the service.
We do not sell your personal information. We do not share your resume or profile with employers. Applying to a job takes you to the employer's own site, and anything you submit there is governed by their privacy policy, not ours.
AI processing
The AI assistant is central to how this service works, so it is worth being specific about what that involves.
When you chat with the assistant, your messages are sent to OpenRouter, which forwards them to a model provider (such as OpenAI, Anthropic, or Google) to generate a response. Depending on your question, the assistant may also include your profile and the text of your uploaded resume in that request so it can give relevant answers. If the assistant needs current information it does not have, it sends a search query — composed from your question — to a web search provider.
This means your resume content and chat messages leave our systems and are processed by these providers under their own terms. We do not control how they train their models. If you would prefer your resume not be used this way, do not upload one — the rest of the service works without it.
Who we share data with
We use the following service providers. Each receives only what it needs to perform its function.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | United States |
| OpenRouter | Routes AI requests to model providers (OpenAI, Anthropic, Google) | United States |
| Exa | Web search results used by the AI assistant | United States |
| Upstash | Rate limiting and caching | United States |
| Sentry | Error and performance monitoring | United States |
| Cloudflare | Bot protection (Turnstile) | United States |
| Google, GitHub | Sign-in providers | United States |
We may also disclose information if legally required to, or to protect the rights and safety of our users.
Job listings
Job listings on this service are collected from publicly available company career pages and applicant tracking systems. They are informational, may be out of date, and may contain errors. We are not affiliated with the companies listed, and a listing here is not an endorsement or a guarantee that a role is still open.
Retention
We keep your account data for as long as your account exists. If you delete your account, we delete your profile, resumes, applications, and conversations. Backups and error logs may retain some information for a limited period after that. Aggregated data that cannot identify you may be kept indefinitely.
Your rights
You can view and edit your profile and delete your resumes at any time from your settings. To request a copy of your data or deletion of your account, email us at [privacy@yourdomain.com].
Depending on where you live, you may have additional rights — such as access, correction, deletion, portability, or objecting to certain processing. Contact us and we will honor any right that applies to you.
Security
Data is encrypted in transit and at rest. Access to production data is limited. Sign-in is handled by Google and GitHub, and you can enable two-factor authentication in your security settings. No service can promise perfect security, and we will not pretend otherwise.
Cookies
We use cookies and similar local storage strictly to keep you signed in, remember your preferences, and protect against automated abuse. We do not use advertising cookies and we do not track you across other websites.
Strictly necessary. Your sign-in session is held in your browser's local storage. The product cannot work without it, so it is not offered as a choice.
Optional: session replay. With your permission we record a masked replay of a small sample of sessions through our error-monitoring provider, so we can reproduce a bug rather than guess at it. Text and form inputs are masked before the recording leaves your browser, and media is blocked. This is off unless you allow it, and you can change your mind at any time from “Cookie preferences” in the footer.
Error and performance reports are sent whichever you choose. They contain no personal data — no request bodies, headers, or IP addresses — and without them a crash on your account would never reach us.
Children
This service is not intended for anyone under 16, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
Beta service
Jobly is currently in beta. Features change frequently, and occasional bugs are likely. We will tell you before making a material change to how we handle your data.
Changes to this policy
If we update this policy we will change the date at the top of this page, and for significant changes we will notify you in the app or by email.
Contact
Questions about this policy or your data: [privacy@yourdomain.com].