Know what is stored.
Know what is shared.

Updated October 16, 2026 · Covers the Windows beta 0.7.6, the Android alpha 0.1.0-alpha1, and careerseeker.app

1. Your Windows workspace

Your profile, preferences, job records, generated documents, scores, and activity history are stored locally on your PC. Provider API keys and Google tokens stored through the app’s vaults are encrypted with Windows DPAPI, tied to your Windows account.

There is no CareerSeeker-hosted pipeline behind the app — we don’t run a server that processes your applications. That said, local-first doesn’t mean offline: the services you connect receive the data described below. The one CareerSeeker-operated service that carries any of your workspace data is the optional phone-updates relay: it is off by default, and what it carries is encrypted on your PC so the relay cannot read it (section 6).

2. AI providers and research

Depending on which features you enable, your configured AI provider receives relevant profile claims, job descriptions, employer research, generated text, and claim-verification prompts. Requests run on your own provider access. Public applicant tracking systems (ATS) and research services receive the requests needed to discover jobs and research employers.

Each provider’s own terms govern how it processes and retains what it receives — storing your records locally doesn’t make a provider retain nothing. Read your provider’s privacy and billing terms before connecting.

3. Optional Google authorization

With Gmail connected, the beta creates draft messages containing application content and attachments. It does not send email, read your inbox, or access your contacts. One honest nuance: Google’s gmail.compose permission is broader than what CareerSeeker does with it — the permission allows managing drafts and sending, while the app only creates drafts.

CareerSeeker’s application policy commits to Google API Limited Use, and Google user data is not used to train generalized AI models. You can disconnect locally and revoke access in Google Account settings.

4. This website, tester signup, and support

The website is served through Cloudflare and includes a Cloudflare Web Analytics script; Cloudflare documents what that service measures in its collection documentation. We won’t describe this site as having “no analytics.”

When you request beta access, we store your email address, your access code, and timestamps of when codes were issued, sent, and used. These records live in Cloudflare’s key-value storage and are used to provide tester access, including queueing your address for Google tester approval. A rolling signup event log deletes itself after 90 days; the access records themselves are kept while the tester program runs, and removed on request. Your access-code email is sent through Cloudflare’s email service from [email protected].

If you contact support, we receive what you choose to include. Please don’t send API keys, Google tokens, or an unredacted resume — just enough detail to explain the issue.

5. Retention and your controls

You control the Windows workspace. Removing the installed app and deleting its data are separate, deliberate actions: the beta’s deletion command shows you the exact workspace path and requires confirmation before removing anything. Files you exported elsewhere and drafts already in your Google account aren’t touched by it.

Revoke AI provider keys. Use Remove AI provider key on the local dashboard (it deletes the key stored on this PC; the running engine keeps its loaded copy until it next starts), or run CareerSeeker.exe clear-byok from source/an unpacked test tree. Then delete any environment or secrets/env.secrets copies you supplied, and revoke the key at the provider if you want it gone everywhere.

Disconnecting a provider doesn’t erase what that provider already processed — its own retention terms apply. For signup or support data requests, write to [email protected] and we’ll handle it.

6. Phone updates and the Android app

Windows Beta 0.7.3 and later can send updates to the CareerSeeker Android app (alpha 0.1.0-alpha1) on a phone you pair with your PC. Phone updates are optional and off by default: nothing is sent to a phone, even a paired one, until you switch on Phone updates on the Pair a phone page and tick its consent box.

What you consent to is the Pair a phone page’s own words, quoted here exactly as your PC shows them (“this PC” is the PC the page is open on):

Nothing is sent to a phone, even a paired one.

When phone updates are on, each engine cycle sends your paired phone:

• the engine’s totals: postings discovered, drafts created, and similar counts;
• your 25 most recently updated applications: job title, company, status, score, and any outcome you recorded;
• your 25 top-ranked job matches: title, company, and whether a posting looked like a repost or carried injection signals;
• whether this PC’s audit chain is intact, with the type, time and record of the 12 latest audit entries (never their contents).

It never sends job descriptions, your resume or cover letters, your Gmail access, or your AI provider keys. Outcomes you mark on your phone reach this PC only while phone updates are on.

Everything is encrypted on this PC before it leaves, with keys that exist only here and on your phone. It passes through a relay we run on Cloudflare, which stores encrypted updates it cannot read. The relay does see a random pairing ID, message sizes, sequence numbers and times, and the network address that connects. Updates it holds expire within 30 days.

The relay is a Cloudflare Worker with Durable Object storage. There is no account: pairing uses a QR code and a six-digit code you compare on both screens. The Android alpha does not offer outcome marking yet.

The Android app keeps a copy of what your PC sent in its private storage, so you can read it offline. It contains no analytics, advertising, trackers, or crash reporting, and asks for two permissions: Internet, and Camera (used only to scan the pairing code). It sends no push notifications.

Turning phone updates off stops new updates from the next cycle; your phone keeps what it has already received until you unpair it. Unpair and erase in the Android app’s Settings removes the phone’s copy and, when the phone is online, tells the relay to discard the pairing’s channel. Unpair from your PC’s Pair a phone page as well so the PC stops sending; anything still on the relay expires within 30 days.

7. Security and scope

Credential vault protection, generated-claim checks, untrusted-text handling, and the draft-only boundary are explained on Safety & security. None of them is a guarantee of error-free software, and we don’t claim independent certification or a completed security audit.

8. Contact and changes

Privacy: [email protected]
Support: [email protected]

The application is not directed at children under 16. If our data practices materially change, we’ll document the change before the related features ship.