Safety & security / Windows beta & Android alpha
Your information.
Clear boundaries.
Trust starts with knowing what an app actually does. Here’s how CareerSeeker handles your information, checks its own work, and keeps the final decision with you.
This is not a promise that we won’t look at your private data; it’s a cryptographic guarantee that we can’t.
Most apps ask you to trust their promises: “we won’t peek,” “we won’t sell it,” “we take privacy seriously.” Those are policies — decisions a company makes today and could unmake tomorrow. CareerSeeker is built differently: the parts that would let us see your career data were never written into the app in the first place.
That’s the difference between a promise and a guarantee. A promise depends on us staying honest. A guarantee doesn’t depend on us at all — it’s just how the math and the architecture work.
No server that can read your data
There’s no CareerSeeker database anywhere with your resume, your applications, or your history in readable form. The one server we run that touches your career data — the optional phone-updates relay — holds only updates encrypted on your PC, for at most 30 days, plus the connection metadata Privacy lists. A breach, a subpoena, or a leak there gets sealed updates and that metadata — never your records in the clear, because they were never collected in the clear.
No upload path we can read
The Windows app has no code path that sends your career data to us in readable form — we didn’t build one. The only career data it can send to a server we run is the optional phone update: encrypted on your PC with keys we never have, off by default, and sent only after you tick its consent box. Even then our relay sees only sealed updates it can’t read — plus the connection metadata Privacy spells out.
Your keys, your account, not ours
Provider keys and Google tokens are encrypted with your Windows account through Windows’ own DPAPI. We don’t hold a copy and we don’t hold a spare key — if you asked us to unlock them, we couldn’t.
One honest exception: the services you choose to connect can see what you send them. Your AI provider sees the text CareerSeeker sends it when it drafts or checks claims; Google sees your draft content if you connect Gmail. We can’t see any of that — but the providers you pick, can, under their own terms.
01 Local working records
02 Connections you choose
03 You review and send
The data path
Local-first. Connected when you say so.
Your profile, job records, generated documents, and activity history are stored on your Windows PC. Features that use outside services send those services what they need to do their job — here’s the map.
Your Windows PC
Your working records
Profile & preferences
Job records & research
Generated documents
Local activity history
↔
Applicant tracking systems & research sourcesReceive the requests needed to fetch public postings and employer information, including search queries.
Your configured AI providerReceives relevant profile facts, job text, research, generated text, and verification prompts.
Google / Gmail · optionalReceives draft messages and application attachments when you authorize Gmail.
If you pair a phone and turn on Phone updates, a fourth path opens: updates encrypted on your PC go to a relay we run and on to your phone. The relay can’t read them, and Privacy lists exactly what they contain and what the relay can see.
Outside processing follows each provider’s own terms. Local storage doesn’t mean fully offline processing, and it doesn’t mean providers retain nothing.
How the safeguards work
Real protections. Honest limits.
01 / CREDENTIALSA protected local vault
API keys and Google tokens are encrypted with Windows DPAPI, tied to your Windows user account. They never leave your PC through CareerSeeker.
That protection covers stored credentials — it isn’t a claim that every document or database is encrypted.
02 / GENERATED CONTENTA check before every draft
The Fabrication Gate compares generated claims against your profile. A claim it can’t support blocks the draft; if verification is unavailable, the application waits.
Checks can miss errors. Your profile quality and your final review still matter.
03 / EXTERNAL CONTENTUntrusted text stays data
Job descriptions and retrieved pages are treated as data, never as instructions. Postings that look like prompt-injection attempts get quarantined.
These defenses reduce risk; no filter catches every malicious input.
Optional · Android alpha
If you pair a phone.
Phone updates are off until you switch them on from the Windows app’s Pair a phone page, and pairing needs a QR code shown by your Windows app plus a six-digit number both screens have to agree on. What travels afterward is encrypted on your PC with keys that exist only there and on your phone: your phone gets a read-only view of your recent applications, top job matches, and whether your audit trail is intact, and the relay in between holds updates it can’t read. Like any server, it does see connection metadata — a random pairing ID, message sizes, sequence numbers and times, and the network address that connects — and it expires what it holds within 30 days. Privacy lists exactly what is sent and what never is. Unpair and erase in the Android app removes the phone’s copy; your Windows PC stays the only authoritative copy.
The sending boundary
CareerSeeker prepares.
You review and send.
The Windows beta creates Gmail drafts. There is no code in the app that sends email or submits applications — that ability simply isn’t built.
The current Gmail workflow doesn’t read your inbox or touch your contacts.
What the Google permission means
Google’s gmail.compose permission can authorize managing drafts and sending them. CareerSeeker’s draft-only behavior is a safeguard built into the app, not a limit on the permission itself — which is why we tell you about both.
You can disconnect Gmail locally anytime, and revoke access in your Google Account settings.
This website is a separate thing
Signup data is different
from your career workspace.
Tester signup uses your email address and access-code records. Support receives whatever you choose to send us. None of that touches the Windows app’s local profile and documents — they’re separate systems.
The website is served through Cloudflare and includes Cloudflare Web Analytics, so we won’t tell you it has “no analytics.”
Read the website privacy details →More detail, when you want it
Read the full privacy policy for exactly what’s stored and what’s shared. Check the signed release details for the package you’re installing.
If you want to go deeper on a specific claim on this page than we’ve written here, ask us directly — we’d rather answer a specific question than hand you a sentence to take on faith.
These descriptions cover both the Windows beta and the Android alpha — see Privacy for exactly what syncs to a paired phone.
Still have a privacy question?
Get a straight answer before connecting your accounts.