Privacy

What JobScout processes, and what it never keeps.

This covers the web demo at jobscout.page and the JobScout Android and iOS apps. Same backend, same rules. Effective 18 September 2026.

What you give it, and where it goes

A candidate profile. Either one of the three built-in personas, or text you paste, or a PDF / DOCX / TXT you upload. That text travels over HTTPS to JobScout's API on Cloudflare, which passes it, together with the day's job postings, to Anthropic's Claude API to produce the scores and the cover letter. It is held in memory for the length of that request and not written anywhere by JobScout. Anthropic processes it under its API commercial terms, which by default do not use API inputs to train models.

Your saved answers. Name, email and phone are read from your résumé, inside the request that reads an employer's questions, and kept nowhere. What you type into an employer's question that no résumé settles (where you live, whether you can work there, sponsorship, notice period, years of experience and, only if you type one, a salary expectation) is kept so the next form that asks is already answered. It lives only on your device: your browser's local storage on the web, app-private storage on Android. They leave it only inside the request that reads an employer's screening questions, where they fill the questions they answer; JobScout's API holds them in memory for that request and writes none of them anywhere. Clear beside them deletes them. Questions about gender, race, disability, veteran status or criminal history are never filled, whatever you have typed.

Filling an employer's form. The résumé file you upload is held like its text: in that browser tab only, gone when the tab closes, and in the Android app's memory for the session. When you open an employer's form from JobScout, the Android app fills it inside the app; on a computer, the Fill with JobScout bookmark asks the JobScout tab that opened the form, and that tab hands your answers and files to that one form and to no other page. Nothing in this passes through JobScout's servers. Attaching a file to an employer's form may upload it to their system at once, before you press Submit (Ashby does), so JobScout says so when it attaches one; it becomes an application only when you press Submit, which JobScout never does.

An uploaded file. The file's bytes are converted to plain text in memory and the text is returned to your device for you to review. The file is not stored. Files over 2 MB are refused before they are read.

Saved jobs. Postings you tap Save on, and the stage you set, live only on your device: your browser's local storage on the web, app-private storage on Android and iOS. The job, the company and the link never leave the device. Clear all in Saved jobs deletes them; uninstalling the app does too. The one exception is described next: when you mark what happened with an application, that single word is counted, on its own.

What is counted

JobScout counts which steps people use, because a job tool that is redesigned on the maker's taste rather than on evidence wastes everyone's time. A counted event is one word from this fixed list — nothing else can be written, and the list is enforced in the code:

• open, sample, upload, paste, where, remote — a tab opened, and which of the setup controls were touched.
• run, scored, letter, tailor — the pipeline ran, what band the best match landed in, and whether a cover letter or a tailored résumé was asked for.
• apply, save, outcome — a posting was opened at the employer's site, kept on the shortlist, or marked with what happened: applied, replied, interview, offer or declined.

Each one is stored with the date, the market (Canada or Kenya), the surface (web, Android or iOS), and a random identifier that is minted per browser tab, dies when the tab closes, and exists only so the steps of a single visit can be read in order. On the saved-jobs page the identifier is per browser rather than per tab, because an outcome is marked days after the run that produced it.

What a counted event never contains: your IP address, your résumé or any part of it, a job title, a company, a link, a score, a name, an email, or anything that could distinguish you from anyone else using JobScout that day. It is not shared with anyone, it drives no advertising, and it follows you nowhere else on the web. The list above is the whole of it: if a field is not named there, it is not recorded, and the code that makes that true is public at github.com/kenmwara/jobscout-app.

If you would rather not be counted, browser settings that block sendBeacon, or any content blocker, stop it, and the page works exactly the same.

What the server records to keep the demo up

Three more things, all to keep a free public demo from being abused:

• A salted SHA-256 hash of your IP address, the time, and the token count and cost of each scoring run. The hash enforces a per-hour cap on runs and cannot be turned back into your address. No profile text, no résumé text, no scores are stored with it. It is kept in a separate table from the counted events above, and the two are never joined. Each of these rows is deleted after 90 days, by a daily job.
• A running total of the day's spend, so the demo can stop calling Claude when its daily budget is used up and serve a cached showcase run instead. The cached run is one the operator seeded, not anyone's live input.
• A security event, only when something looks like abuse. If a request is refused by the per-hour cap, presents a wrong secret to one of the operator's own endpoints, or a pasted résumé contains instructions aimed at the AI rather than at an employer (for example "ignore your previous instructions"), the server records what happened, the time, and that request's IP address and country, so an attack can be blocked. The résumé itself is still not stored: the event names which patterns matched, never the text. Ordinary use never produces one. Security events go to the operator's private security log and are deleted after 90 days.

Cloudflare, which hosts the API and this site, keeps its own standard request logs under its privacy policy.

The job postings

The feed is public job postings gathered by JobScout's own pipeline from public job boards and company career pages. It contains no personal data about you. View posting opens the employer's own site in your browser; from there, their privacy policy applies. JobScout never submits an application on your behalf.

Permissions

The Android app asks for one permission: Internet. Uploading a résumé uses the system file picker, so the app never gets access to your files beyond the one you choose. It does not read contacts, location, the camera, or anything else.

Children

JobScout is a job-search tool for adults and is not directed at anyone under 16.

Your choices

• Use a built-in persona instead of your own résumé, and nothing about you reaches the API at all.
• Leave the what happened? box alone on the saved page and no outcome is ever counted.
• Delete saved jobs at any time with Clear all, or by uninstalling.
• Questions or a deletion request: [email protected]. Since no profile text is stored, there is nothing to delete server-side, but ask anyway and you'll get a straight answer.

Changes

If this policy changes, the new version is posted here with a new effective date. The code that makes these claims true is public at github.com/kenmwara/jobscout-app.