Privacy and your data

Where your data lives, what goes to OpenRouter, Apollo, Brave, Wikidata, Google, GitHub, Stripe and Cloudflare, what careerbot.dev's operators see, how long things are kept, and how to get a copy or have it deleted.

What you give CareerBot is used only for your own job search. It isn't sold, used for advertising, or shared with employers.

Your workspace

Everything belongs to a workspace: your stories, record, goals, directions and limits, companies, roles, pursuits, resumes, letters, notes and the people you choose to contact, along with your keys, budgets and spending. Each person who signs in has a workspace of their own, and nothing in one workspace is visible from another.

CareerBot also keeps the cost of each paid step, so your budgets and Reports work.

Your own keys

Every paid service can run on your own account: OpenRouter for AI, Apollo for company search, and Brave Search if you add it. On careerbot.dev, a plan that includes AI runs it on CareerBot's own OpenRouter account instead, within the plan's allowance. Keys are stored encrypted and used only to make calls for you. A new key is checked with its service before it's saved. Removing a key in Settings, under Keys, deletes it from your workspace.

What goes where

OpenRouter and the AI models

To read, rank and write for you, CareerBot sends the needed parts of your stories, record, goals and job postings to the models you choose, through OpenRouter, on your key or, on a plan that includes AI, CareerBot's. OpenRouter and the model provider handle it under their own terms.

Apollo and Brave

Search terms only: company names and websites, industries, titles. Your stories and record aren't sent to them. An email address is revealed through Apollo only for a person you choose.

Wikidata

Only the company name you type when looking up a company you like, sent from CareerBot's server. Nothing about you or your account goes with it. It's free.

Google

Your name and email when you sign in with Google. If you connect Google Drive, CareerBot can see only the files it creates and the folder you pick for them, nothing else in your Drive. Disconnecting stops syncing; the files stay yours.

GitHub

Your name and email when you sign in with GitHub. If you connect GitHub, CareerBot reads only the repositories you choose, read-only. Files that look secret (environment files, keys and certificates) are never fetched, and keys, tokens and passwords found in what is read are replaced with [redacted] before anything goes to an AI model.

Stripe (careerbot.dev)

When you choose a paid plan or buy more AI: your email, the plan and a reference to your workspace. You enter your card on Stripe's own page, so CareerBot never sees it. CareerBot keeps your Stripe customer and subscription references, your plan, whether it's paid up, when the period ends, and each payment's amount with Stripe's fee. careerbot.dev's plans have no free trial; if one ever does, it's kept as a scrambled one-way copy of your sign-in email and account id, never the email or id itself, so the same email or Google or GitHub account gets one trial; it stays after your account is deleted.

Cloudflare Email (careerbot.dev)

CareerBot's emails go out through Cloudflare's Email Service, which gets your address and the message: an invitation; a welcome after your first sign-in; that this month's AI allowance is used up (at most once a month); a payment that didn't go through, and when it then did; your plan changed or cancelled; notice of a change to the Terms or your plan's price; and that your account was deleted, to the address it had. The waitlist sends one email, when the hosted version opens, with a link that takes you off the list. CareerBot keeps a log of each: to whom, what for, the subject and when.

Your browser

CareerBot keeps you signed in, and saves a story you haven't submitted yet and how you like the sidebar. Signing out clears unsent drafts. Talk uses your browser's own speech recognition, and CareerBot keeps no recordings.

careerbot.dev and a copy you run

On careerbot.dev, the app runs on Cloudflare and its data is stored with Convex, in the United States. The privacy page is the full statement.

careerbot.dev's operators see, in its settings, each person's name and email, when they were last active, their plan and AI allowance, AI spent this month and what they've paid, background work that failed in the last week with its error message, and their own log of changes. Getting started (when each workspace first signed up, chose a plan and paid, and wrote a first story, fact, resume and pursuit) shows them only totals. Nothing you write is shown to them in the app; they can reach the database itself, to keep careerbot.dev running and fix problems.

On careerbot.dev, an export file is deleted an hour after it's made, a waitlist entry is kept until you take yourself off with the link in its email, ask for it to go or delete your account. careerbot.dev backs up its database automatically and keeps backups for a limited time, after which what you delete is gone from them. For help, write to team@careerbot.dev (Getting help).

On a copy you run yourself, everything stays in your own accounts: your own Convex holds the data, and your keys are encrypted with a key that lives only in your deployment's settings. Whoever runs the copy decides what happens to its data. A self-hosted copy has no privacy page of its own and sends no analytics. See Run your own copy.

Once a day a self-hosted copy asks careerbot.dev for the list of releases, to tell its owner when a newer version is out. The request carries no account, personal data or anything about the copy or its people, but like any web request it shows careerbot.dev the IP address of the server the copy runs on. Turn it off with Check for updates in Settings, Updates, or with UPDATE_CHECK=off (Configuration).

Analytics on the public pages

careerbot.dev counts visits to its public pages (the ones you can see without signing in) with Cloudflare Web Analytics, and only while you're signed out. It records the page (without anything after a ? or #), the site you came from, your browser, operating system, type of device and country, and how fast the page loaded. It uses no cookies, stores nothing in your browser, and Cloudflare doesn't keep your IP address.

The signed-in app is never measured. To opt out, turn on Global Privacy Control or Do Not Track in your browser; your visits aren't counted. Copies run by others, and local builds, send nothing.

Getting a copy or deleting it

Settings, Your data exports everything in your workspace as one file you can download. Your keys, connections and password aren't in it.

The same page deletes your account, under Delete account: you type your account's name to confirm, and CareerBot cancels a paid plan's subscription with Stripe at once (no refund for the rest of the period; if Stripe can't be reached, it keeps trying until Stripe confirms), deletes your workspace and everything in it, including stored files and your keys, disconnects Google Drive and GitHub (Google revokes CareerBot's access; CareerBot's GitHub App is uninstalled from your account unless another workspace uses it), then deletes your sign-in and the account itself, and signs you out. The log of emails sent to you, operators' log entries naming your email and, if you had a free trial, its scrambled copy of your sign-in email and account id stay; a paid plan's Stripe subscription and customer references stay until Stripe confirms the cancellation, then 30 days. It can't be undone, so export first if you want a copy. How it works: Deleting your account.

If you can't sign in, email privacy@careerbot.dev to have your account deleted or for a copy of your data.

On your own copy, you hold the data: see Updates, backups and export.

Disconnecting Google Drive or GitHub, or removing a key, takes effect at once. Rejecting a story takes everything that came only from it out of your record. Deleting a story removes the story, its versions and notes, and, as you choose, what came only from it: what's waiting for review goes unless you untick it; approved facts stay, each marked for you to keep or reject, unless you tick them. What you rejected that came only from it is deleted too, with its reasons and notes, whatever you tick.

Edit this page on GitHub