How your data is held

The application runs on Vercel. Your profile data, sign-in, and uploaded files live in a managed Postgres database and file storage on Supabase. Product analytics run server-side on PostHog, hosted in the EU, with no cookies and no tracking script on public pages. Transactional email goes through Resend, and an AI provider generates answers and import proposals. That is the whole list of companies your data touches; the privacy policy says what each one receives and why.

Traffic is HTTPS only, and production sends a strict-transport-security header so browsers refuse to fall back. Every response carries a content security policy, a no-sniff header, a referrer policy, and a permissions policy that switches off camera, microphone, and location. Sign-in cookies are HTTP-only, so page scripts cannot read them. Storage encryption is what the platforms provide for managed Postgres and object storage — no additional layer is added on top, and none is claimed. Uploaded files are private by default: they sit in a non-public bucket and are reached only through short-lived signed links.

Every table holding your content carries a rule, enforced by the database itself, saying which rows you may read and write — row-level security. The application queries the database as you, not as an administrator, so a mistake in a page cannot widen what a query returns. The few operations that need more authority are individual database functions with one job each (record an attestation, stamp a credential verification), not a master key handed to the application; the administrative key exists, stays on the server, and is used rarely. The same rules bound the AI: retrieval runs inside the visitor's permissions, which is why an answer cannot cite something the reader is not allowed to see. Public questions are rate-limited and logged, and the candidate can read that log.

Your content stays until you delete it or delete your account. From the dashboard you can export everything as JSON in one request — profile, sections, claims, evidence links, uploads and their extracted text, including the derived text the retrieval layer reads, so nothing about what the AI can see is hidden from you. Account deletion is self-serve and immediate: uploaded files are removed first, then the account and every record it owns, and a deletion request goes to the analytics processor. There is no retention grace period to wait out and no email you have to send.

Do not open a public issue. Email [email protected] with the impact, the steps to reproduce, the affected URLs or records, and any proof-of-concept data reduced to the smallest sample that shows the problem. A person reads every report and replies; this is a one-person beta, so expect days rather than hours. Two classes get dropped-everything priority: one account's data reachable by another, and private or recruiter-only evidence appearing in a public answer. Dependency patches come before feature work, and only the current production deployment is supported.

Content that breaks the rules rather than the software goes through report a problem, which reaches the same person by a different door.