Privacy Policy

Who runs this

The operator of Job Tracking Helper is responsible for your data here. For anything about your privacy, write to privacy@saranatour.dev.

What we collect

• Account. Your name, email, username, preferred name, social links and photo. When you sign in with GitHub, it gives us your name and email.
• Job search. What you want from a job, your skills and locations, lowest acceptable pay, whether you need a visa, and answers you save for application forms.
• Resume. The file, its text and its review.
• Applications. Roles, statuses, notes, tasks, goals and the answers prepared for each form.
• Mail and contacts. If you connect your Cloudflare account: its access token, your messages and drafts, and the people you write to.
• Calendar and booking. Your events and attendees. Guests who book through your pages give their name, email and a note.
• Activity. A record of what you changed, what the app did for you and what failed. Summaries can name companies and goals.
• Analytics. Page views, page speed, clicks on links that leave the site and session replays. Separately, our server tells Databuddy when an AI crawler or AI agent requests a page, except booking pages: the path, host, user agent, accept header, referrer and the format asked for. An AI browser acting for you can be counted this way, and browser privacy signals don't stop it, because it doesn't run in your browser.

Some of this is about other people, like your contacts and booking guests. Please only add it if you have the right to.

How we use it

We use your data to run the app for you, keep it secure, fix problems and understand how it's used. We rely on the agreement with you to provide the app, on legitimate interests for security and analytics, and on your consent where we ask for it. We don't sell your data, and we don't use it for advertising.

Who we share it with

Only with the services that make the app work, and only for what's listed here:

• Convex. Hosts the database, backend and files, so it holds everything above.
• Cloudflare. Hosts the website. If you connect your own Cloudflare account, your token, messages and recipients are used there to send and receive mail.
• TypeSafe (the Jev model), through the Convex AI gateway. Your preferences, skills, pay and visa needs, the roles you rated, your saved answers and form questions, goals and workflow text, and your resume text when you press Review. If you allow it, also each email's sender, subject and up to 4,000 characters of its text.
• Google (the Gemini model), through the Convex AI gateway. To draft answers: the job posting, saved answers that aren't personal details, and up to 6,000 characters of your resume. The app tries to remove your email and phone number first, but this is automatic and can miss things, and other personal details stay in. These requests ask the provider not to keep the data. Requests to Jev don't.
• Firecrawl. Search terms from your loops and the posting addresses. When you open a form, also your answers and a link to your resume, so its browser can fill the form in.
• AI agents you connect. If you connect an agent, such as Claude or ChatGPT, its company gets what you allow when you connect it, which can include your preferences, your shortlist, your prepared applications and their answers, your goals, views, loops and workflows, and your contacts. Disconnect one any time under Account.
• context.dev. Search terms and company domains, used to find job boards.
• GitHub. Handles sign-in.
• Databuddy. Analytics and session replays.

When you press Submit on a form, your application goes to that company and the site it uses. Their own privacy policies apply from there. We may also share data if the law requires it. These services may process data outside your country.

Cookies and browser storage

The app keeps a few things in your browser:

• Your sign-in tokens and color theme, in local storage.
• Whether the sidebar is open, in a cookie that lasts 7 days.
• Calendar display settings, in local storage.
• Session and anonymous visitor IDs for analytics, set by Databuddy.

Security

Cloudflare tokens, connection details, mail, contacts and drafts are encrypted with AES-256-GCM, under a key only the server holds. Your resume, saved answers, applications and calendar don't get this extra layer. We try to keep your data safe, but no system is completely secure, so please think about what you store here.

The app is built to skip demographic questions, like gender, race or disability, but it recognizes them by their wording and can miss one, so check each form. It doesn't store job-site passwords.

How long we keep it

• Archived applications move to Trash after 30 days.
• Trash is deleted after the time you choose: 30, 90 (the default), 180 or 365 days, or never.
• Activity records are kept for 90 days.
• Everything else stays until you delete it or your account.

Deleting your account

Delete your account from the Account page. Your profile, resume file, mail, notifications and other records are removed right away or shortly after, in the background. A few things stay:

• An empty account record and your sign-in link with GitHub or your password record.
• Anything in your own Cloudflare account, like the email Worker. You can remove it there.
• Data that providers already received, which their own policies cover.

To have the rest removed, or if something looks left behind, write to privacy@saranatour.dev.

Your rights

Depending on where you live, you can ask to see, correct, delete or get a copy of your data, or object to or limit how we use it. You can withdraw consent at any time. Write to privacy@saranatour.dev and we'll answer within 30 days. You can also complain to your local data protection authority.

Age

The app is for people aged 18 and over. We don't knowingly collect children's data.

Changes

If we change this policy, we'll update the date at the top. For bigger changes, we'll tell you in the app.