Privacy Policy

What we collect

• Account data. When you register, we store your email address and — for password sign-in — a salted bcrypt hash of your password (never the plaintext). If you sign in with Google, GitHub, or LinkedIn, we store your verified email and a provider identifier so we can recognise you next time; we do not keep the provider's access tokens.
• Job activity. If you save, view, apply to, or track a job, we store that interaction (the job, timestamps, application stage, and any notes you add) so we can show you your pipeline.
• CV / résumé. If you upload a CV for skill matching or AI fit analysis, we store the file and the text we extract from it. Running an AI fit analysis sends the relevant parts of your CV, together with the job posting, to our language-model provider (see “Third-party services”).
• API keys. If you create a personal API key, we store only a SHA-256 hash of it. The key itself is shown once at creation and is unrecoverable afterwards.
• Technical data. Standard request logs (IP address, user agent, timestamps) and, if you opt in via your browser, cookies. We do not use tracking or advertising profiles.

How we use it

We use your data to run the service: authenticate you, remember your saved and tracked jobs, match jobs to your CV, deliver any digests you subscribe to, and keep the platform secure and working. We do not sell your personal data or use it for third-party advertising.

Cookies

When you sign in, we set a single HttpOnly, SameSite=Lax session cookie holding a signed token. It is strictly necessary for keeping you logged in and cannot be read by JavaScript. Logging out clears it.

Job listings

The jobs we display are aggregated from public company career boards and other public sources. We normalise and deduplicate them; we do not own this content, and a role closes in our catalogue once it disappears from its original source.

Third-party services

We rely on a small set of processors to run freehire:

• A language-model provider — processes CV and job text to produce AI fit analysis, only when you request it.
• Error monitoring (Sentry) — captures application errors to keep the service reliable; configured without personal-data capture.
• OAuth providers (Google, GitHub, LinkedIn) — only if you choose to sign in with them, to verify your identity and email.
• ChatGPT Actions — if you connect freehire to a custom GPT, ChatGPT sends your search and tracking requests (authenticated with your API key) to our API. Your use of ChatGPT is also governed by OpenAI's own privacy policy.

Retention

We keep account and activity data for as long as your account exists. When you delete your account, we delete or anonymise your personal data, except where we must keep it to comply with the law. Request logs are retained for a limited period for security and debugging.

Your rights

You can access, correct, export, or delete your personal data at any time — most of it directly from your account settings, or by contacting us. You can also revoke API keys and unlink sign-in providers. If you are in the EU/EEA or UK, you have the rights granted by the GDPR, including the right to lodge a complaint with a supervisory authority.

Contact

Questions or requests about your data? Reach us at hello@freehire.dev, on Telegram, or via GitHub. As an open-source project, our data handling follows what the source code actually does.