Your name and email address, from Google sign-in. The description you wrote of the work you want, and the standard we built from it. Your reactions to roles, meaning star ratings and notes. The roles we delivered to you and the explanations we wrote about them. Your subscription status. The city and state you told us you work from, so we can judge whether a role is within reach. And if you arrived through one of our ads, the campaign labels and the click identifier that ad link carried. That is the whole inventory.
No resume. No employment history, no current employer, no references. No passwords. Sign-in is through Google, so no password of yours ever reaches us. No IP logs, no analytics profiles. You may be searching while employed, and we built this so that a breach of our database would tell someone very little about you.
Everything we hold exists to pick roles for you, explain the picks, and sharpen your standard when you react. Job postings, your standard, the city and state you gave us, and the notes you write on roles are sent to OpenAI to produce each score and its evidence, and to apply the changes you ask for. Your name and email are not part of what is sent. We do not sell your information or share it with employers. Nothing about your use of the product is disclosed to anyone, including employers whose roles you are shown.
Your daily roles arrive by email, on by default and switchable off on your Account page. If your trial lapses we send a short series of reminders, with an opt-out that we honor. Receipts and account notices are always sent. Every email includes a working unsubscribe.
Links in the morning email pass through our server so we can record which roles you opened and how you rated them. That signal tunes your matches. No third party is involved.
When you reach us by clicking one of our ads, the link carries labels naming the campaign and, for Google ads, a click identifier that Google attached. We keep those with your visit, and if you sign up they stay with your account. If you then subscribe, our server will report to the ad network that its click led to a subscription, so we know which ads earn their keep. That report will carry the network's own click identifier, the fact of the conversion, and a one-way cryptographic hash of your email address that lets the network match the conversion when the click identifier was lost along the way. The hash cannot be reversed into your address. Nothing else we hold is included. No advertising code runs on our pages and no ad network can see your use of the product. We also keep a bare count of how many visitors click through to the app and reach the sign-in page, as a step name and a timestamp with nothing that identifies anyone.
A sign-in session, and nothing else. No analytics cookies, no advertising cookies, no third-party cookies.
Supabase holds the database and runs sign-in. Cloudflare serves the site and app. Railway runs the matching workers. OpenAI scores postings against your standard. Stripe handles payment as the merchant of record, so your card number never touches our systems. Resend delivers our email, which means it sees your address and the roles we sent you. Job postings come to us from fantastic.jobs. Data flows in from them and nothing about you flows out. Each of these holds only what its job requires.
We keep your data while your account exists. You can delete your account yourself on the Account page, which permanently removes your account, standard, reactions, and sign-in identity. One thing survives. A one-way cryptographic hash of your email address is kept solely so a free trial cannot be repeated by deleting and re-signing up. It cannot be reversed into your address and is used for nothing else.
You can read and change everything we hold about you inside the product. Wherever you live, we honor requests for access, correction, deletion, and a copy of your data. Write to support@handpickedroles.com. The service is for adults and is not directed at children.
Data is encrypted in transit and at rest by the providers above. Database access is enforced per account at the database level, not just in the interface. Administrative access belongs to one person, the founder, behind its own access control, and is used for support and operations only.
If we change this policy in a way that matters, we will tell you by email before it takes effect rather than quietly editing this page.