Privacy

• No account is needed to search, read employer pages or use the calendar and feeds.
• We run no advertising, no analytics trackers and no third-party scripts.
• If you pick light or dark mode, the choice is kept in your own browser (local storage, key atlas-theme). It never reaches us.
• Like any website, our hosting provider handles your IP address to deliver pages and protect against abuse.

We store:

• your email address, which is how you sign in (we email a one-time code);
• if you sign in with Google instead, the name, email address and profile picture link Google shares with us;
• what you save: roles, employers you follow, applications you track (including any notes you type), and your alert settings;
• a record of the alert emails we have sent you, so we do not send one twice;
• your active sign-in sessions, with the IP address and browser they were started from, so you stay signed in and we can spot misuse.

Sign-in codes are stored only as a hash and expire after five minutes. To slow down abuse we count recent sign-in attempts per IP address for a minute at a time.

We set cookies only when you sign in: a session cookie that keeps you signed in, and the short-lived cookies the sign-in process needs. They are strictly necessary for the account to work, so we do not ask for consent to them, and there are no tracking or advertising cookies at all.

The CV checker and builder run entirely in your browser. Your CV file is read on your device and is never uploaded to us.

We email you only sign-in codes and the alerts you set up. Every alert email has an unsubscribe link that works without signing in. We never sell or share your address.

• Vercel hosts the website.
• Neon hosts the database.
• Resend delivers our emails.

Each acts only on our instructions. If you send a takedown or correction request, we keep what you send, including your email address, to deal with it.

• Your account, saved roles, follows, tracker and alerts: to provide the service you signed up for (UK GDPR Article 6(1)(b)). Kept until you delete them or your account; deleting your account deletes all of it at once.
• Sign-in codes: to let you in (Article 6(1)(b)). Only a hash is stored, and each code expires within minutes.
• Records of the alert emails we sent: so we never send the same alert twice (Article 6(1)(b)). Deleted with your account.
• Takedown and correction requests: to keep our listings accurate and respect employers’ wishes (our legitimate interests, Article 6(1)(f)). Kept while we deal with the request.
• Rate-limit counters (a network address or a scrambled form of an email, and a count): to stop abuse of sign-in, your account actions and the takedown form (Article 6(1)(f)). Email addresses are never stored in them, only a one-way hash. Each counts for an hour at most and is deleted automatically after that, usually within two hours.

How long takedown requests are kept once dealt with: to be set by the operator before launch.

You can ask for a copy of your data, for it to be corrected, or for your account and everything linked to it to be deleted. Unfollowing, unsaving and deleting alerts remove those records straight away.

Data controller and contact address: to be added by the operator before launch. ICO registration number: to be added.

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.