privacy

we do not sell your data

Not to advertisers, not to recruiters, not to schools, not to data brokers, and not as part of an acquisition without telling you first. There is no analytics vendor, no advertising pixel and no third-party tracker on this site. What follows is the specific version of that, written from the database schema rather than from a template.

what we store, and only because something needs it

Every field here exists because a feature reads it. Nothing is collected speculatively.

Your profile — name, school, major, graduation year, GPA, work authorization, target fields and locations, portfolio and GitHub and LinkedIn links — these are the Fit Score's dimensions; anything you leave blank is dropped from the score rather than counted against a listing
Your resume, as structure — contact details, education, experience entries and their bullets, skills, projects, links — the internship score reads your skills, and both generators may assert only what is in here
The resume file name and extracted text — we retain the text and structured details for your profile; the original PDF, Word document, HTML, or image is not retained
Cover letter drafts, one per listing — so a draft survives you closing the tab
Applications you saved or tracked, their status, and any notes you wrote — the tracker
Which deadline reminders we have already sent you — without it the daily job would mail you about the same award every morning
Your saved searches, and when we last emailed you about each one — new-match alerts — the timestamp is what stops an alert repeating what it already sent
Whether the weekly digest is on, and when the last one went out — the digest — the timestamp is the whole of what we remember about it. We do not keep a record of which opportunities any digest contained
Your email address — it is how you sign in — there are no passwords here — and where reminders, alerts and the digest go if you leave them on

what we count, and what we deliberately do not

There is no analytics script on any page here — no Google, no PostHog, no Vercel Analytics, nothing that phones a third party when you load something. We count three things, into a table in our own database, and that table holds no user id, no IP address and no browser fingerprint. It cannot be joined back to a person, because there is nothing in it to join on.

That a filtered search happened — with which filter names were used and whether it returned nothing. What you typed into the search box is never recorded — only that a text term was present
That a listing page was opened — with whether it was an internship or a scholarship. Not which listing
That a GitHub audit ran — with the score it produced. Not the username

Everything else we report — signups, applications tracked, resumes, cover letters — is counted from the tables that already exist because a feature needed them, rather than from a second log of what people did. And the LinkedIn checker and the essay reviewer are counted nowhere: both run entirely in your browser, both pages say so, and adding even a content-free usage ping would put a network call on a page that currently makes none. We would rather not know how often they are used.

resume imports and student verification

Resume files are read on our server. Extracted text and structured details are stored; the original uploaded file is not. Optional AI enrichment sends extracted text to Anthropic only when that feature is enabled. Review imported details before saving your profile. Your onboarding draft stays in this browser for up to seven days.

Student verification stores school-inbox verification, current-enrollment status, its expiry, and discount redemption. University sign-in uses the university’s identity provider; Instela never receives your university password. We retain hashes of the verified school email and university identity after account deletion to prevent the same student discount being claimed on another account.

what leaves our systems, and to whom

Four services, each doing one job. None of them is paid for your data, and none of them receives anything we were not asked to send.

Anthropic — your resume content — resume text is sent only if optional AI enrichment is enabled. Cover letter generation sends the profile and resume facts used to generate that letter
Resend — your email address and the listing titles in that message — for requested student-email verification codes and optional deadline reminders, saved-search alerts, and weekly digests
Supabase — everything above — it is the database and the sign-in provider; the data lives there
GitHub — the username you type into the audit — a request to GitHub's public API necessarily tells GitHub which profile was asked for. Nothing about you is attached to it

what we will never do

Fetch your LinkedIn profile — not by scraper, not through an unofficial API, not by logging in as you. LinkedIn sued Proxycurl over exactly that and it shut down in July 2026. The checker runs entirely in your browser, so the text you paste into it is never sent to us either
Store or infer demographics — race, gender, veteran status and disability are legal declarations on an application form. We do not hold them, do not guess at them, and the application packet leaves those questions for you to answer yourself
Submit an application on your behalf — an application asks things no stored profile answers, and a model answering them would assert things about you that nothing in your resume supports — under your name, to an employer, without you reading it
Take payment details — there is nothing to pay for, so there is no card number here to lose
Sell, rent or share your data with recruiters, schools or brokers — the whole premise of this product is that it works for the student, and an aggregator that sells its users to the other side is not doing that

deleting it

There is a button on your profile. It deletes your profile, every resume and everything parsed out of it, every cover letter, every saved and tracked application with its notes, your reminder history and your login record. It happens immediately, not on a queue, and there is no undo — we keep no backup copy we could restore you from, which is the same fact stated from both directions.

Reminders can be switched off without deleting anything: use the unsubscribe link in any message, or the setting on your profile. The link needs no login, because putting an auth wall in front of an opt-out is how you earn spam reports.

what we cannot promise

No product this size has been through a formal security audit, and this one has not either. What we can tell you is specific: row-level security is on for every user-owned table, the application connects as the table owner and every query is scoped by user id in code, sign-in is a magic link so there is no password of yours to leak, and the service-role key exists in exactly one file that does exactly one thing. That is a description of the design, not a guarantee about the outcome, and we would rather say so than print a badge.