Privacy Policy

This site is operated by Arnav Verma ("we"). We are the controller of the limited personal data described below. Questions and privacy requests go to privacy@getthatrole.com.

Information you enter. Your name and, if you give it, your email address; career preferences such as target title, experience level, location, work mode, salary range, timeline, industries and skills; links you add (LinkedIn, portfolio, GitHub); a resume file or text you import is read once on our server to build your master resume and is not kept; resume photos are not supported and a photo in an imported file is not read; job links or job text you paste; the cover letters and messages the app drafts and you edit; tracker notes; contact details you add for people you plan to reach (name, title, employer, link); practice stories. We use this only to run the features you see. Your master resume and every resume you make or import (contact details, work history, education, skills, notes you attach to an entry, the job and company a resume is for, the posting text you attach, and the earlier versions we keep) are stored in your account on our server so they follow you between devices. Everything else in this list is stored in your browser's local storage. When you open Find Jobs or search for jobs, your target title, skills, experience level and work mode are sent with the request to rank the results and are not kept; Find Jobs opens with roles for your target title near the location in your profile. When you paste a LinkedIn job link, the job title and company named in the link, or in the share text pasted with it, are sent so that we can find that role on the company's job board. The link is not sent with them and we request nothing from LinkedIn; the posting's number becomes part of the address of that job's page in this app. The rest is not transmitted to us.

Information collected automatically. Like any website, our hosting provider (Vercel Inc.) receives your IP address, browser type and the pages you request in order to serve them, and keeps short-lived server logs for security and reliability. On Find Jobs the page's address carries your search (the title, place, filters, page and opened role), so that a reload or a link you share brings the same list back; that address is part of what the hosting provider sees when the page is requested. When Find Jobs opens before you have typed anything and the location in your profile names no place we know, our server reads the hosting provider's estimate of your city, region, country and approximate coordinates from the request (the provider adds them to every request) and sends that estimate to your browser, which matches it to a city in the public city list, shows that city in the where box and uses it for that first list only. The estimate is not stored and is not placed in the page's address; you can change or clear the place at once. If you allow analytics, Vercel Web Analytics records page views and the referring site. It sets no cookies and does not track you across other sites; identifiers are hashed and discarded daily. Paths that would reveal which job you are working on are masked, and anything after "#" in the address is dropped, before they are sent.

Device features you switch on. The mock interview can show your camera picture to you; the video stays on your device and is never recorded, analyzed or uploaded. Dictation uses your browser's own speech recognition, which may send audio to the browser maker (for example Google in Chrome or Apple in Safari) to turn it into text; you can type instead. The interviewer's voice uses your browser's speech synthesis; in Chrome or Edge the question text, which can include the company and role name, may be sent to Google or Microsoft to be read aloud, and you can mute the interviewer to avoid that. The job search can ask the browser for your location to filter and sort roles by distance; the coordinates are rounded to about half a mile and sent with your job searches so our server can apply that filter. They are not stored.

Your account. When you sign in we store your email address, your name when Google or Apple provides it (you can change it on the Profile page), the identifier Google or Apple gives us for your account, which sign-in method you used and when, whether your account is allowed in, on a waitlist or blocked, when that standing last changed and which owner changed it, the time and version of the terms you accepted, and a record of each time you accept the terms (see How long we keep data). Sign-in codes are stored only as hashes; a code works for ten minutes and its record is deleted when it is used, replaced or expires. Google and Apple tell us your verified email address, that identifier and your name; we read nothing else from their replies, keep no access tokens from them and request no other permissions. When we let your account in from the waitlist we send you one email to say so. Our emails show our logo, loaded from our own site; we do not track whether they are opened. Your sessions are stored on our server under a hashed token, and a signed cookie keeps you signed in. To stop abuse, our server counts sign-in requests, code attempts and new accounts per address and per network in our database for up to a day. It also counts recent searches, lookups and link matches per IP address in memory for about ten minutes. It also counts, per account, the PDFs you download in our database for up to an hour, and other resume downloads in memory for about ten minutes. It also counts, per account and for the day under a hashed form of your email address, how many resume imports and other AI-assisted actions you have run and the estimated cost of model use they caused, so that clearing your data or deleting and recreating the account does not reset the day's allowance.

The browser extension. If you install the Get That Role extension, pressing its button (or its keyboard shortcut) reads the job posting on the page you are looking at (its title, company, location, work arrangement, pay, posting date, employment type, closing date, text and link, and the company's website when the page names it) and shows you what it read. On a page listing jobs it reads the listed jobs' links, titles, places and work arrangements for you to pick from, and keeps only the links you pick. On LinkedIn it reads only a job's own page: never a list of jobs, a profile or any other page. "Save link to Get That Role" on a link's right-click menu keeps only that link. It runs only when you press it and only on that page. The extension requests nothing from the job site, never signs in anywhere, and sends nothing to our server.

What you save, and the stage changes, follow-up dates and notes you make in the extension, wait in the extension's own storage on your device (at most 50 items) until a page of this app collects them. Each item is marked with the account whose board the extension holds a copy of when you make it, and is handed only to a page signed in to that account; an item made while it holds no copy goes to the account signed in when a page of this app next collects it. After 14 days an item is no longer handed over, and the extension, which checks once a day, deletes it. Chrome lets only this site's pages reach the extension, and all they can do is see that it is installed, collect what waits, give it the copy described next, or wipe what it keeps; nothing can make it read a page or open one. While you are signed in and a page of this app is open, the app gives the extension a short copy of your board (each saved job's id, title, company, status, when it moved to that stage, when it last changed, whether its materials are ready, follow-up date and a shortened form of its posting's address), your account's id and your skills, so the extension can show which postings you already saved. That copy also stays in the extension's storage on your device. It is wiped when you sign out (or a page of this app finds you signed out) and when another account signs in on this browser, and Clear my data wipes it along with the waiting items. Removing the extension deletes everything it kept.

Before the extension has reached the app, it opens the app in a new tab with the posting in the part of the address after "#", which your browser never sends to a server. The app takes it out of the address bar as soon as it has read it (keeping it in that tab's session storage until you act on it) and adds the posting only when you press Save or Tailor, or when the extension, reached after all, hands the same save over itself. The job's page address in this app is built from the posting (the job board's name and the posting's number, or the posting's own address), and the company's website, when the page names it, is looked up for its logo as described under Our server. Our use of what the extension reads complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

What we do not do. We do not connect to your email: the inbox feature in the tracker is a simulation with sample messages. We do not keep the resume file you import: its text is read once and the file is discarded.

• Your browser. Your jobs, tracker, outreach drafts, contacts and practice stories live in local storage on the device you use; they are not synced between devices and we cannot see them.
• Our server. Receives job titles you search, company names or careers links you add, the job title and company named in a LinkedIn job link you paste or in the share text pasted with it, and postal codes or company domains that need a lookup. It uses them to fetch public information. When you search job titles, and when Find Jobs opens with roles for your target title, it also receives the filters you pick (including a location filter: a city, postal code or rounded coordinates) and, to rank the results, the target title, skills, experience level and work mode from your profile; these are used for that request only. Lookup and search results are cached on the server (postal codes for up to 30 days, company icons and logos for a day, job listings for up to 15 minutes) without any link to you; nothing else is kept. When you import a resume it receives the file or text, reads the text in memory and discards the file. When you attach a posting to a resume it receives the posting's text and keeps it with that resume. Export files (PDF, Word, text and JSON) are built on our server from your saved resume when you ask for one and sent to your browser as a download, never as a page; the file is not stored and no other service receives your resume to make them.
• Our database. A database run by our database hosting provider holds your account record and sessions, and public job listings read from company job boards (title, location, team, link and posting date). A company board you add joins the index so that everyone's searches can include it; the index does not record who added it. It also holds your master resume, every resume you make, their earlier versions, the postings you attach, and counts of your AI-assisted actions.
• Sign-in providers. If you sign in with Google or Apple, that provider handles the sign-in on its own site under its own privacy policy and tells us who you are. Sign-in codes are emailed through our email provider, which sees your address and the code.
• Job board providers. Our server reads public job listings from Greenhouse, Lever, Ashby, Workable and SmartRecruiters, and a posting's description when you open it. Those requests carry the company identifier and the posting's number only, never your data.
• Lookup services. Company icons come from Google's favicon service, company logos from the job boards' own image servers, and postal codes are resolved through Zippopotam. All are called by our server, so your IP address and cookies are not shared with them.
• The AI model provider. When you import a resume, the text of the file or paste, apart from email addresses, phone numbers and links, which are removed in code and put back afterwards, is sent to Anthropic, PBC once to be structured into sections and bullets; every line it returns is checked against your text in code before you see it. Requests carry no email address or account id; the provider can tell that requests come from the same account only through a code we derive from it and cannot turn back into you. It processes requests under its API terms on a tier that does not train on inputs, keeps our fixed instructions in a cache for up to one hour and never your text, and keeps requests for up to 30 days; we never upload files or batches to its storage.
• Sites you choose to open. Links to job postings, employers or LinkedIn open those sites, which have their own privacy practices.

We do not sell personal data, share it for advertising, or use it to train models.

• Running the features you ask for: performance of our terms with you.
• Serving pages, keeping the site secure and keeping you signed in: our legitimate interests.
• Page-view analytics: your consent, which you can withdraw at any time on the Cookies page.
• Camera, microphone and location: your consent, given through your browser's permission prompt.
• Centring the first list of roles on the city your connection suggests, when your profile names no place we know: our legitimate interests; the place is shown and can be changed or cleared at once.

If you store details about a recruiter, hiring manager or other contact, you are responsible for using them lawfully and respectfully. Those details stay in your browser. A references section inside a resume is stored with that resume in your account, printed and exported with it, and never sent to the AI model when we tailor or write for you; when you import a file, its text is sent once as the Resume import section says, with email addresses, phone numbers and links removed; you are responsible for having those people's agreement; Clear my data and deleting a resume remove them. Every contact you add can be removed individually, and Clear my data on your Profile removes everything.

• Data in your browser: until you remove it, using Clear my data on the Profile page or your browser's site-data settings.
• Your resumes: in your account until you delete them, clear your data or delete the account. A deleted resume stays recoverable for 30 days, then is removed with its earlier versions and tailoring records; up to ten earlier versions of a resume are kept until you delete them from its history, and they, like tailored copies and their change records, keep what the resume held when they were made. Clear my data and account deletion remove every document and record above at once; the AI request records and allowances below follow their own periods; the database's restore history keeps an encrypted copy of deleted rows for up to six hours.
• AI request records: counts of your AI-assisted actions with their cost, kept in full for 7 days, then by day for 90 days per account, then as totals with no account for ever; a failed import keeps a short error code and no text.
• Terms acceptance records: three years under a hashed form of your email address, so they survive account deletion and cannot identify you from the database alone.
• Blocked accounts: if we block an account for abuse, its resumes and other studio records are deleted after 30 days and the account after 90 days.
• The browser extension: saves and the changes you make in it wait until the app collects them; after 14 days they are no longer handed over and are deleted by the extension's next daily check. Its copy of your board stays until you sign out, another account signs in, Clear my data wipes it, or you remove the extension.
• Your account: until you delete it (Profile: Delete account, or Remove my account on the waitlist page) or ask us to. Deleting it removes the account, its sessions and its sign-in identifiers; the abuse counters for the address (no account data) expire within a day. Sessions: 30 days after the last visit and never more than 90; sign-out ends one at once. Sign-in codes: usable for ten minutes, stored as hashes, deleted when used, replaced or expired.
• Server logs: kept by our hosting provider for security and reliability. Each request to the Studio and the AI features logs the route, an outcome code, record ids, counts, timing and, for a model call, the model, token counts, cost and the provider's request id; never your text. Logs are kept for 1 day.
• Sign-in attempt counts per address and network: in our database for up to a day. Per-address request counts for searches and lookups: in memory for about ten minutes. PDF download counts per account: in our database for up to an hour.
• Postal-code lookups: cached on our server for up to 30 days; company icons and logos for a day. Neither is linked to you.
• Analytics: aggregated page-view counts only.
• Public job listings: cached on our server for up to 15 minutes, and kept in our job index while the role is open and for a day after it closes.

You can view and correct everything in the app, download your documents from the Studio (each resume as a PDF, a Word file, text or JSON, or printed from your browser, and everything in your account as one JSON file), clear them with Clear my data on the Profile page, and delete your account from the Profile page or the waitlist page. For a copy of the account and usage records we hold, or if you cannot sign in, email privacy@getthatrole.com. Depending on where you live you may also have rights to access, correct, delete or port personal data we hold, to object to or restrict processing, and to withdraw consent. To exercise them, or to complain, email privacy@getthatrole.com. We answer within 30 days. You can also complain to your local data protection authority. Residents of California and other US states with privacy laws: we do not sell or share personal information, and we do not discriminate against anyone who exercises their rights.

We do not track you across other sites, sell data, or serve targeted advertising, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. Analytics run only with your explicit choice in the consent bar, whatever your browser signals.

The service is for people aged 16 and over. We do not knowingly collect data from anyone younger; if you believe we have, contact us and we will delete it.

The site is served over HTTPS. Our database holds your account record and sessions (tokens and sign-in codes only as hashes) and your resumes. Resume content, including your master resume, its earlier versions and attached postings, is encrypted in our database with a key held outside it; titles, company and job names, posting addresses, scores, dates and counts are not. Your jobs, tracker, contacts and stories stay in your browser, which is only as safe as your device: on a shared computer, sign out and use Clear my data before you leave. Clear my data removes your resumes and other studio records on the server and in every open tab of this browser at once.

Our hosting, database, email and analytics providers operate in the United States and other countries. Your account record, sessions, sign-in emails, connection data and analytics are handled there under the providers' standard data protection terms. Our model provider Anthropic, PBC processes requests in the United States at our request, bound by its API data protection terms.

We will update this page when the service changes, with a new effective date at the top. Material changes will be announced on the site. See also the Cookies & storage page and the AI transparency page.