Privacy policy

1Who runs OpenJobs

Compound Labs operates OpenJobs. Write to hello@thecompound.tech with questions about this policy or your data.

2What OpenJobs stores

• Your sign-in. Supabase Auth stores your email address. If you sign in with Google, it also stores the name Google shares.
• Your profile: your name, contact details, location, work authorization and sponsorship answers, current title and company, years of experience, expected pay, start date, links, and the answers you save for application questions.
• Your resume, in a private storage bucket. Each account has its own folder, and only that account can read it.
• Your saved job searches, saved and dismissed jobs, recommendations and each private preparation draft: its questions, answers, resume, review results, revisions, status and times.
• Your experience notebook and source revisions, approved or uncertain facts, source passages, and deletion and review history. Legacy application approval and delivery records remain part of your account history.
• Questions you collect from permitted public forms or paste yourself, their source and coverage, and the answers you edit. Historical browser-extension records can include employer form questions, answers, application URL and run result. Answers may include sensitive information you choose to enter. The current product does not fill or submit employer forms.
• Your settings: your plan, the AI provider you chose, and your AI key. Your AI key is sealed with AES-256-GCM before it is stored.
• If you connect recruiter email: your Gmail address and your Gmail app password, sealed with AES-256-GCM. OpenJobs also stores the recruiter messages it reads, up to 20,000 characters of each body, and the replies it drafts. Message bodies are stored as plain text, so they are protected by the access rules described below.
• For legacy browser extension tokens: only the SHA-256 hash. OpenJobs never stores the token itself.

3What OpenJobs does with it

OpenJobs serves a shared public catalog of technical jobs. An account keeps saves, searches, dismissals, the experience bank and preparation materials private. Saving and matching a job never create an application. Choosing Prepare creates an owned held draft.

Paid preparation uses your approved experience to tailor a resume and draft answers to collected questions. Outputs are tied to the source, job and question revisions used. You review, copy or download the materials, then apply manually on the employer site. Public cached pages do not include your bank or identity.

OpenJobs does not sell your data and does not show ads.

4Gmail access

Recruiter email is optional for existing legacy subscriptions and is not included in Prepare or Daily. To turn it on, you create a Gmail app password and paste it into OpenJobs. OpenJobs uses that password for two things:

• Reading. OpenJobs opens your inbox read-only over IMAP and reads new messages. It reads Sent Mail to find threads you have already answered. Nothing is marked as read, moved or deleted.
• Sending. OpenJobs sends a reply from your Gmail account over SMTP only after you approve that reply and its 10-second undo window has passed. When a recruiter asks for your resume, the reply attaches the resume you uploaded.

To remove this access, delete the app password in your Google Account under App passwords, or disconnect recruiter email in OpenJobs Settings.

5The AI and what it receives

Public discovery and free account storage do not require an AI key. Paid preparation sends the relevant approved bank facts, source passages, job text and collected questions to the selected model to draft a resume and answers. Free resume import uses a rules parser and does not make a hosted-model call. Optional recruiter email also makes these requests:

• Sorting. For each batch of up to 25 new messages, OpenJobs sends the sender's name and address, the subject, and the first 600 characters of each body. The AI marks each message as job mail or not.
• Judging. For job mail, in batches of up to 12, OpenJobs sends the same header lines and the first 2,500 characters of each body. The AI identifies the company, the role and the questions asked, and decides whether the message needs a reply.
• Drafting. For each message that needs a reply, OpenJobs sends your profile facts (name, email, phone, location, work authorization and sponsorship, current title and company, years of experience, expected pay, start date, links and your saved answers), the sender, the subject, the first 3,500 characters of the body, and the questions the AI found. If the message names a company website, OpenJobs fetches that page and sends up to 4,000 characters of its text. Your resume file binary is not sent in these email requests.

For legacy Bring your own AI subscriptions, requests go to the provider you connect: OpenRouter, Google Gemini, OpenAI or Anthropic. OpenJobs uses your key; that provider bills you and its terms and privacy policy apply.

For hosted preparation memberships and legacy AI included subscriptions, OpenJobs uses a Compound Labs provider account. OpenJobs records generation status, model, token usage and estimated cost for metering and budgets; billing does not include the text of your bank.

6Who else receives data

• Supabase hosts the database, sign-in and resume storage.
• Cloudflare hosts the website and runs the scheduled jobs.
• Google receives the IMAP and SMTP connections for your Gmail account if you connect recruiter email.
• The AI provider described above receives the requests listed there.
• Stripe processes payments for paid plans. OpenJobs does not store your card number.
• An employer receives the information you choose to copy, upload and submit on its own application page.
• PostHog records page views on this website. Automatic click capture and session recording are off.

7How it is protected

Each table uses row level security, so a signed-in user can read only their own rows. AI keys and Gmail app passwords are sealed with AES-256-GCM. The key that opens them is held by the server, not the database, and a signed-in user cannot read the sealed columns.

8How long data is kept

OpenJobs keeps your data while your account exists. When you delete your account, OpenJobs deletes the account, every row tied to it and your resume files at once. Managed hosting backups expire on the provider's backup schedule. New encrypted operational snapshots of application data and resume files use a 14-day expiry policy. Legacy private Git database archives retain historical copies and do not expire automatically. Deleting an account does not immediately remove backup copies; the applicable expiry policy still applies, and legacy archives require separate removal.

9Export and delete your data

• Settings › Account › Download my data downloads one JSON file with every OpenJobs record for your account, and links to your resume files that expire after one hour. Sealed AI keys, sealed Gmail app passwords and extension token hashes are left out.
• Settings › Account › Delete my account asks you to type DELETE, then deletes your resume files, your sign-in and every record tied to your account. It cannot be undone.
• You can also email hello@thecompound.tech from the address you sign in with, and we will export or delete your data for you.

10Age

OpenJobs is for people who are 16 or older. If you are younger, do not use it.

11Changes to this policy

If this policy changes, we update this page and the date at the top.