Privacy policy

• You can search jobs without an account. Browsing sets no tracking cookies.
• With an account, Ghostless stores your email, a hashed password, your settings, saved jobs and resumes.
• Your resume is used only to score it and match you with jobs. It is never shown to employers or anyone else.
• You can download or delete everything from your account page.

• Account: your email address, an optional name, and your password stored as a one-way hash (it can't be read back, even by us).
• Google or GitHub sign-in: if you use one, Ghostless receives your name, your verified email address and the provider's id for your account. Nothing else: no contacts, repositories or files, and no access after you sign in.
• Sessions: a sign-in token kept in a secure, httpOnly cookie, stored on our side only as a hash, plus the browser name so you can recognise your devices.
• Settings: theme, text size and similar display choices, in a cookie and on your account.
• Saved jobs: the jobs you save, each application's status, and any notes you write.
• Match feedback: jobs you mark “Not interested” on your matches, with the reason if you give one, so they stay hidden. Signed out, this stays in your browser.
• Resumes: when you upload a resume, the text is extracted and stored with the skills and details read from it. The file itself is not kept. Resumes you build are stored as you write them. If you check a resume without an account, it stays in your browser.
• Problem reports: what you write, the page you were on, and your email if you give it. Signed out, a hash of your network address is kept for 24 hours so a report sent twice is stored once.
• Usage counts: “Share anonymous usage stats” is off unless you turn it on in Settings, and you can turn it off again at any time; browsers that send Do Not Track or Global Privacy Control are never counted. Page views are counted without cookies, without storing IP addresses and without your account, even when you're signed in. A visitor is counted with a hash of the IP address and browser that changes every day, so nobody can be followed from one day to the next. With usage stats on, sign-ups, sign-ins and resume checks (the score, never the text) are counted with your account; with them off, they aren't. Usage counts are deleted after about 13 months; deleting your account removes the account from them.
• Error reports: when a page breaks, the page and the error message are recorded so it can be fixed, without your account.
• Browser notifications: only if you turn them on. Each browser's push address and keys are stored, and messages go through that browser maker's push service (Google, Mozilla or Apple). They say how many roles are new and name a job and employer, never your resume. Turning them off deletes the address.

Only to run the features you use: keeping you signed in, syncing saved jobs, scoring your resume, sending account emails (confirming your address and resetting your password), fixing reported problems, and understanding which pages are useful. There is no advertising and no data sale.

“Help improve job matching” is off unless you turn it on in Settings. With it on, your saved jobs, applications and “not interested” choices are also used, on our own servers, to measure and improve how jobs are matched. Your resume text isn't used for this and nothing is shared. You can turn it off again at any time, and turning it off stops any further use; we keep a record of when you turned it on and off, and of the wording that applied.

Resume scores and suggestions are calculated by Ghostless itself, without AI. If the site offers an optional AI review and you ask for one, the text of your resume and of that job posting is sent to Anthropic, which provides the AI model, to write the review. Anthropic does not use API data to train its models by default. Nothing is sent unless you press the button.

Ghostless uses a small number of service providers to host the website and the database, and Resend to deliver account email. They process data only to provide those services. Company logos come from Google's website icon service, fetched by our server, so your browser never contacts a third party for them.

• Account data: until you delete your account.
• Sign-in sessions: 30 days, or until you sign out.
• Password reset and confirmation links: they expire within a day and are cleared a week later.
• Usage counts: about 13 months.
• Problem reports: until they're resolved and no longer needed. Deleting your account removes your email from them.

• See and export: download everything stored about you as a file from your account page.
• Correct: change your name, settings, saved jobs and resumes whenever you like.
• Delete: delete your account, which permanently removes your sessions, saved jobs, notes and resumes.

Ghostless is built in Ontario and follows Canada's federal privacy law (PIPEDA). Questions or requests go through the “Report a problem” link at the bottom of every page.

If this policy changes in a way that matters, signed-in users will be told on the site before it takes effect.