Effective date: 2026-10-03
This policy describes what data the service collects, why it is collected, where it is stored, and how long it is kept. It applies to the service operated at jsaa.pl (the operator is a one-person business registered in Poland).
1. What the service is
Job Search AI Assistant is a personal job-search assistant: it stores your CV template, job offers, applications, generated documents, and interview preparations, and uses large language models (LLMs) to tailor CVs and analyse offers. The service is in closed beta and access is by invitation.
2. Data you provide
When you use the service, you provide: your CV template and its contents, job offers you add or import, your application records, and settings such as compensation preferences. This data is stored in Microsoft Azure (Cosmos DB and blob storage, region West Europe) and is encrypted at rest.
3. Sign-in
You sign in with GitHub (OAuth). The service stores your GitHub identity so it can recognise you on return visits. The service does not receive or store your GitHub password.
4. Gmail and Calendar access (optional, read-only)
If you connect Gmail, the service requests read-only access
(gmail.readonly): it reads job-related email (application confirmations, recruiter
messages, rejections) to surface signals in the app. If you connect Google Calendar, the service
requests read-only access (calendar.events.readonly): it reads
calendar events to correlate interview scheduling. It never writes, modifies, deletes, or
sends emails, never creates or modifies calendar events, and never accesses attachments. The refresh token Google issues is stored
encrypted in your account. You can disconnect at any time from the settings page, and you can
revoke access in your Google account settings; changing your Google password also invalidates
the token.
4a. Google Calendar access (optional, read-only)
If you connect Google, the same grant also requests read-only Google Calendar
access (calendar.events.readonly): it reads job-related events (interviews,
recruiting meetings) in the near future to surface them in the app. It never creates, modifies,
or deletes events, and it does not read your calendar settings or other users' calendars.
5. Language model processing
To tailor CVs, analyse offers, and enrich signals, the service sends relevant content to third-party LLM providers (the service's default provider is OpenRouter; you may bring your own API key for Anthropic, OpenAI, or Gemini). This means portions of your CV, offer, and application content are transmitted to those providers for processing. LLM features run only when a provider is configured, and the service only sends the content a given feature needs.
6. Retention
The service keeps your data for at most as long as your account exists; some working records expire sooner. When you erase your account, what happens to each kind of data, and how long a copy can outlive that, is as follows.
These are deleted when you erase your account:
- Your CV and templates. A database backup can keep a copy for up to 10 days. Earlier versions of files stay recoverable for up to 10 days.
- Offers and applications. A database backup can keep a copy for up to 10 days.
- Generated documents. A database backup can keep a copy for up to 10 days. Earlier versions of files stay recoverable for up to 10 days.
- Interview prep. A database backup can keep a copy for up to 10 days.
- Mail and calendar signals. A database backup can keep a copy for up to 10 days. Earlier versions of files stay recoverable for up to 10 days.
- Settings and connections. A database backup can keep a copy for up to 10 days. We revoke this app's access to your Google account; if that fails, you can remove it yourself.
- Activity log. A database backup can keep a copy for up to 10 days.
- Internal processing records. They can hold document text, and are cleared automatically within 10 days.
- Your prepared data export. Earlier versions of files stay recoverable for up to 10 days.
These are kept:
- Access record. One record of your GitHub username marked revoked stays, so the beta's access sync cannot re-admit you. It goes when the beta ends.
- Record of this erasure. Your user id, the status, timestamps and counts, with no content. It expires on its own within 10 days.
- Platform logs and backups. Diagnostic and application logs are kept for up to 30 days. They hold your user id, and some application logs carry content such as a Gmail address, company or job title. Logs can also record blob paths, including the name of a stored CV file, which is derived from the CV's content.
- Service configuration. Shared by every user and holding none of your content, so it stays.
- Copies held by third parties. The AI provider you chose keeps prompts and responses for its own retention period; this app cannot delete them.
7. Erasure and export
You can export your data and erase your account from the settings page.
You can download your data export for 7 days. We delete it within 10 days, and a deleted copy stays recoverable by us for up to 10 more days. The archive file itself is not encrypted beyond the storage encryption Azure applies to all our data; once you download it, keeping that copy safe is your responsibility.
Deleting runs in the background and can take a while. Blob storage and the database keep soft-deleted copies and backups for up to 10 days, and internal processing records are cleared within 10 days; after that they are gone for good.
Logs and the AI provider you chose keep their own copies as described above; this app cannot delete those.
Anything you already downloaded, such as a data export, stays on your device.
Signing out of this app does not sign you out of GitHub or revoke this app's GitHub authorisation. Do that in your GitHub settings.
If you connected Gmail, check the permissions in your Google account and remove this app if it is still listed.
This app can't revoke the API key you gave it for your AI provider. Revoke or rotate that key in your provider's account.
8. No selling of data
The service does not sell personal data and does not share it with advertisers. Data is shared only with the processors needed to run the service (Azure hosting, the LLM providers described above, and GitHub for sign-in).
9. Contact
Questions about this policy or your data can be raised at the project's issue tracker: github.com/Arasz/job-search-ai-assistant/issues.