What JobScout processes, and what it never keeps.
This covers the web demo at jobscout.page and the JobScout Android and iOS apps. Same backend, same rules. Effective 14 September 2026.
The short version. JobScout has no accounts, no analytics, no ads, and no third-party SDKs. The only network calls it makes are to its own API. Resume text you paste or upload is used for one scoring run and then discarded. Nothing you type is ever written to a database or a log.
- no accounts
- no analytics
- no ads
- no tracking SDKs
- no resume storage
- no selling of anything
What you give it, and where it goes
A candidate profile. Either one of the three built-in personas, or text you paste, or a PDF / DOCX / TXT you upload. That text travels over HTTPS to JobScout's API on Cloudflare, which passes it, together with the day's job postings, to Anthropic's Claude API to produce the scores and the cover letter. It is held in memory for the length of that request and not written anywhere by JobScout. Anthropic processes it under its API commercial terms, which by default do not use API inputs to train models.
An uploaded file. The file's bytes are converted to plain text in memory and the text is returned to your device for you to review. The file is not stored. Files over 2 MB are refused before they are read.
Saved jobs. Postings you tap Save on, and the stage you set, live only on your device: your browser's local storage on the web, app-private storage on Android and iOS. They never leave the device. Clear all in Saved jobs deletes them; uninstalling the app does too.
What the server records
Two things, both to keep a free public demo from being abused:
- A salted SHA-256 hash of your IP address, the time, and the token count and cost of each scoring run. The hash enforces a per-hour cap on runs and cannot be turned back into your address. No profile text, no resume text, no scores are stored with it.
- A running total of the day's spend, so the demo can stop calling Claude when its daily budget is used up and serve a cached showcase run instead. The cached run is one the operator seeded, not anyone's live input.
Cloudflare, which hosts the API and this site, keeps its own standard request logs under its privacy policy.
The job postings
The feed is public job postings gathered by JobScout's own pipeline from public job boards and company career pages. It contains no personal data about you. View posting opens the employer's own site in your browser; from there, their privacy policy applies. JobScout never submits an application on your behalf.
Permissions
The Android app asks for one permission: Internet. Uploading a resume uses the system file picker, so the app never gets access to your files beyond the one you choose. It does not read contacts, location, the camera, or anything else.
Children
JobScout is a job-search tool for adults and is not directed at anyone under 16.
Your choices
- Use a built-in persona instead of your own resume, and nothing about you reaches the API at all.
- Delete saved jobs at any time with Clear all, or by uninstalling.
- Questions or a deletion request: ken@tbot.trade. Since no profile text is stored, there is nothing to delete server-side, but ask anyway and you'll get a straight answer.
Changes
If this policy changes, the new version is posted here with a new effective date. The code that makes these claims true is public at github.com/kenmwara/jobscout-app.