Career Compass (“we”, “us”) is a career exploration tool at career-compass.io. It was built around a simple idea: you should not have to hand over your career history to a database to get something useful back. This policy describes exactly what we process, what little we store, and the choices you control. Questions any time: privacy@career-compass.io.
The short version
- We do not store your resume. Your resume and interview answers are processed only for the duration of your session and are never written to a database.
- Your name, email, phone number, and address are removed from the extracted profile before any AI analysis, and never re-enter it.
- The core service requires no account and no sign-in.
- Anything we do store — share links, purchases, saved results — happens only when you explicitly choose it, and saved results are encrypted before they reach storage.
- We never sell personal data and we never send marketing email.
What we process transiently (and never store)
When you use the pipeline — uploading a resume, answering interview questions, receiving suggestions — the working data lives in your browser and travels with each request inside a cryptographically signed envelope. Our backend is stateless: it verifies the envelope, does its work, and returns the result without persisting your resume text, extracted profile, or interview answers. Sessions expire after 60 minutes, at which point that data simply ceases to exist.
Before your extracted profile is sent to our AI provider for analysis, direct identifiers (name, email address, phone number, mailing address) are stripped out. We also do not log request bodies, resume text, or interview answers in our server logs.
Service providers we rely on
These providers process data on our behalf to run the service:
- Anthropic (Claude) — analyzes your de-identified profile and interview answers to produce career suggestions.
- Adzuna — receives role titles and your stated location to fetch real job listings and salary data. It never receives your resume or profile.
- Cloudflare Turnstile— a bot check before upload; it may set its own cookie per Cloudflare’s privacy policy.
- Upstash — rate limiting, using counters derived from your IP address.
- Vercel and Railway — host the frontend and backend respectively, and produce standard infrastructure logs (IP address, request path).
- Stripe and Supabase — used only for the optional features described next.
What we store — only if you opt in
Share links. If you create a share link, we store a snapshot of your results card. It contains no direct identifiers and expires automatically after 30 days.
Purchases. Payments are processed by Stripe; we never see or store your card number. We keep a record that your session purchased a feature, plus the purchased content itself, with a limited retention period.
Accounts and saved results. Saving results is optional and only offered after your results exist. Sign-in is via Google or an email magic link — there are no passwords. Our authentication provider (Supabase) holds your email address and sign-in identifier. Saved results are encrypted on our backend (AES-256-GCM) before they reach the database, so the storage provider only ever holds ciphertext. A saved result never includes your resume, its raw text, or your interview transcript — only the final results and the enriched profile behind them. Your email is used solely for sign-in. No marketing email, ever.
Cookies and local storage
Session state is kept in your browser (memory and sessionStorage) and is cleared when your session ends. We set no advertising or cross-site tracking cookies. Signing in creates a standard authentication token in your browser; the Turnstile bot check may set its own cookie.
Retention and deletion
- Pipeline data (resume, answers, profile): gone when your session ends — never stored.
- Share snapshots: deleted automatically after 30 days.
- Saved results: kept until you delete them. Deletion is immediate and hard — there is no soft-delete or recovery window. Deleting your account removes every saved result and erases the sign-in identity itself.
Your rights
You can access and export any saved result from your account (loading a saved result returns everything we hold in it), and delete individual results or your entire account in-product at any time. Depending on where you live (including the EU/EEA, UK, and California), you may have additional legal rights to access, correct, delete, or port your personal data, and to object to or restrict processing. We honor these regardless of where you live: email privacy@career-compass.io and we will respond. We do not sell personal data or use it for targeted advertising, so there is nothing to opt out of on that front.
Children
Career Compass is not directed at children under 16, and we do not knowingly collect personal data from them.
Changes and contact
If we make material changes to this policy, we will update this page and its “last updated” date. For anything this page does not answer: privacy@career-compass.io.