Privacy

Last updated 3 October 2026 (version 1.9)

Searching Job Spotter needs no account, and searches are not stored or linked to you. A search carries only the job words, place, level and time window you ask for. We use them once to answer and don't keep them or link them to you. The same goes for a CV, a job advert or an interview answer you send to score a match, draft a cover letter or practise an interview without an account: used once to answer, never stored.

We keep one anonymous count: each week, how many searches were made for a kind of job in a place (up to three words of the role, only when they look like a job title, and the town or city). No internet address, account or full search is kept with it, and a count is only shown or licensed once it holds 10 or more searches. See job demand data.

To find jobs we ask public job board APIs (The Muse, Remotive, Himalayas, Jobicy, Remote OK and Arbeitnow, NHS Jobs and Teaching Vacancies for UK searches, and Adzuna, Reed, USAJOBS and Careerjet when they are switched on) for listings that match. Only the search words and place are sent. Careerjet's API also requires the internet address and browser type of the device making the search, so when Careerjet is switched on those two are passed to Careerjet with the search and not kept by us. Listings are kept in a short-lived cache so we ask those boards less often. A job id holds only details of the job itself (its source, title, company, place, date and pay), never anything about you.

When you open a listing you go to the job board or employer's own site, and their privacy policy applies there. The site runs on Cloudflare, which may keep standard technical logs under the Cloudflare privacy policy. No ads. We count visits to these pages with Cloudflare Web Analytics, which sets no cookies and keeps no personal data: it shows us totals such as pages viewed, the country and the type of browser.

If you make an account (optional)

Job Spotter is run by Good Turn Studio, the data controller (contact below). We keep only what you give us, to run the features you use:

• Your email address, to sign you in by link and, if you ask, to send alerts and reminders. Sign-in links and sessions are stored only as one-way hashes. Signing in sets one cookie (js_s), needed to keep you signed in; no other cookies apart from js_ref below.
• Saved jobs, notes, follow-up dates and saved searches, to run your tracker, reminders and alerts. Applications you mark as applied and replied are counted, across all users and only from 5 applications per employer, to show employers' reply rates; no one is identifiable in those figures.
• Your profile and CV, if you add them, to find jobs for you and, only if you switch it on, to let employers find you. CV text is encrypted before it is stored. Employers see an anonymous summary (only the parts you choose) and never your name, email or CV unless you say yes to a specific job.
• LinkedIn connections, if you upload LinkedIn's Connections.csv: first name, last name, company and position only. Email addresses and profile links in the file are dropped on upload and never stored. Your connections are used only to show you who you know at companies, and are never shown to anyone else or contacted.
• Work email domain (for example company.com), if you confirm a work address, and work check scores, shown to employers as evidence.
• UK right to work share code, if you add one, encrypted before it is stored. Employers see only that a code is ready, and get the code after you say yes to an introduction, so they can check it on GOV.UK.
• Your dream job flag, one job posted on Job Spotter each month, if you choose one. That employer sees the flag on your anonymous card.
• Requests for a person to check a score, introduction or profile: what you wrote and the date, so we can reply to you.
• If you join a group or programme through a link from an employer, adviser or council, the date you joined. They see only counts (how many joined, were introduced and found work, with numbers of 1 or 2 hidden), never who.
• Referrals: if you open someone's referral link, one cookie (js_ref) holds their referral code for 30 days and nothing else. If you then make an account, we record who referred you so they can be rewarded (see Refer and earn); they see only counts, never your name or email. If you share your own link, we keep your referral code and those counts.
• Applications you prepare: the job, the CV and cover letter made for it from your own CV, your answers to the employer's questions, and what happened to it (sent, replied, interview, outcome), with the last 10 versions of the materials so you can undo a change. An application goes to the employer only when you press Send and say yes, or when Autopilot sends it within the limits you set. The employer then receives your name, contact details, CV, cover letter and answers, and its own privacy policy applies to them.
• Standard answers and phone number, if you add them (for example right to work, notice period, salary expectation), used only to fill in application forms. Questions about gender, ethnicity, disability, age, sexual orientation, religion and similar are always answered "prefer not to say" and are never guessed.
• Your application address: each application that goes by email or through an employer's form gets its own address (a-code@reply.goodturnstudio.com) so replies come back to you. Email applications are sent by Resend from apply@goodturnstudio.com, in your name, with a copy to you. Mail sent to an application address is read by Job Spotter only to put it in your inbox and to update that application (for example an interview invitation or a rejection); the message text is kept with your account.
• The application robot: for employers whose forms run on common hiring systems (Greenhouse, Lever, Ashby, Workable, SmartRecruiters, Recruitee, Teamtailor, Personio), a browser run on Cloudflare opens the employer's form, fills it in with your details, CV, cover letter and answers, ticks that you have read the employer's privacy notice where the form asks, and submits it. It stops and hands back to you at anything it can't answer or any human check (CAPTCHA). We keep a short record of what it did and what the employer's page said back. See how the robot works.
• Messages and interviews with employers about your applications, so both of you can see the conversation and the times you agree.
• Autopilot, if you switch it on: your settings (how many a day, the lowest match, which CV) and a log of what it sent.
• Connected apps: if you sign in to Job Spotter from an app such as Claude or ChatGPT, we keep the app's name, what you allowed it to do, when it was last used, and its access tokens as one-way hashes. The app reaches your account only within what you allowed, and you can disconnect it at any time on your account page. What the app does with what it sees is covered by that app's own privacy policy. See connecting an app.
• Employers: your email, company and job posts, the applications people send you through Job Spotter (with your stages, messages and interview times), the introductions you ask for, and any extras you order (what, for which post, the price and whether it's paid), kept for our accounts.
• Platform API customers: your email, a name for the key and a monthly count of calls. Only a scrambled form (hash) of the key itself is kept.

Legal basis: providing the service you asked for (contract), and your consent for introductions, alerts and shift emails, which you can withdraw at any time. Data is stored on Cloudflare (D1 database) and emails are sent by Resend; both act for us under their data processing terms and may process data outside the UK under standard safeguards. We never sell your data or use it for advertising. Introductions are shared only with the employer you said yes to.

How long: unused accounts are deleted after 12 months, and CV text after 12 months unused. Sign-in links expire within minutes and are deleted after a week. You can download all your data or delete your account at once on your account page; deletion is immediate (if you were hired through an introduction, a bare record of that hire, with no contact details, is kept for the employer's invoice). You have the right to access, correct, delete or move your data and to object or complain to the ICO (ico.org.uk).

Contact: jobspotter@goodturnstudio.com

Job Spotter · Privacy · Terms · jobspotter@goodturnstudio.com