Privacy policy

Last updated: 30 October 2026. This policy is written for users in India and follows the Digital Personal Data Protection Act, 2023 (DPDP Act).Pending legal review: Whole policy against the DPDP Act 2023 and the DPDP Rules once notified

Who is responsible

Jobs with Joe, based in Chennai, India, runs this site and is responsible for the data described here (the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). Questions about this policy: jobwithjoe@gmail.com, or see Contact.

Without an account

• You can browse every job and reach the employer’s application page without signing up.
• We don’t ask for your name, phone number or documents to browse.
• There is no advertising or tracking code. Optional analytics (Google Analytics and Microsoft Clarity) load only if you choose “Allow analytics” in the cookie notice; see Cookies.
• Without an account the site sets no cookies, except the one that remembers your cookie choice once you make it.
• We never receive your job applications. You apply on the employer’s own site.
• We never see or store your card, UPI or bank details. Razorpay handles payments (see below).

What stays in your browser

A few things are saved only in your browser’s local storage and are never sent to us unless you sign in: your light or dark theme choice (jwj-theme), the jobs you save (jwj-saved-v1) and the jobs you opened recently (jwj-recent-v1). Clearing your browser’s site data deletes them.

Accounts

An account is optional. You sign in with a one-time link sent to your email address (and, where we offer it, with Google). We keep your email address and the dates you joined and last signed in, so we can sign you in and keep your data apart from everyone else’s. Sign-in is run by Supabase, our database and authentication provider.

Cookies and optional analytics

When analytics is switched on for this site, a notice asks whether you allow it. Until you click “Allow analytics”, no analytics script loads and no analytics cookie is set. Your answer, yes or no, is kept for 180 days in a cookie named jwj_consent, so we don’t ask on every page. You can change it any time with “Cookie preferences” at the bottom of every page; saying no after a yes removes the analytics cookies we can reach and reloads the page.

• Google Analytics 4 (Google) counts page views and visits, using cookies whose names start with _ga. Advertising features and Google signals are off; we never use it for ads.
• Microsoft Clarity (Microsoft) records how pages are used (clicks, scrolling, and replays of visits) so we can fix confusing pages. Text you type is masked, and on account pages (profile, tracker, resume, alerts) the page content is masked too. It uses cookies such as _clck and _clsk.
• Both providers process this data on their own servers, which may be outside India, under their own terms.

Cookies when you sign in

Signing in sets a sign-in cookie (its name starts with sb-, and a long session may be split across a few numbered cookies). It holds your session so you stay signed in and is strictly necessary for your account to work; it is not used for analytics or advertising. Signing out removes it. While you are signed in your browser also remembers which saved jobs it has already copied to your account (jwj-saved-synced-v1), and signing out clears this browser’s copy of your saved jobs.

What your account stores

• Your profile: name, education (degree, branch, college, graduation year, CGPA), career stage and experience, preferred cities, roles you are interested in, whether remote work suits you, your expected pay, and your skills.
• Your saved jobs, with what each listing said when you saved it.
• Your application tracker: the jobs you add, the status you set, your notes and dates, and a history of status changes. These are statuses you enter; we cannot see employers’ hiring systems.

We use this only to run the site for you, for example to show how well a job matches your profile. Only you can see it. We never show it to other users or share it with employers, and we do not sell it.

Your resume

If you upload a resume, it must be a PDF of up to 5 MB. The file is stored in private storage that only your account can read. Our server reads the text from it to suggest skills for your profile and to compare it with job descriptions; that text is stored with your account, is visible only to you, and is never written to our logs. You can replace or remove the file from your profile at any time.

Matching and AI embeddings

Match scores are worked out by our own rules from your profile and the job listing. Separately, when we turn on the optional AI matching feature, a short summary of your profile (career stage, years of experience, degree, branch, roles of interest and skills; never your name, college, CGPA, expected pay, cities or resume) is sent to OpenAI to create an “embedding”, a list of numbers that describes it. We store that list with your account to rank jobs by similarity. When the feature is off, nothing is sent to OpenAI. Under OpenAI’s API terms, data sent through its API is not used to train its models by default.

Job alerts

If you create a job alert, we store what it looks for (keywords, cities, career levels, remote preference and companies you pick), which channels it uses and whether it is paused. For delivery we store your time zone, quiet hours and daily limit; the email address of your account if you turn on email digests; the Telegram chat ID our bot receives when you link Telegram (removed when you send /stop or unlink); and, if you allow browser notifications, the push address your browser gives us (it identifies your browser to its push service, not to us). We log each alert we send (which job, which channel, when and whether it was delivered) so you never get the same job twice. Alerts only include open, high-confidence listings. Deleting an alert or your account removes it and its delivery log.

Apply-link clicks

When you select an “Apply on the official site” button, our server sends you to the employer’s page and counts the click. For each click we store only: which job, when, whether the request looked like an automated program (such as a search-engine crawler), and, if you came from one of our own links, the campaign tags in that link (for example, which channel post it was). We store no name, account, cookie, device identifier or IP address with the click.

To stop the count from being inflated, our server turns your IP address into a one-way code that changes every day (a keyed hash). Only that code reaches our database, where it is kept in short-lived counters that are deleted once they are a day old (the clean-up runs each time a click is counted). It cannot be turned back into your IP address, and codes from different days cannot be linked. A click is never treated as proof that you applied for a job.

Job views, applies and visitor counts

To show honest numbers such as “1.2K views” and “23 applied via Joe” on jobs, and the totals on our open stats page, we count a few anonymous events: a visit to the site (once a day), opening a job page or a reel link, selecting Apply, saving a job, sharing it and running the resume match. For each event we store which job (if any), the day, whether it came from the website, the browser extension or a reel link, and, for a visit, the campaign source in the link you arrived from (for example, utm_source=instagram).

We set no cookie and store no IP address, user agent, account or device identifier for this. Our server combines your IP address and browser name with a secret key and the date into a one-way code (a keyed hash), and only that code reaches our database, so each visitor is counted once per job per day. The code changes every day (a second code for “this week” changes every Monday), cannot be turned back into your IP address and cannot link your visits across days. Known bots and crawlers are not counted. Counts below 5 are not shown on jobs. So the same event isn’t sent twice, the page notes which events it already sent today in this tab’s session storage, which your browser clears when you close the tab.

The browser extension sends a daily “active” ping with a random install ID it generated, turned into a one-way code by our server, so we can count extension users. See the extension privacy policy.

Search terms

When you search the jobs list, we keep the words you searched for (lower-cased, at most 80 characters) and the time, so we can see which roles people look for. We store nothing else with it: no account, IP address, cookie or filter choices. Text that looks like an email address or a phone number is never stored. Search terms are deleted after 90 days.

The old waitlist

The site no longer offers a waitlist. If you joined it earlier, we store your email address, where you joined from (for example the pricing page), the date of the consent wording you agreed to, and whether you’ve confirmed. We use it only to send one confirmation email and one email when Pro launches. Confirmation links are stored only in a scrambled (hashed) form. You can leave at any time with the link in any email we send, or by writing to us. We delete waitlist entries within 30 days of Pro launching or of you leaving, whichever is first.Pending legal review: Retention period and consent wording

Subscriptions and payments

Jobs with Joe has no paid plan and takes no payments today. If a paid plan were ever offered, it would be billed through Razorpay Software Private Limited, an RBI-authorised payment aggregator in India. On a subscription, Razorpay collects your payment details directly; we never see or store your card, UPI or bank details. We receive and keep: the subscription and payment IDs Razorpay gives us, your plan, billing dates and status, amounts, and the details you add for invoices (name, state, PIN code and, if you give one, your GSTIN). We keep invoices and payment records for 8 years because Indian tax law requires it, even if you delete your account; they are then separated from your account.Pending legal review: Razorpay entity description, tax record retention period (CGST Act s.36 / Income-tax Act)

AI features

AI tools (such as resume tailoring, cover letters, the co-writer, Apply Copilot answers and interview prep) work only when you use them. When they are switched on, the text you choose to send (for example your resume and a job description) goes to OpenAI, our AI provider, to generate a response, and comes back to you. We send only what the feature needs, never your payment details. Under our agreement with OpenAI, data sent through its API is not used to train its models. OpenAI processes data in the United States, so using an AI tool means your text leaves India.Pending legal review: Cross-border transfer under DPDP Act s.16; OpenAI API data-use terms

Service providers

These services process data for us, each under its own privacy policy and retention periods: Vercel (hosts and delivers the website), Supabase (our database, sign-in and file storage, in its Mumbai, India region), Render (runs our backend in Singapore), Razorpay (payments, when you subscribe), OpenAI (AI features and AI matching, only while they are switched on and you use them), Telegram and your browser’s push service (only if you choose those alert channels) and, if we switch email on, an email delivery provider. Like any website, our hosts receive standard request data, including your IP address, to deliver pages and protect against abuse, and keep their own request logs. Our own application logs record event names, outcomes and request IDs, never your resume, profile details or IP address.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• see what we hold: Account and privacy has a “Download my data” button that gives you everything stored with your account as a JSON file (your resume file itself downloads from your profile);
• correct or complete it: edit your profile, skills, alerts, saved jobs and tracker at any time;
• erase it: deleting your account on the Account page removes your account, profile, resume file and its text, saved jobs, tracker, alerts and embedding straight away. We keep one internal record that an account with your user ID was deleted, without your email or any other detail. Some records, such as invoices, must be kept by law even if you ask us to erase them; we’ll tell you when that applies;
• withdraw consent by deleting your account, removing your resume, pausing alerts or leaving the waitlist; and
• nominate someone to act for you if you die or cannot act, and raise a grievance, by emailing jobwithjoe@gmail.com. We answer within 30 days.

If you are not satisfied with our answer to a grievance, you can complain to the Data Protection Board of India.Pending legal review: Rights wording, response time and grievance officer details under DPDP Act ss.11–14

Job listings

Listings come from employers’ public job boards and describe jobs, not job seekers. If a listing names a person (for example a hiring contact), that is how the employer published it; ask the employer, or contact us, to have it changed or removed.

How long we keep data

• Your account, profile, resume, saved jobs, tracker and alerts: until you delete them or your account.
• Apply-click counters: one day (the clicks themselves carry no identifier).
• Search terms: 90 days.
• Engagement events (views, applies, visits, extension pings): kept to show daily history on /stats. They carry only the daily one-way code above, which cannot be linked to you or across days.
• Waitlist: until 30 days after Pro launches or you leave the list.
• Subscription, payment and invoice records: 8 years (tax law), separated from your account if you delete it.
• Usage counters for plan limits: the current period plus 12 months.

Children

Accounts and paid plans are meant for people aged 18 or over. If you are under 18, a parent or guardian must agree before you join the waitlist, create an account or subscribe. If we learn we hold a child’s data without that consent, we delete it.Pending legal review: Verifiable parental consent under DPDP Act s.9

Changes before new features

Optional analytics asks for your consent first (see Cookies above). This policy is updated in the same change that ships anything new that handles personal data.

Questions and complaints

If you have a question or a complaint about how this site handles data, email jobwithjoe@gmail.com. We will reply, explain what we hold, and fix anything that is wrong. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.Pending legal review: Grievance redressal process and Data Protection Board reference