Privacy

Who this covers

This policy covers Imba Jobs (the site at imbajobs.com, its public API and its MCP endpoint). It applies whether or not you sign in. Employers’ own career sites, which you reach by clicking an apply link, have their own policies and are outside ours.

The operator of this deployment has not yet published its name and address on this page. Until it does, every right below can be exercised with the self-service tools under How to see or delete your data, without contacting anyone.

What we store, and why

Anonymous id

On your first visit we set an HTTP-only cookie named fh_anon containing a random id, so that anything you later save — a role in your queue, a resume, an agent key, an OPT timeline — is kept for this browser without a sign-up step. It is set whether or not you go on to save anything. Everything below is keyed to it. The id is random; it contains nothing about you, and if you clear the cookie the data becomes unreachable (and can be purged — see retention). If you sign in, rows keyed to your anonymous id are re-keyed to your account so they follow you across devices.

Account details, if you sign in

Sign-in uses GitHub, Google or an emailed link, when enabled for the deployment. We store the name, email address and avatar URL the provider gives us, and a session. We never see your provider password. For GitHub and Google, the sign-in library also stores the link to your provider account together with the tokens the provider issues at sign-in (access, refresh and ID tokens); we do not use them to act on your provider account, and they are deleted with your account.

Resume and profile

When you upload a resume we store the file bytes, its name and type, the text we extracted, a hash of the file, and the structured profile parsed from it (contact details, education, experience, projects, skills, work-authorization notes if you include them). We store the preferences you set — role types, tracks, countries, daily limit, minimum fit score, keyword filters and standard answers — so your agent can read them. Purpose: fit checks, apply packs, and giving your agent accurate information.

Queue, fit checks and apply packs

The roles you queue, with status (queued, applied, skipped, failed) and any notes; fit checks (a score, verdict, strengths and gaps for a role against your resume); and apply packs (a tailored headline, cover letter, highlights and answers). Purpose: the core product.

Agent keys and events

When you create a key for your agent we store a SHA-256 hash of it, its first characters so you can recognize it, a label, the kind of agent, and timestamps for creation, last use and revocation. The full key is shown to you once and never stored. We log the events your agent reports — applied, skipped, failed, notes, run started and finished — with the role, a message, a timestamp, and any extra structured details your agent chooses to attach, which we store as sent. Tell your agent not to include anything you would not want kept. Purpose: letting you see what your agent did, and letting you revoke access.

OPT tracker submissions

When you submit a timeline we store the fields on the form: OPT type, service center, premium-processing flag, the dates you enter, and the optional school, field of study and notes. These are published on the tracker and through the public API, without any identifier. We also store your anonymous id or account id (so you can delete the row) and, for the rest of the day you submit, a hash of your IP address keyed with a server secret that changes every day. The hash exists only to limit submissions to five per browser or connection per day. It is not perfect anonymity — someone holding both our database and that secret could test candidate addresses against it — so we do not keep it: hashes from earlier days are erased automatically the next time anyone submits a timeline, and we never use them after the day they were created. Email addresses, links, USCIS receipt numbers, A-numbers and SEVIS ids typed into the free-text fields are removed before saving; please leave out anything else that identifies you.

Abuse limits

AI features and sign-in emails cost money, so we count how often they are used: one counter row per resume read, fit check or apply pack that calls a model, and per sign-in email. A row holds a label for the limit, the time, and a hash of your IP address (or, for sign-in emails, your email address) keyed with a server secret that changes every day, never the address itself. Purpose: per-connection and site-wide daily limits. Rows are deleted after two days.

Server logs and analytics

Our hosting provider keeps standard request logs (IP address, user agent, path, timing) for a short period for security and debugging. We use Vercel Web Analytics for aggregate page-view counts; it does not use cookies and does not identify individuals.

Imba Interview Tool (desktop app and subscription)

The desktop app runs on your computer. What you give it, such as typed prompts, screenshots you choose to capture and, once you start listening, microphone and system audio and its transcript, goes from your computer to the AI and speech-to-text providers you connect, under their terms. We don’t bundle, proxy or resell that AI usage. Your provider API keys and sign-ins stay on your computer; we never receive them.

If you subscribe, we store, tied to your account:

• your Stripe customer id and a copy of your subscription: its status, price, trial and billing-period dates and any scheduled cancellation. Purpose: knowing whether you have access, on the site and in the app;
• the ids of your Stripe Checkout sessions, so a second Checkout can’t start a second subscription, and a log of the Stripe events we’ve processed (Stripe ids only, no account id), deleted after 90 days;
• for each desktop app you approve: the device name, operating system and app version it reports, when it was approved, last checked in and expires, and a hash of its sign-in token, never the token itself. Activation requests that aren’t approved stop working after 10 minutes.

The app checks with us when it starts and before paid features to confirm your subscription. That check sends its sign-in token, not your provider keys or anything you asked it. You can sign out any desktop app on your billing page. Deleting your account cancels any subscription immediately, signs out your desktop apps and deletes our billing records for the account. Stripe, our payment processor, keeps the payment records it is required to keep, such as invoices.

What we do not do

• We do not sell personal data, and we do not share it with advertisers or data brokers.
• We do not run advertising or ad-tracking scripts.
• We do not submit applications, hold your passwords for other sites, or act on your behalf without your agent’s instruction.
• We do not send your resume to employers. Your agent may, under your instructions.
• Imba Jobs does not use your data to train models. When an AI feature runs, the AI provider handles the text it receives under its own terms, described in the next section.

Third parties that process data for us

• Vercel hosts the application and provides the aggregate analytics described above.
• Railway hosts the Postgres database where everything in “What we store” lives.
• Stripe processes Imba Interview Tool payments. When you start a trial, we create a Stripe customer with your account id and email address. Stripe collects and holds your card details under its own privacy policy; we receive your subscription status, not your card number.
• Sentry receives technical error reports when something breaks: the error message and stack trace, the page path, and browser and operating-system details. We configure it not to collect cookies, request bodies, query strings, IP-based user details or agent keys, and we strip anonymous ids and keys from anything it sends. Reports are kept for Sentry’s standard retention period and are used only to find and fix bugs.
• The AI provider receives text only when an AI feature is enabled for the deployment and you use it. This deployment uses MiniMax (mainland China platform), at api.minimaxi.com. MiniMax's privacy policy for this platform says it stores the personal information it collects inside the People's Republic of China, and that personal information included in a request may be collected and may appear in its output. Its own retention and training terms apply to what it receives; see MiniMax’s policy. What it receives when it is used:
  • Resume parsing: the text extracted from your resume, which includes whatever the resume contains — usually your name and contact details.
  • Fit checks and apply packs: the job posting plus a summary of your profile — name, location, work-authorization and sponsorship status, years of experience, summary, skills, languages, experience, education (with GPA if you gave one), projects, and the role types, tracks and countries you chose. Apply packs also send the draft cover letter, highlights and cautions we wrote, which can state whether you need sponsorship. Your email address, phone number, links, standard answers (salary, pronouns and the rest), keyword filters, daily limit and fit threshold are not sent. If your resume was never parsed into a profile, its text is sent instead, with email addresses, phone numbers and links removed.
  Nothing is sent when AI features are off — the heuristic versions run entirely on our servers.
• Resend sends email (sign-in links) when email is enabled; it receives your email address and the message.
• GitHub and Google act as sign-in providers when enabled and receive the sign-in handshake.
• Image hosts. Company logos are loaded from Google’s favicon service (www.google.com), hackathon thumbnails from Devpost and the image CDN it uses, and repository avatars from GitHub (avatars.githubusercontent.com). Your browser fetches these images directly, so those services receive your IP address and browser details, under their own privacy policies. We send them nothing else.

Your own agent is not a third party we control. It receives whatever the MCP endpoint returns for your key — your full profile including contact details and standard answers, queue, job data and apply packs — and what it does next is governed by the tool you run and the sites it visits.

How long we keep it

• Everything keyed to your anonymous id or account stays until you delete it. We intend to purge anonymous data untouched for twelve months.
• Agent events and fit checks are kept for the same period as the profile they belong to.
• OPT submissions remain part of the public dataset until you delete them. The IP hash on a submission is erased after the UTC day it was created (at the next submission by anyone).
• Abuse-limit counters (hashed IP or email, never the raw value) are deleted after two days.
• Server logs are retained by the hosting provider for a short rolling window.
• Job postings, hackathons and repositories are public data refreshed on a schedule; inactive postings are kept so historical links keep working.

How to see or delete your data

• Your profile page shows what we hold and has a Delete all my data action that removes your profile, resume, queue, fit checks, apply packs, keys, events and OPT submissions in one step.
• To remove a single OPT submission instead, use “Your submissions” on the tracker: anything you shared from this browser or account is listed there with a delete button.
• Agent keys can be revoked individually on the agent page.
• This deployment has not published a contact address yet, so requests by email are not possible for now. Everything above works without contacting anyone; once an address is configured it appears here, on the terms page and in the footer.

Cookies and local storage

There are no advertising or cross-site tracking cookies.

Your rights

Wherever you are, you can access, correct, export and delete the data we hold about you using the steps above. If you are in a jurisdiction with specific rights (the EU/EEA, the UK, California and others), those rights apply, and the self-service tools above handle them. We do not discriminate against anyone for exercising them.

Children

Imba Jobs is for people searching for jobs and is not directed at children under 16. We do not knowingly collect their data.

Security

Data is encrypted in transit; agent keys are stored only as hashes; IP addresses in OPT submissions are never stored, and their daily hashes are erased once the day is over; access to production systems is limited to the people who operate them. No system is perfect; if we learn of a breach affecting your data we will tell you.

Changes

When this policy changes we update the effective date at the top and, for material changes, note it on the site. The current version is always at /privacy.

Contact

No contact address has been published for this deployment yet. Use the self-service tools in How to see or delete your data.