Policy

Privacy

Honestly, the site processes some information the moment you load it, and more if you subscribe. This page says what that is.

Contact support@findyourrolefirst.click for account or privacy requests. Please don't send resumes, identity documents, payment cards, or full API keys.

What we process

Hosting providers see network and request data: IP address, path, time, and device headers. The app hashes the IP for rate limits. A hash isn't anonymous. Search parameters are processed to answer the request. We don't keep a free-text search history in an account table. Provider logs may still record query strings.

We previously collected names, emails, and countries for a waitlist. New signups are closed. Earlier messages included an unsubscribe link, which still works. Existing records remain until we set and publish a deletion schedule.

If you create an account, we store your checkout email, an account ID, agent-key hashes and prefixes, browser-session token hashes, subscription status, paid-access dates, usage totals, and the source job IDs already delivered to you. Agent keys pass through API authentication. A separate token in an HttpOnly cookie signs in your browser; the database stores only its hash. We can send a short-lived, single-use sign-in link to your checkout email. The link token is stored as a hash, and the email never contains an agent key. Signing in doesn't replace your agent keys.

When you connect an AI agent by signing in ("Allow" on our sign-in page), we store the name and return addresses the agent registered with us, a short-lived single-use code, and hashes of the agent key and refresh token we give it. That key works only through our MCP server, lasts an hour, and is renewed with the refresh token; a refresh token used twice ends every key from that sign-in. Rotating your agent key in the console ends the agent's access. The agent can search the feed and read your preferences and saved roles, and it can save roles, mark where they stand, follow companies and set email alerts for you; it can't pay, or change your plan, key or profile. We never apply for you; an agent you ask to apply does that on the company's own site.

For the first-month offer and referrals we also store your referral code, which account referred yours (if any), whether and when a referred account paid, a normalized form of your email so the offer is used once per person, the single-use discount code issued to your account, and any referral refunds. Someone who referred you can see a count of their referrals that paid, never who you are.

If you sign up for the newsletter, we store your email, whether you chose daily or weekly, when you signed up, confirmed and last got an email, and a hash of the IP you signed up from (to stop mass sign-ups). We email a confirmation link first and send nothing else until you click it. Every newsletter has a one-click unsubscribe; unsubscribing stops all newsletter email. Newsletters are sent through Resend from news.findyourrolefirst.click.

Public job metadata lives in a separate store from account records. The billing provider processes payment and contact details when you subscribe. We don't store full card numbers in the Find your role first database.

Who sees it

Cloudflare serves the frontend and proxies API and MCP traffic. Google Cloud runs the backend and database, in the United States, and keeps encrypted backups there for 30 days. Resend sends account access links. If you sign in with Google, Clerk handles that sign-in and tells us your Clerk user ID and the email address on your Google account; we store those two things and nothing else from it, and Clerk's own script runs only on the account page, where it keeps your Google sign-in current, so Clerk also records the days you open your console. Signing out ends it there too. We use that data to authenticate, return jobs, meter usage, stop abuse, send those emails, and answer support. Your own AI client receives the jobs you request and applies its own policies. Opening an employer link sends you to a different site. If you write a line about the work you want, or use Suggest from my résumé, that text is sent to Voyage AI (through MongoDB Atlas) to turn it into numbers we compare with job titles. If you add a résumé, we keep the file in your account so you can see, download and reuse it from your profile; only you can see it, we keep your last three, and deleting one removes it. We read it to suggest roles, focus words, places and your years of experience, which become your preferences and fit profile. Company logos load from Logo.dev, so your browser asks Logo.dev for each logo by company name; that request carries your IP address and browser details, as any image request does, and nothing about your account.

The site has no advertising scripts. Cloudflare Web Analytics counts page views on our public pages: it sets no cookies and doesn't identify you, and it records the page, the referring site, your country, and your device and browser type. Live responses include Cloudflare Network Error Logging headers, which can report failed network requests to Cloudflare.

Children

The service isn't meant for anyone under 16 (or the age of digital consent where they live, if higher), and we don't knowingly collect their data. If we learn we have, we delete the account and its data. Tell us at support@findyourrolefirst.click.

Cookies

jf_session authenticates the browser account. It lasts up to 30 days and uses SameSite=Strict. jf_checkout binds checkout to the originating browser for one day and uses SameSite=Lax, so the payment provider can return you here. Both are HttpOnly. jf_ref holds a referral code from a link you opened, for up to 30 days, so the sign-in that follows can credit whoever shared it; it uses SameSite=Lax and carries no access. They're Secure on HTTPS. Logout clears the session cookie. Blocking them breaks the browser account flow. API clients use a bearer header instead.

How long it stays

Change records and old closed jobs are kept about 90 days. Job-delivery ledgers stay for about three to four months. Rate-limit buckets can drop after five minutes. Access links expire after 15 minutes and are removed by the cleanup job after another day. Account records and claimed checkout references currently have no automatic deletion clock. Backups and provider logs may last longer than the app tables.

For access, correction, or deletion requests, email support@findyourrolefirst.click. We'll verify ownership without asking for the full key. Some records may have to stay for a legal reason. Account deletion isn't a self-serve button yet.

That's the list.

Effective 29 September 2026. This notice describes current processing. It isn't a GDPR or CCPA compliance claim.