Privacy Policy
Last updated: 31 October 2026. This is still a launch draft. The operator must add its legal identity, business address, privacy contact, jurisdiction and final processor/retention details before public launch.
Information you provide
CareerOS may process your target role, skills, project descriptions, learning progress, resume contact and education details, experience and portfolio links, interview practice answers and job application notes.
Guest mode
Guest workspace data is stored in local browser storage on the device you use. Clearing browser storage or changing devices can remove access to this data.
Signed-in workspaces
When Google OAuth is enabled and the user signs in, account workspace data is stored in Supabase. Row Level Security restricts workspace access to the authenticated account that owns it. Signing in merges existing guest and cloud records rather than blindly replacing the guest workspace.
AI coaching and provider choices
AI reviews are optional, available only to users aged 18 or older, and require a separate user action and consent. CareerOS provides two hosted Gemini reviews per authenticated account per day, subject to provider availability and server quota. The hosted service uses Google's unpaid Gemini API tier. Under Google's current terms, Google may use submitted content and responses to improve its products and services, and human reviewers may process them. Do not submit personal, sensitive, confidential or proprietary information to this hosted free tier. CareerOS redacts common direct identifiers (such as email addresses, phone numbers, URLs and long numeric identifiers), but this is not complete anonymization and does not replace the user's duty to remove personal data and confirm that the context is generalized. Review Google's Gemini API terms before use. Users can instead configure their own API key for Gemini, OpenAI, OpenRouter, Anthropic, Groq or Mistral. A personal key is held in the browser tab's session storage, sent through CareerOS's API only when a user requests analysis, and forwarded to the selected provider. CareerOS does not persist the key in the account database. The selected provider receives the submitted context under its own terms; provider costs and data handling are the user's responsibility. Do not use shared devices or submit credentials, government identifiers, employer secrets or data you lack permission to disclose.
Payments
Paid checkout is not active in this release. If subscriptions are enabled, payment credentials and card details should be handled by the payment provider; CareerOS should store only subscription identifiers, plan and status metadata required to provide the service.
Advertising and analytics
Advertising is not active by default. If advertising or analytics is enabled later, the operator must update this notice, implement legally appropriate consent controls and explain third-party processing before collecting related data.
Retention and deletion
Guest data remains in browser storage until removed by the user or browser. Signed-in users can request account deletion from the workspace account controls. Deletion requires a recently issued sign-in session, an explicit confirmation phrase and the server-side Supabase service key. Deleting the account removes the Supabase user and related database rows through cascading foreign keys. A browser-local guest copy is not deleted automatically; users should export data before deletion and clear local browser storage separately if they want that copy removed. This flow still requires a production end-to-end test after the server key and Google OAuth are configured. The operator must publish a valid privacy/support contact before broad public launch.
Security
CareerOS uses HTTPS, server-side secrets and database row policies in its planned signed-in architecture. No internet service can promise absolute security. Do not upload information you are not authorized to share.
Changes
This notice must be updated when data flows, processors, advertising, billing or legal operator details change.