Privacy
No Varnish holds very little about anyone. There is no builder account, no CV, no application data and no profile. Applying happens on the employer’s own site, so the part of a job hunt that carries the most personal data never touches us at all. That small footprint is the strongest privacy control here, and it is deliberate.
What we store
| Data | Who it is about | Why |
|---|---|---|
| Email address | Job alert subscribers | To send the digest you asked for |
| Email address and company | Employers | To run your listing and let you sign in |
| Session cookie | Employers | To keep you signed in |
| Visitor hash | Visitors | To count views without identifying you |
| Reporter hash | People who report a listing | To show you that you already reported it |
| IP address | Visitors | Rate limiting only. Never written to a table |
| A daily count, per page | AI crawlers, and visits arriving from an AI answer | To see whether AI engines read the site. No identifier is stored |
Analytics without tracking
We count page views and apply clicks so employers can see whether their listing is working. The identifier behind those counts is a hash of your IP address, your browser’s user agent and a salt that rotates every day. Because the salt changes daily, yesterday’s hash cannot be matched to today’s, so there is no way to follow a person across days.
We also keep a tally of how often AI engines read the site, and how often somebody arrives here from an AI answer. That one has no identifier at all — not a hash, not an IP address, not a row per visit. It is a single number per day, per engine, per page, so it can say “this page was read forty times” and can never say who read it. Query strings are discarded before it is written, so anything you type into the search box never reaches it.
Page views are also reported to Google Analytics — but only if you accepted when asked. Google then sets two cookies, _ga and _ga_QQLBWESQZ5, which keep an identifier on your device so it can tell a returning visitor from a new one. Your IP address is used to derive an approximate location.
If you refused, or have not been asked yet, the Google tag is not loaded at all — no request is made to Google and no cookie is set. Refusing is one click, is remembered for a year exactly as accepting is, and you can change your mind from Cookie choice at the bottom of any page.
An earlier version of this page said Google set no cookies, on the strength of a “cookieless” setting that turned out not to work. That is why the choice is now asked rather than assumed.
Cookies and local storage
One cookie exists before you choose anything: the employer session. It is strictly necessary and needs no consent. The two Google Analytics cookies above are the only others, and they appear only after you accept.
Up to three values may be kept in your browser’s local storage — a draft of the post form, the timestamp of your last visit so the feed can mark what is new, and your answer to the cookie question, which is stored here rather than in a cookie so that recording a refusal does not itself set one. None of them leaves your device and none identifies you.
How long we keep things
| Data | Kept for |
|---|---|
| Unconfirmed alert signups | 7 days, then deleted |
| Raw view and click events | 90 days |
| Reporter hash | 12 months |
| Sessions | 30 days, rolling |
| Rate limiting keys | The length of the window only |
| Do-not-contact records | Permanently, on purpose |
| Listings, companies, and daily totals | Indefinitely |
A do-not-contact record outlives everything else because deleting it would let us contact you again, which is the opposite of what it records.
Your rights
- Subscribers. Every digest has an unsubscribe link that removes your saved search, its matches and your address immediately. It takes one click and asks for no confirmation — asking you to confirm by email before deleting your email would be circular.
- Employers. Write to us and we will expire any live listings and anonymise your account.
- Anyone emailed about a sourced listing. One click removes you and your whole domain, permanently. See the sourcing policy.
- Access or correction. Ask, and we will assemble it by hand. There is little enough that this is realistic.
Who else processes this
These third parties are involved in running the site: hosting (Vercel, United States), the database (Supabase, EU), email delivery (Resend), analytics (Google Analytics, United States). The database is provisioned in the EU. Currency rates are fetched from a public source that receives no personal data.
This page describes what the product actually does, and is kept in step with it. It is not legal advice.