Privacy & Data

What we collect

The information you type into the intake form (job title, department, responsibilities, qualifications, and similar fields) to generate a document. If you sign in, your email address, and every job description you generate while signed in — this is what powers My JDs, so you can come back and re-download it later; see the next section. If you sign up for law-change alerts, your email and which states' changes you asked to hear about. If you leave your email on the free Pay Transparency Checker or Inclusive Language Scanner, that email and which tool you used, so we can follow up with relevant emails — and we record which follow-ups we've already sent, so we don't email you the same thing twice. If you share a report card, a random share token identifying that shared link. If you use our API (when available), an API key credential and basic usage counts for billing and abuse prevention. If you make a purchase, your payment is handled entirely by Stripe — we never see or store your full card number. If you submit feedback, whatever you write there. None of the above is ever sold or shared with third parties for marketing, and you can ask us to delete it anytime. We also log IP addresses briefly for abuse prevention (rate-limiting free usage), not for tracking individuals.

Accounts, alerts, shared links, and API keys

A little more detail on the newer pieces, in plain terms:

• Magic-link accounts: your email address, plus a temporary session token while you're signed in. We keep your email so you can sign back in and reach your saved items; ask us to delete your account and we remove it and its saved data.
• Law-change alert subscriptions: your email and which states' law changes you subscribed to, so we can email you when something relevant changes. Every alert email includes an unsubscribe link, and we delete the subscription when you unsubscribe.
• Email follow-ups: if you came from a free tool and left your email, we note which follow-up emails we've sent so we don't repeat ourselves. You can unsubscribe from any email; we stop sending and delete your signup on request.
• Shared report links: each shareable report-card link gets a random token, stored alongside the report it points to so the link keeps working. The token is kept until the link is revoked or the underlying saved item is deleted.
• API keys: if API access is available to you, each key you create is stored in hashed form (we can't recover the key itself), linked to your account along with basic request counts for billing and abuse prevention. You can rotate or deactivate a key anytime; deactivated keys are removed from active use, with brief security logs kept for a short period afterward.

How AI generation works

To generate a job description, the information from your intake form is sent to Anthropic (Claude) or OpenAI, depending on which provider is configured. We don't control their systems, but as of today both providers state that data submitted through their API is not used to train their models by default. We'd encourage you to check Anthropic's or OpenAI's current policies directly if this matters for your organization's compliance requirements — we're summarizing their public position, not making a guarantee on their behalf.

Resume feedback

If you use the Resume Feedback tool, the resume you upload or paste and the job description you paste are sent to Anthropic (Claude) to write the feedback. We read an uploaded file in memory to extract its text and don't keep the file, the resume text, the job description, or the feedback — they aren't saved to a database or attached to an account, and we don't put their contents in our logs. Like the other free tools, we count that the tool was used (never what you entered) and log your IP address briefly to enforce the daily limit. Because a resume contains personal details, only include what you're comfortable sending to an AI provider; the Anthropic policies linked above apply.

Generated documents

The job description itself — the actual generated content — is built and sent back to you as a file in the same request. If you're not signed in, we don't save a copy of it afterward. If you are signed in, we save the intake and generated content (not the file itself) so it shows up under My JDs and can be re-downloaded later; you can delete any saved job description from that page yourself, anytime. Beyond that, what we retain (in our database) is limited to purchase/subscription records so we can enforce how many generations you've paid for, account and alert-subscription records described above, share-link tokens for shared reports, and anything you explicitly submit through the feedback form or the free tools' email signup.

How long we keep data

We don't keep your data longer than we need it. In plain terms:

• Saved job descriptions: kept until you delete them. You can delete any saved JD yourself from the My JDs page anytime, and they're deleted automatically if you delete your account.
• Email signups (from the free tools or anything else you sign up for): kept until you unsubscribe or ask us to delete them.
• Feedback you submit: kept until you ask us to delete it.
• Purchase and subscription records: kept as long as needed to enforce your generation allowance, prevent abuse, and maintain billing records.
• Aggregate usage counts: our own daily totals (visits per page, referral sources) are kept for about 13 months (400 days) so we can compare year-over-year; they contain no names, emails, or IP addresses.
• Rate-limiting data: temporary counters tied to your IP expire about a day after your last request.
• Bulk CSV audits: never uploaded, so never retained — see the section below.

Your deletion and access rights

You can ask us what personal data we have about you, ask us to delete it, and opt out of any emails — and we'll honor those requests. We never sell your personal data and never share it with third parties for marketing, so there's nothing to “opt out” of on that front. To make a request, email privacy@jobdescriptiontool.com from the email address you used with us, telling us what you'd like us to do (delete your saved JDs, remove your email signups, tell you what we have, etc.), and we'll take care of it.

Bulk CSV audits

The bulk pay-transparency audit on our /audit page runs entirely in your browser: your CSV is read and scanned by code in the page itself, and never uploaded to our servers. Because of that, we have nothing to retain and nothing to delete afterward — the file and its results exist only on your computer. To be explicit: we do not train models on your data. The bulk audit makes no AI call at all (it's a pattern-matching scan), and nothing you upload through it is used to train any model.

Saved defaults

If you use the “remember my defaults” feature (department, job code, EEO-1 classification, etc.), that's stored in your own browser's local storage, not on our servers — we never see it. You can clear it anytime from the form itself.

Uploaded documents and instructions

If you upload a document to pre-fill the job description form, or type additional instructions or a change request, that text is sent to our AI provider to read it and write the draft. We read the file once to extract its text, we don't store the file or its contents, and we don't log them. Please don't upload files containing personal details about individuals (such as resumes or performance reviews). We keep only anonymous usage counts, such as how many documents were imported that day.

Analytics and error monitoring

We use Vercel Analytics, which is cookieless and doesn't track individuals across sites. We use Sentry for error monitoring, which may capture technical details about a request (like the page you were on) if something breaks, so we can fix it — not to profile you.

We also keep our own aggregate usage counts, such as how many visits started on each page, which kind of site referred them, and whether a free tool was used. These are stored only as daily totals, with no names, email addresses, or IP addresses. Your browser keeps a temporary session marker (cleared when you close the tab) so a visit isn't counted twice, and your IP address is used briefly to limit abuse and deleted within about a day.

Cookies

We don't use third-party advertising or tracking cookies. The only cookies this site sets are the ones it needs to function:

• jd_access — proves a completed purchase or active subscription, so you can use the generations you paid for. Not readable by page scripts, lasts about a year.
• jd_checkout_nonce — a temporary security cookie used only while a Stripe checkout is in progress; deleted once the purchase is confirmed.
• jd_admin — site-owner admin session cookie; not readable by page scripts, lasts about 30 days.
• jd_admin_ui — a visible-to-scripts copy of the admin login state (site owner only) used as a display hint; it grants no access by itself.
• sb-<project-id>-auth-token — set by Supabase to keep you signed in when you use magic-link login (the exact name includes our Supabase project ID).

You can delete these cookies in your browser settings anytime — doing so just signs you out or ends your purchase-access session. Your account and saved JDs are stored on our servers and come back when you sign in again.

Your choices

You can use the tool without creating an account. You can clear your saved defaults anytime. If you'd like us to delete data associated with your email, alert subscriptions, share links, API keys, or purchase records, email privacy@jobdescriptiontool.com and we'll take care of it.

Changes to this page

We're a small, early-stage product and this page will be updated as the product (and our data practices) evolve. Check back if it's been a while.

Contact

Questions about any of this? Email jobdescriptiontool@gmail.com. See also our Terms of Service.