How we handle your data

We never store your JobAdder candidates or your LinkedIn connections. Your data is processed in memory, compared, and discarded. The only thing we keep is your email address — and only because we need it to send you the results.

When you connect JobAdder, we read your candidates in small batches. For each candidate we compute only two one-way cryptographic hashes:

• A hash of their normalised email address
• A hash of their name and current employer

Everything else — full names, phone numbers, notes, job history, candidate IDs — is discarded immediately. The hashes are sent straight to your browser and nothing is retained on the server between batches. Never written to disk, never stored in a database, never logged. Your JobAdder access token is discarded the moment the last batch completes.

Your Connections.csv never leaves your browser — not the names, not the emails, not the LinkedIn URLs, not even in hashed form. Your browser computes the same two hashes for each connection and runs the comparison itself, on your device. Our server never sees your LinkedIn data at all.

The hashes are SHA-256 digests of normalised fields. A hash can be compared for equality but can't be reversed to recover the original text, so the comparison works without either list being exposed. The hashes of your JobAdder candidates are only ever sent to one place: your own browser, over HTTPS, during your own audit.

When you unlock the full results list, we capture your email to:

• Send you the list (the whole point)
• Follow up with a short email sequence about Sprout (over 14 days)

Your email is never associated with any candidate names, connection names, or audit results. We store only: your email, how many connections were missing, and a timestamp.

You can unsubscribe at any time using the link in any email we send you.

• Vercel — hosts the application. Sees request metadata (IP, path, timing) but not your audit data.
• Resend — sends your results email. Sees your email address and the list of missing connections (because we have to email it to you).
• Supabase — stores your email and audit summary (not the list itself). EU region.
• Analytics — we count, anonymously, which steps of the audit people reach (visited, connected, uploaded, completed) under a random session token, plus a coarse size band for completed audits (e.g. “2k–5k connections”). No names, no emails, no third-party trackers, no cookies beyond our own session.