Legal
Privacy Policy
Last updated: September 2026 · GDPR-compliant · EU servers
JobHiker is built on one core belief: your career data is yours. This document explains what we collect, why, and what we do to protect it.
What we collect
We collect the email address you use to register and the CV text you upload. We also collect minimal usage data (jobs saved, notification settings) to power your account dashboard. If you subscribe, payment is handled by Lemon Squeezy as the merchant of record — the payment form is theirs and no card details ever reach our servers. We store only your subscription's status, its trial and billing period dates, and the provider's own subscription and product identifiers.
How we use it
Your CV text is sent to our AI providers to score jobs against your profile and, when you explicitly request a cover-letter draft, to generate that draft from your CV and the posting. Draft generation is optional and never submits an application. We do not use your CV for advertising or to train AI models. Email is used for authentication, transactional emails, and the optional match notifications (which you can disable at any time); if you subscribe, it is also passed to our payment provider so the subscription can be matched to your account.
Storage and security
CV data is stored encrypted at rest (AES-256) on servers in the EU, and is decrypted server-side for scoring and cover-letter generation. Generated letters are also encrypted at rest; they are included in your data export and deleted with your account. All traffic is protected with TLS in transit. We store no raw personal documents beyond the encrypted CV you upload.
Self-hosted users
If you run the self-hosted version of JobHiker, none of your data ever reaches our servers. You are responsible for securing your own deployment. The self-hosted version is AGPL-licensed and auditable.
Data retention
Your account data is retained for as long as your account is active. You can delete your account at any time from your account menu, which immediately purges all personal data including CV text. Backups are purged within 30 days.
Cookies
We use one session cookie for authentication. No advertising cookies, and nothing that follows you to other sites.
Product analytics
We measure how people move through signup so we can find and fix the places it goes wrong. This runs on PostHog, hosted in the EU. Until you opt in, it stores nothing on your device — no cookies, nothing that survives the tab — and we ask for that opt-in at the signup step, not before. If you decline, it is switched off entirely and we do not ask again. We record which steps you reached, never the contents of your CV.
Your rights (GDPR)
You have the right to access, correct, export, or delete your personal data at any time. To exercise these rights, email hello@jobhiker.com or delete your account from your account menu. We will respond within 72 hours.
Contact
Questions or complaints: hello@jobhiker.com. For GDPR-specific requests, add 'GDPR Request' in the subject line.