Privacy Policy
Effective October 7, 2026
1. The short version
- We don't sell your data or share it for advertising. There are no ad trackers on Posted.
- Google Analytics runs only if you say yes in the cookie banner. A Global Privacy Control signal counts as no.
- Your resume is private to you. We use it to fill in your profile and match you to jobs.
- Your profile is visible to signed-in members only, unless you make it public.
- You can download everything we hold or delete your account yourself, any time, from Settings.
2. Who we are
Posted.Careers ("Posted", "we") is a job board and professional community: the website at posted.careers, the Posted mobile app, the Posted.Careers Assistant browser extension, and the job emails we send. The company responsible for your personal data (the "controller") is YesYep LLC, 141 W. 36th, 22nd floor, New York, NY 10018.
Questions, requests or complaints about privacy: privacy@posted.careers. We answer within 30 days.
3. What we collect and why
For people in the EU, UK and similar places, the law asks us to name a "legal basis" for each use. "Contract" means we need it to provide the service you signed up for. "Legitimate interests" means a reasonable business need that we've weighed against your privacy, and you can object. "Consent" means only if you say yes, and you can take it back.
| What | Why | Legal basis |
|---|---|---|
| Account: email, password (stored only as a hash), or your Google or Apple sign-in | Create and secure your account | Contract |
| Profile: name, username, photo, headline, location, phone and contact email (if you add them), links, school, what you're looking for | Your profile, and how members find and contact you | Contract |
| Resume and what we read from it: work history, education, skills, employers, job titles | Fill in your profile, match you to jobs, suggest Exchange posts and job alerts | Contract |
| Job activity: job alerts, saved jobs, which jobs you open | Send your alerts, keep your saved list, count which listings get used | Contract; counting is legitimate interests |
| Community activity: Exchange posts and responses, endorsements, circle connections, profiles you view | Run the Exchange, circles and endorsements; tell members who viewed them (unless you browse privately) | Contract; view notifications are legitimate interests |
| Billing: plan, subscription status, Stripe customer id. Card details go to Stripe; we never see them. | Charge for paid plans and manage your subscription | Contract; tax records are a legal obligation |
| Campus and referral codes: which code you used, who referred you, campaign link details (utm tags) | Apply your free trial and credit the referrer | Contract |
| Device: push notification token, app version, platform | Send push notifications you’ve allowed | Contract |
| Campaign page views: a one-day code made from your IP address and browser, which we can't reverse or link across days | Count unique visits to campus campaign pages | Legitimate interests |
| Analytics: pages you visit and how you got here, through Google Analytics | Understand which pages get used | Consent (the cookie banner) |
| Server logs: IP address, browser, time of request | Keep the service running and secure, investigate abuse | Legitimate interests |
Job listings come from employers' public pages. We remove personal email addresses from the listing text we keep, leaving only role inboxes like careers@.
We don't ask for sensitive information like health, religion or ethnicity. If your resume contains it, it's processed only as part of your resume and never used for anything else.
4. AI and match scores
When you upload a resume, we send it to Anthropic, the company behind Claude, to read it and turn it into profile details. We also use Anthropic to suggest Exchange posts from your work history, tailor resume text to a job when you ask, and screen Exchange posts for abuse. Anthropic processes this only on our behalf, doesn't use it to train its models, and keeps it only briefly under its commercial terms.
We compare the skills from your resume with each job's requirements to give a match score. It decides the order of Fresh Jobs and your daily email, and adds a "best matches" section. It never hides jobs from the site, and no employer sees it. You can turn it off under Settings, Privacy, "Rank jobs by my resume".
No decision with legal or similarly significant effects on you is made by automated means alone.
5. Who can see what
- Your profile (name, photo, headline, location) is visible to signed-in members. Turn on "Public profile" and anyone can see it, search engines included.
- Work history and education are visible to signed-in members. Members who've worked at a company can show up, as counts, on that company's job pages. Turn on "Hide my employers" and your work history, employers and clients are visible only to you, and you don't count toward those numbers.
- Your email, phone and resume file are never shown to other members. When you respond to someone's Exchange post, they get your message with your email as the reply-to address, so they can answer you.
- Exchange posts go to your circle unless you choose public.
- Profile views: when you view a profile, its owner is told, unless you turn on "Browse profiles privately".
- Classmates: students who joined with the same campus code see each other only if both turn on "Show me to classmates".
- Our team: a small number of administrators can see account data to run the service and answer support requests.
6. Companies that process data for us
These companies handle data only to provide their service to us, under contracts that limit what they can do with it. We don't sell personal data to anyone, and we don't share it for cross-context behavioral advertising.
| Company | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage (all account data and resumes) | United States |
| Netlify | Hosting the website and its servers | United States |
| Anthropic | Reading resumes, AI suggestions, abuse screening | United States |
| Stripe | Payments and subscriptions | United States |
| Mailgun (Sinch) | Sending email | United States |
| Expo | Delivering push notifications to the app, via Apple and Google | United States |
| Google sign-in (if you use it); Google Analytics (only with consent) | United States | |
| Apple | Sign in with Apple (if you use it); app push notifications | United States |
| Mux | Streaming the homepage video, only when you press play | United States |
| Komoot (Photon) | Suggesting places as you type your location (through our server, so Komoot never sees your IP address) | European Union |
We may also disclose data if the law requires it, to protect people's safety, or as part of a merger or sale of the business, in which case this policy keeps applying to your data.
7. Email
Your daily Fresh Jobs email and job alerts are part of the service. Activity emails tell you about responses, endorsements, circle requests and profile views. News and trial tips are occasional. Every email has a one-click unsubscribe that stops that kind of email, and email settings control each type. We don't track whether you open our emails or which links you click in them.
8. Cookies
We use only the cookies the site needs, plus Google Analytics if you allow it. Change your answer any time with "Privacy choices" in the footer or in Settings.
| Cookie | Purpose | Lasts | Needs consent |
|---|---|---|---|
sb-…-auth-token | Keeps you signed in | Until you sign out (up to 400 days) | No |
posted_consent | Remembers your cookie choice | 6 months | No |
posted_beta | Holds a campus or referral code until you finish signing up | 30 days | No |
_ga, _ga_* | Google Analytics: tells visits apart | 2 years | Yes |
The site also keeps small notes in your browser's local storage, such as which banners you've dismissed. They never leave your device.
9. The mobile app and browser extension
The app uses the same account and data as the website. It asks for your photo library only to set a profile photo, and for notifications only if you allow them. It doesn't track you across other apps or websites.
The browser extension signs you in by reading your posted.careers session cookie. When you click "Tailor", it reads the text of the page you're on and sends it to Posted, with your work history, to draft resume text for that job. It does nothing until you click, and it doesn't record your browsing.
10. How long we keep it
| Data | Kept |
|---|---|
| Account, profile, resume and everything you’ve created | Until you delete your account (deletion is immediate), or after 18 months without use: we email a warning 30 days before, with a one-click link to keep it. Paid accounts are never deleted this way. |
| Old resume files and photos you replaced | Deleted within a day or two |
| Database backups | 7 days, then overwritten. A deleted account is gone from backups within 7 days. |
| Billing records | Stripe keeps invoices as long as tax law requires; we delete our copy with your account. |
| Profile views | 90 days |
| Notifications | 12 months |
| Which jobs you opened | 13 months, then the count stays without your account attached (or sooner, if you delete your account) |
| Campaign page view counts | The daily visitor code goes after 13 months; the counts stay |
| Server logs | A few days, at our hosting providers |
| Google Analytics data | As set in Google Analytics, at most 14 months |
| Proof that we deleted an account | A scrambled (hashed) copy of the account id and the date, kept so we can confirm a deletion |
11. Your rights
The privacy dashboard shows who can see what, what we hold about you, and every control below in one place. Wherever you live, you can:
- See and download your data: Settings, "Download my data".
- Correct it: edit your profile and work history.
- Delete it: Settings, "Delete my account".
- Stop emails: one click in any email, or email settings.
- Object to profiling: turn off "Rank jobs by my resume".
- Withdraw consent: "Privacy choices" in the footer.
If you're in the EU, UK or a similar place, you also have the rights to restrict how we use your data, to object to processing based on legitimate interests, and to complain to your data protection authority. We'd like the chance to fix it first: privacy@posted.careers.
Anything you can't do yourself, email privacy@posted.careers from the address on your account. We answer within 30 days.
12. California residents
Under the California Consumer Privacy Act, as amended by the CPRA, this is what we've collected in the last 12 months:
| Category | Examples | Disclosed to |
|---|---|---|
| Identifiers | Name, email, username, account id, IP address | Service providers in section 6 |
| Customer records | Phone, billing status | Supabase, Stripe |
| Professional or employment information | Work history, job titles, employers, skills | Supabase, Anthropic |
| Education information | Schools, degrees | Supabase, Anthropic |
| Commercial information | Plan and subscription history | Stripe, Supabase |
| Internet activity | Jobs opened, profile views, pages visited (analytics only with consent) | Supabase, Google (with consent) |
| Inferences | Job match scores | Supabase |
| Sensitive personal information | Account login and password | Supabase |
Sources: you, your use of the service, and Google or Apple if you sign in with them. We use this information for the purposes in section 3, and keep it as described in section 10.
We do not sell or share personal information, as the law defines those terms, and never have for anyone under 16. We use sensitive personal information only to provide the service, so the right to limit it doesn't apply. We honor Global Privacy Control as an opt-out.
You have the right to know, access, correct and delete your personal information, and to not be treated differently for using these rights. Use the controls above or email privacy@posted.careers. We'll confirm your identity by matching the request to your account email. An authorized agent can make a request for you with your signed permission.
13. Children
Posted is for people 16 and older, and isn't directed at children. If you believe someone under 16 has an account, email privacy@posted.careers and we'll delete it.
14. International transfers
Posted runs in the United States, and so do most of the companies in section 6. When data about people in the EU, UK or Switzerland goes to the US, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents), or the EU-US Data Privacy Framework where the company is certified.
15. Security
Data is encrypted in transit and at rest. Each member can reach only their own private data, a rule the database enforces. Resumes sit in private storage that only their owner can open. Admin access is limited to a few people. No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.
16. Changes
If we change this policy we'll update the date at the top. If the change matters, we'll email you before it takes effect.