Your job hunt and your career are nobody's product.

What we store, and why

• Your account basics: your first and last name, your email, a mobile number only if you choose to give one, and your money settings (KiwiSaver rate, student loan yes or no) so take-home pay is right. A mobile is never texted for marketing unless you tick the separate box for that; giving the number is not saying yes.
• Where you are at, only if you choose to say: one optional answer, such as studying, changing career or new to New Zealand. It is kept to choose which guides and tools come first for you, and nothing else: it never changes what is free or what you pay. It is never shared with anyone, including Brevo, an AI tool, an employer that paid for your seat and the anonymised statistics. Change or clear it in Settings; it is in your export and erased with your account.
• What you put in: jobs, contacts, notes, dates, salaries, documents' details. This is your working data. It exists so the product works, and for no other reason.
• Career mode, if you use it. Your job and its dates, your pay record, your wins, your 1:1 notes, goals, skills, CPD hours and certificates. They are kept on our server in Auckland so they follow you to your phone and are backed up, and the words you write in them are encrypted before they are stored, with a key that is not kept with the database or its backups. Amounts and dates are kept as they are, so a reminder can be worked out without reading anything you wrote. None of it is ever shown to an employer, including one that paid for your seat. If you turn on career mode's email reminders, Brevo is told only that a reminder is due and which kind, never what it is about. It is in your export and erased with your account. A parental leave due date and the life events you tick off stay on your device only.
• Praise notes, if you ask a colleague for one. Your Career can make a link that asks one colleague for a few lines about something you did. You send it yourself; we never contact them. The colleague gives their name, how they know you and the note, and nothing else: no account and no email address. It is kept only in your record, encrypted the same way as the rest of your career words, and it is never used or quoted by us or shown to anyone else. You can hide it or delete it, but not change it, because the words are theirs. They are shown a private link, once, to change or withdraw it, and a withdrawn note leaves your record at once; when a note is withdrawn or deleted, its words are deleted and only the date it arrived is kept, as a number we count. The link itself is kept only in a scrambled form we cannot turn back into the link, and ends after 30 days, once a note is sent, or when you revoke it. Praise notes are in your export and deleted with your account. If you are the colleague, that note is everything we keep about you, and it goes when you withdraw it, or when they delete it or their account.
• Your Timesheets, if you use it. The places you work, and for each piece of work the date and the hours, a start and finish time and a note if you add them, and, while a timer is running, the moment it started, so a phone that goes to sleep loses nothing. With Career and Timesheets or On the Move it also keeps your projects and tasks, your rates and settings (the billing method, whether work is billable, and rounding), a project's budget, and a project's contact and who asked for a piece of work, who are people already in your Contacts. It is kept on our server in Auckland, like career mode, and your notes and the names of your projects and tasks are encrypted before they are stored, the same way as the rest of the career record. Hours, amounts, dates and settings are kept as they are, so totals and reports can be worked out. Every earlier version of an entry is kept by our database, not your device, each time the entry is changed or deleted, so you can see what changed and when; its note stays encrypted there too. Delete an entry and the notes in its history are deleted with it; the dates and hours stay, as the record of the work and that it was removed, until you erase your account. The CSV and the PDF timesheet are made in your browser and saved to your device, and we send them nowhere. Invoices you make keep the client's name and details, the lines and your notes encrypted, and your invoicing details (the name you invoice under, your bank account and GST number) are encrypted too; an expense keeps its description encrypted, with its date, amount, kilometres and rate as they are. A share link is made only when you press Share a link: we keep an encrypted copy of the hours you chose to share, and the link's code only in a scrambled form we cannot turn back into the link. Anyone with the link can see that copy, read-only, until it ends after 30 days or you turn it off; we count how often it is opened, and delete it 30 days after it ends. If you tick Ask them to sign it off, whoever opens it can sign the hours off or query them, once: a sign-off records the signer's typed name, role, drawn signature and the time (and any comment), encrypted except the time, and nothing about their device; it is kept with your account, shown only to you, never emailed to anyone, and kept until you erase your account. None of it is shown to an employer unless you choose to share it with a team (below). It is all in your export, earlier versions included, and erased with your account, except a copy you have shared with a team.
• When you accepted the terms' section on tax figures. Section 6 of our terms says every tax figure is an estimate only. We record when you accepted it: at sign-up, or when you tick the box at the top of Your Timesheets' Tax and GST page. Each record holds your account, the version of the section and of the terms, and the date and time; nothing about your device. It is in your export, and it is deleted with your account.
• Files you upload, if you choose to. A CV, a certificate or a reference letter, stored on our server in Auckland and encrypted, each file with a key of its own. A file is only ever sent back to you. It is never sent to an AI tool, and never to anyone else.
• The words of a CV you upload. A CV is uploaded as a PDF or Word file, never pasted, and the text of an uploaded CV is read on our server to check it against jobs: when it arrives, or for a CV already in Documents, once, the next time you open the app. The words come back to you and are kept with the rest of your job hunt, on your device and in your account, so the keyword check, CV Match and Tailor My CV can use them. The reading itself keeps nothing and logs nothing. When a file cannot be stored (the free plan keeps one CV file), it is read the same way and the file is not kept, only its words. The CV Builder can fill its form from a CV of yours in the same way: one in Documents, or a file uploaded there, which is read for its words and not kept, and is not added to Documents. Its words come back to that page, and go into the form only when you say so. The words of the CV you choose go to Anthropic only when you press CV Match, Tailor My CV or the CV Builder's AI tidy, as set out below.
• Your evidence index, if you have a paid plan and use CV Match. To find the experience in your own records that answers a job ad, our server keeps an index of it: the lines of your own CVs, your wins in Your Career (not a win recorded as praise, which is somebody else's view of you), skills, certificates and CPD, the jobs you have held (the title, employer and dates, never the pay), and your prepared interview answers. Never your 1:1 notes. It is not new information: every word of it is a copy of a record you already keep here, and it is rebuilt from those records, so a record you change or delete changes or leaves the index too, a deletion at the next sync. It is encrypted before it is stored, the same way as career mode's words, is never shown to anyone at jobtracker.co.nz or to an employer, and is deleted with your account.
• What Tailor My CV suggested for a job, and what you decided. Each time you tailor a CV, we keep the suggestions, the kind of each, the records each one was built from, and whether you accepted, edited (with your words) or skipped it, with the match score before and after, so the job can show "What we changed for this job". It is encrypted before it is stored, the same way. The tailored CV itself is kept in Documents as a Word file, linked to the CV it came from and to its job. Our admin screens only ever count these (how many tailorings, how many suggestions were accepted, edited or skipped, and the average scores), and only once enough people are behind a figure that nobody can be picked out. They are deleted with the job, or with your account, and are in your export.
• A seat from an employer, if you use one. When an organisation buys twelve months of On the Move for people it is letting go, each person gets a code. If you use one, we record that your account used it, because the seat cannot run otherwise. The organisation is never told: not whether you used your code, not anything in your account. Once ten or more of its codes have been used it sees a count, in steps of five, so no one person can be picked out. If you are the one buying seats, we keep your organisation's name, any PO number, the order and its codes, for the seven years tax rules require.
• Feedback and the check-in, if you send them. What you write in the app's Feedback box or the short check-in for early members, with your email address and the screen you were on, so James can reply. Nothing from your job hunt goes with it. It is deleted with your account if you erase it. We never quote you publicly, or use your words to promote jobtracker.co.nz, without asking you first. If we would like to, we ask, and we use only what you agree to, such as your first name and your role.
• A message, if you send us one through the contact form. Your name, your email address, what it is about and your message, kept to answer it and deleted two years after it arrives. It is emailed to us so we can reply, and it is never added to a mailing list or used for marketing.
• A quote request, if your organisation asks for one. The organisation, your name, your work email, a phone number if you give one, and what you tell us in the form at /employers/quote, kept to answer the request and prepare the quote and invoice. They are never added to a mailing list or used for marketing.
• An application for the startup offer, if your company makes one. What you type in the form at /startups: the company's legal name and NZBN, a company email, your name and role, the seats wanted, the year of incorporation and the number of staff as you state them, where you heard of the offer, any note, and the declarations you ticked, with the date. To check the application we look the company up on the New Zealand Business Number register, a public register, by its NZBN, and keep three things from it: the registered name, the status and the registration date. Nothing else from the register is kept, and nothing about you is sent to it. We keep our own decision and working notes beside the application. All of it is kept to decide the application and to run the team, and is never added to a mailing list or used for marketing. An application we decline is deleted 12 months after the decision, and so is an approved one whose link was never used; an approved application is kept while its team is with us. The page also counts its visits by the partner link they arrived on (a directory's or an accelerator's), as a number for the day and nothing else.
• Almost nothing else. Our own analytics are privacy-first and cookieless: they count pages, not people, and a handful of steps by name, never who took them. The steps are: a visit that came from Calculate.co.nz, a press of a link to the demo or of a start button on one of our landing pages, an account made (and whether by Google, a password or a sign-in link), a first job added, a plan's checkout opened and a plan started, a letter template saved or copied, and, in Your Timesheets, a first entry, a timer started, a place or project added, a report viewed, a PDF timesheet saved, and a share link or a praise link made. None of them carries anything you typed. We also advertise on Google Search, on Microsoft's Bing search, on Meta (Facebook and Instagram) and on TikTok, and to know which of those ads work, our public pages can load each platform's tag (TikTok's only on the page its ads link to, and Microsoft's only on the pages our Bing ads link to). Never the app, your account, our AI tools, or any page where you type your name, email or phone number, with one exception: the sign-in page loads Google's and Meta's tags only after you have made an account there, and only once every box on the page has been emptied and its address cut back to plain /signin, so all they can record is that an account was made. When you visit one of those public pages, the tag sends that platform the page's address, the page you came from, your browser's details and IP address, and its own cookie, and Meta's also records when an account is made. Microsoft's tag, on the pages our Bing ads link to and nowhere else, is also told when that page's start button is pressed, and nothing after that: never that an account was made, a trial started or a payment taken. If you are signed in to Google, Microsoft, Facebook, Instagram or TikTok, that platform can link the visit to your account there, under its own privacy policy. We switch off Meta's automatic reading of forms, we tell Google a visit may not be used for personalised ads, and we never use these tags to show you ads later. If you arrived from one of their ads and later make an account, start a trial or pay, we tell that platform only that the click it sent us became an account, a trial or a payment, and the amount (for Google, as a file of its own click ids; Microsoft is told none of the three). We never send them your name, your email or anything from your job hunt. Your browser's settings, an ad blocker and each platform's own ad settings can all refuse their cookies. No fingerprinting to recognise you. The one check the sign-in page and the contact page make, to tell a person from a script, is explained under Cloudflare below.
• Three more things our own analytics and pages keep, none of them about you. When you arrive from an ad, our analytics keep the tag the ad platform adds to the link, which identifies the click rather than you, so we can count visits from each platform. On the pages our ads and our Calculate.co.nz placements link to (the ones whose address begins /start), pressing the start button adds one to a daily count for that page and where the visit came from, with no cookie and nothing that could identify you. And Ask Jo, the help panel, answers from this site's own text inside your browser, with no AI. Ask Jo questions are kept for 12 months, without your name or account, with contact details masked, to improve the answers. Each question you ask is sent to our server with the answer Jo gave (or that it had none), the address of the page you asked on and nothing more of it, the time, whether you were signed in (only yes or no, never which account), whether you typed it or pressed a suggested question, Yes or No if you press one under the answer, and a random label made for that one question so the Yes or No can find it, which is cleared within a day. It is sent with no cookie, and our server does not keep your IP address with it. Anything that looks like an email address, a phone number, a long number such as an IRD or bank account number, or a web address is masked first, in your browser and again on our server. So please leave personal details out of a question. Pressing Yes or No also adds one to a daily count for that answer. If Jo cannot answer, a button offers to send that one question to a person. Pressing it emails the question (masked in the same way) and the address of the page you asked on to contact@jobtracker.co.nz, and, only if you type one into the optional box, your email address so that we can reply. Nothing about your account goes with it. The question is kept for 12 months, without your name or account, in the same list as the questions above; an email address you type is not kept on our server, only in the email we receive, as with any message you write to us.
• Heatmaps and replays of some visits to our public pages. On our home page, product and pricing pages, employer pages, ad landing pages, articles, guides, glossary and the templates list, our own analytics record a sample of visits: where people click and how far they scroll (heatmaps), and for some visits a replay of the page as it was used, so we can see what is confusing and fix it. Everything typed into any box is hidden before it leaves your browser, and a replay is not linked to your name, your email or your account. It runs on our own analytics server in Auckland, not a third party's, and never in the app, your account, sign-in, our calculators and tools, the letter templates or any page with a box for your name, email or phone number.
• How you found us, if you make an account. A few coarse facts kept for the length of one visit and written to the account once: a source label such as "calculate", the campaign and post named in the link you followed and whether that link was an ad or a post, if it named them, the first page you landed on, the site you came from if it was not us, and, if you clicked an ad, the click id that ad put on the link, which is deleted 90 days after you sign up. It tells us which guides, tools, posts and advertising are worth the effort, counted in totals and never used about you. It is kept in the tab, not in a cookie (signing up with Google carries it in a cookie while you are at Google, deleted when you come back and in any case after ten minutes), it disappears when you close the tab, and it identifies nobody except to the platform whose own click it is. Your browser also remembers, for 30 days, which link or site first brought you here: the same coarse facts and when you arrived, and which ad platform if it was an ad, but never the ad's click id. It stays in your browser's own storage for this site, not in a cookie, and our own pages use it only to credit that first link: as how you found us if you come back by typing our address and make an account, and in the daily count of start button presses described above. It is only to know which advertising works, and it is never shared. A later link does not replace it until the 30 days are up, and clearing your browser's data for this site removes it. These facts are in your export, the click id for as long as it is kept. Separately, if we cannot tell from the link or site you came from how you found us, an account made from 29 September 2026 is asked once in the app, after setup, where you heard about us: one tap from twelve choices such as "Friend or family", "Google", "An AI assistant" or "TikTok", with nothing to type. On the free plan the question has to be answered before you carry on; on a paid plan, a trial or a seat you can skip it. If we can tell how you found us, you are not asked. We keep the answer with your account, count it in totals beside the link you came from, and tell Brevo the answer's words (below). It is in your export and goes with your account.
• Who invited you, if a friend did. A friend's invite link keeps its code in a cookie on your browser for up to 30 days; the cookie holds that code and nothing else, is read only by us, and is deleted when you make an account. We record who invited whom, to give each of you the month's credit the invite offer promises, when each credit was applied, and, if the friend's first payment is refunded in full, what was taken back. The person who invited you sees only how many people signed up from their link and how many have paid, never who. The credit is added to your account at Stripe, our payment provider, described as "Referral: a free month". It is in your export, and if you erase your account your side of the record is deleted, leaving only an anonymous note of the credit.
• Records kept when you sign in, for security. Each browser you are signed in on keeps a session with the IP address it signed in from and the name your browser gives itself, so your account page can show where you are signed in and you can sign out of any of them; a session ends 30 days after you sign in, or sooner when you sign out, and is then deleted. A sign-in link keeps the IP address that asked for it, and is deleted a week after it is used or runs out. Each attempt to sign in is counted against the address tried and the IP address for up to a day, to slow down guessing. A failed sign-in (a wrong password, a spent link, a Google sign-in that was refused) is kept for 90 days as a security record: the email address tried, why it failed, the IP address and the browser's name, so we can notice somebody working through one account, or one network trying many. None of these ever holds a password or a sign-in link. Erasing your account deletes every one of them that carries your address, straight away.
• A log of every request to our website, for 30 days. Our web server writes one line for every request to jobtracker.co.nz: the time, the address asked for, the IP address it came from, your browser's details and the other headers it sent, and how we answered. Never your cookies: they are taken out before the line is written, and so is any private code in an address, such as a sign-in link, a team invitation, a shared timesheet, a client sign-off link or a team's live page for its client. We keep it for 30 days, and then it is deleted. It is used only to keep the service secure, to find and fix faults, and to dispute ad clicks we believe are fraudulent. For that last one only, we may show the ad platform that charged for those clicks the lines about them, and nothing else. It is never used for advertising or to follow anyone around the site.
• Your calendar feed, if you turn it on. Sync to my phone, on the app's Calendar, makes a private link that your calendar subscribes to. Your calendar's provider (Google, Apple, Microsoft or whichever you use) then fetches it from our server every few hours and keeps its own copy, under its own privacy policy. The feed carries your events from 90 days ago onwards: for each, its stage and title, the job title and employer it is for, the date and time, and the place if you gave one. Never your pay, your notes or your contacts. We keep the link only in a scrambled form we cannot turn back into the link, with when it was made and when it was last fetched. Switch the feed off, or make a new link, and the old one stops working at once.
• Our own cookies, and only these. The sign-in cookie, which keeps you signed in for up to 30 days, or only until you close the browser if you said it is a shared or public computer. While you sign in with Google, up to four short ones, each lasting ten minutes at most: one that checks Google's answer is to the request we sent, and others that carry across whether you ticked shared computer or news from us, and how you found us. And a friend's invite code, for up to 30 days, above. Scripts on the page cannot read any of them, and none is shared with anyone or used for advertising. The ad platforms' own cookies are described under "Almost nothing else".

If you share your hours with a team

An organisation can buy Team seats and invite you by email. Nothing is shared until you accept and choose to share. If you do, the team's managers (its Owner, its Admins and its Approvers) see, for the hours you log at that organisation only:

• the date, start and finish times, breaks and hours;
• the project and task, and whether the team counts it as billable;
• when you marked a week sent;
• if the team uses approvals, when you submitted each period, and when it was approved or sent back, by whom and why;
• the dated history of every change.

They see your notes too, unless you untick that when you join or switch it off later in Your Timesheets, under Settings; it starts ticked, because a team usually needs the notes to make sense of the hours. They also see whether your seat is in use, or your own paid plan covers you. They never see the pay or rates in your own account, any other job or client, your job hunt or your career record.

The team's projects and tasks appear in Your Timesheets at that organisation, each marked billable or not by the team; you can see that, but not change it. Anybody sharing can add one. Whoever made it, the Owner and the Admins can rename it, or move its hours into another task of the same project (the hours, dates and notes never change, and each move is kept in the entry's history), and the new name shows to everybody in the team; only the Owner and the Admins can remove one. You can stop sharing at any time, and those projects then become yours to change.

Approvals, if the team uses them. They are off until the Owner or an Admin turns them on, from a start date, by the week, the fortnight or the month. You then submit each period, and an Approver, an Admin or the Owner approves it or sends it back with a reason; nobody approves their own time. We keep, with the team, when you submitted each period, when it was approved or sent back, by whom, the reason, and a copy of the hours as approved: the dates, times, hours, project and task and whether they were billable, never a note. If you change an approved period, it goes back for approval by itself and the approved version is kept beside the change. This record is hours only, and it is kept like the team's copy described below: for seven years from the date of each entry, or until 90 days after the team closes, whichever comes first. If a period is sent back, or ends without being submitted, we email you about it once, and nobody else.

The team's own rates. The Owner and Admins can type the team's billable rates, for the whole team, a project, a task or a person on a project, and a private cost rate for each person. Some of them may be about you. They are kept with the team and used only to work out what the hours shared with it are worth: the value, its GST, the value without GST, the cost and the margin. Only the Owner and Admins see the rates and those figures; Approvers see hours only, and you see only whether your hours are billable, never the team's rates. Nothing is ever read from the pay or rates in your own account.

Your hours on a team's invoice. If you share your hours with a team, its Owner and Admins can put your billable hours on an invoice to their client (only approved hours, when the team uses approvals) and, if they choose, on a sign-off page their client sees, with your name and the hours' value; never a note, a rate, a cost or a margin, and nothing about any other work. If you change hours after they are invoiced, the Owner and Admins are told in the app what changed (never your notes). The invoice is the team's own PDF, which it sends itself: we never email a team's client and never take a payment for a team.

Clients of a team. When a team uses invoices, its Owner and Admins can record each client's name, email address and postal address. We keep them encrypted, show them only to that team's Owner and Admins, print them on the team's own invoices, and never write to them: the team sends its invoices and links itself.

Client sign-off links. Before invoicing, the Owner or an Admin can make a sign-off link for a client, and the team sends it. Through it the client sees the billable hours (the approved ones, when the team uses approvals) by project and task, their value, and the names of the people who worked them, which may include yours, and can approve them or ask a question. The link lasts 30 days, unless the team turns it off sooner. We record when it was opened and when it was answered, the answer, and any name and comment the client types (encrypted), and show them only to the team's Owner and Admins. That record keeps no IP address and nothing about the client's device, and the page has no analytics. Like any visit to jobtracker.co.nz, opening it does write a line to our web server's log of requests, with the link's code taken out, and that line is deleted after 30 days.

A team's live page for its client. The Owner or an Admin can also make a standing private link for one of the team's clients, and the team sends it. Through it the client sees, whenever they open it, the billable hours to date (the approved ones, when the team uses approvals) on their own projects by project and task, their value, the hours against each project's budget and each period's sign-off answer; never anybody's name, a note, a rate, a cost, a margin or another client. It lasts 12 months unless the team chose another end, and the team can turn it off at any time. While the team's seats are paused for an unpaid bill, or after the team ends, the page says it is paused and shows no figures, and no new link can be made; it comes back by itself when the team pays again. We record when it was made and turned off, and each time it was opened, and show that only to the team's Owner and Admins; that record keeps no IP address and nothing about the client's device, and the page has no analytics. Like any visit to jobtracker.co.nz, opening it does write a line to our web server's log of requests, with the link's code taken out, and that line is deleted after 30 days.

A team's clients, invoices, sign-off records and client links are kept while the team exists and deleted with it, 90 days after the team ends.

Your usual hours, if the team sets them. The Owner or an Admin can record the hours a week you usually work, from a date. The team's managers and you see them beside the hours you log, and they go into the team's payroll download with the public holidays and long days in your shared hours; you find them in your own data export too. They are kept with the team, every change dated, and go with your place in the team, unless the team keeps a copy of hours you shared, when they stay beside it as part of its record.

Hours an organisation kept before you joined. Once you have joined its team and chosen which of your places the team is, an organisation can ask us to load its own earlier record of your hours, from a file it sends us. Each row is matched to you by your email address and added to Your Timesheets at that place, with its date, hours, project and task, and its note encrypted the same way as your own notes. The file is read only to load it and is not kept: we keep only a scrambled key for each row, so the same row is never loaded twice, and counts of what was loaded. Nothing is loaded for anybody who has not joined, or has not yet chosen their place, and nothing is held for them: their rows are left out, and the organisation sends them again once they have. Once loaded, the entries are yours, to change or delete like any other, and what the team's managers see of them follows the sharing choices above.

Time away, if you mark it. If you mark time away on your week in Your Timesheets (annual leave, sick leave or other, whole days or part of one day), we keep the days, the type and whether you chose to show the type. The team's Owner, Admins and Approvers see that you are away on those days, and the type only if you ticked to show it. It is a record of days away and nothing more: we do not work out leave, a balance or pay from it. You can remove a mark at any time. The team stops seeing your marks when you leave it, and we delete each one 13 months after the days it covers, or with your account.

Reminders about missing hours, if the team uses them. If the Owner or an Admin turns them on, and you share your hours and have logged none at that organisation for the week by the day and time the team chose, you see a reminder in the app and get one email that week, unless you turn those emails off in Your Timesheets, under Settings, Teams. We keep the date of the week you were last emailed. The Owner and Admins see the names of the people who logged nothing the week before, never their hours. Anybody marked away on those days is left out.

A shared tablet to clock in, if the team uses one. If you set a kiosk PIN, we keep it only scrambled (a salted hash, never the four digits), when you set it, and how many wrong tries in a row it has had; after five it locks until you set a new one. When you tap your name and type your PIN on your team's tablet, the start or stop goes into your own timesheet at that organisation and is shared exactly as your other hours there are. Your name is on that tablet only while you share your hours with the team and have a PIN set. We keep nothing about the tablet with your entry: no location, no photo and no details of the device. To stop anyone guessing PINs, 10 wrong PINs on one tablet within 10 minutes pause that tablet for everybody for 10 minutes.

When you stop sharing, leave the team, are removed from it or erase your account, the organisation keeps a read-only copy of the hours you shared up to that day, without notes, labelled with your name and email address, as its own record. We keep that copy for them for seven years from the date of each entry, or until 90 days after they close the team, whichever comes first, and then delete it. If you shared nothing, your name and email are deleted from the team when you erase your account.

The invitation email is sent by us, and your address is not added to any mailing list. The link in it is not recorded by our analytics.

The one shared layer, and your switch

There's one thing we build from user data, and we'd rather explain it than bury it: anonymised, aggregated salary statistics. What roles like yours really pay, by title and region, built from advertised, asked, offered and accepted numbers across many users, so that every Kiwi can walk into a negotiation knowing the real number.

• It's aggregate only: no names, no employers you can be traced through, no individual rows, and small samples are suppressed so nobody can be reverse-identified.
• Anonymised salary statistics are on by default; one toggle in Settings turns them off. Off means off, and everything else works identically.
• It's for you, not about you: the entire point is handing the information advantage back to the person on the wrong side of the table.

Email: what we send, and what we don't

Seven kinds, and we keep them apart on purpose.

• About your account: sign-in links, a note when you create the account, the reminders before a trial's first charge and 14 days before a yearly plan renews, anything needed to keep it working. These go out because you did something that asked for them, and there is no way to be signed up and not get them.
• Everything else: only if you tick the box. It is not ticked for you, on any form, ever. It means a handful of emails a year: new tools and guides, and a note at a few moments that matter, such as a trial or paid plan ending, marking a job accepted, or not having been in for a while. We work out those moments on our own server, and Brevo is told only which moment it is. If you said yes before those moments were added in September 2026, you said yes to the tools and guides only, and that is all you get. Every one has an unsubscribe link that works on the first click.
• The Monday email, only if you turn it on: a separate switch on your account, off until you turn it on, and ticking the box above does not turn it on. Once a week, about your own job hunt: what you logged last week and three things for this one. It holds counts only, never an employer's name or a job title, so it is safe in an inbox somebody else might see. Every one has a stop link that works without signing in.
• The job hunt tips, only if you turn them on: another separate switch on your account, off until you turn it on. Three short emails at most, each sent once: when your job hunt is still empty, when it is nearly useful, and when it has gone quiet. We decide who is due one on our own server, and Brevo is told only that a tip is due, never anything about your job hunt. They stop when you turn them off, or when you mark a job accepted.
• Career mode's reminders, only if you turn them on: a separate switch on your account, off until you turn it on. Your pay review six weeks and two weeks out, a trial period or a certificate about to end, and a check-in every fortnight. We work out who is due one from dates alone, on our own server, and Brevo is told only which kind of reminder it is: never your employer, your job, your pay or anything you wrote.
• The monthly summary of your hours, only if you turn it on: a separate switch in Your Timesheets, under Settings, off until you turn it on. On the first of each month, if you logged hours the month before, one email with the hours, how many days, how many places, and what the work paid by the hour came to by the rates on your entries. It never names a place, a project or a note.
• A team's emails, only if an organisation invites you to its team: the invitation, sent at its manager's request to the address they typed. Once you are in, a note when your role in the team changes, a note if the team removes you from it (what it keeps, what you keep and what your plan is now) and, if the team uses approvals, when your hours are sent back with a reason or a period has ended without your hours sent. If you approve hours, a list on the days something waits for you; if you are the Owner, a note when the team's card does not go through. If the team turns on reminders about missing hours and you share your hours, one email in a week you have logged nothing there by its day and time, unless you are marked away or turn those emails off in Your Timesheets, under Settings, Teams. None holds a note or your pay, and none puts you on a mailing list.

Your address is never given, sold or rented to anyone else, and we send nothing for anyone else except a team's own emails above, which go only to the people in it or invited to it. If you never tick the box or turn on the Monday email, the tips, career mode's reminders or the monthly summary, and are in no team, you will never hear from us about anything except your own account.

The toolbar button, and the bookmark

There are two ways to bring a job ad across from a job site: a bookmark you drag to your bookmarks bar, which works in any desktop browser, and a toolbar button for Chrome and Edge, which is the same thing with a panel in front of it. Both do exactly the same reading, and this is all of it. The toolbar button is Save to jobtracker.co.nz on the Chrome Web Store, which Google reviewed before publishing it.

• They read the one page you press them on, at the moment you press. Not in the background, not on a schedule, not on any other tab, and not when you are not pressing. Nothing is installed that watches job sites. On LinkedIn, where an ad is folded behind a "See more" button, they press that button on the page first, so the whole ad is read; they press nothing else.
• Our server never visits a job site. The reading happens inside your own browser, on a page you opened yourself. We do not fetch, crawl or scrape anybody's listings, and there is no copy of any job site on our side.
• The job travels after the # in the address of the tab that opens, and a browser never sends that part to any server. So the job title, the employer and the ad text are not in our logs, our analytics or anyone else's, on the way in.
• Nothing is saved until you say so. The app shows you what came across and asks. Say no and it is gone, and the address is cleared either way, so a refresh cannot add it twice.
• The toolbar button stores nothing and sends nothing. It holds no settings, keeps no history of the ads you read, has no analytics in it, loads no code from anywhere, and asks for the narrowest permission Chrome offers: the tab you are on, only while you are pressing the button. It never sees any other tab.
• Once the job is in your board it is yours, on our server in Auckland, and every other line on this page applies to it like anything else you typed in.

Who helps us run it

No product this size is run alone, and naming the handful of companies involved is more useful than a sentence saying we use "industry-standard providers". Here is the entire list of suppliers, what each one sees, and where it is, and after it the places we advertise.

• SiteHost, Auckland, New Zealand. The server and the database. Your jobs, notes, contacts, dates, salary figures and any files you upload live here and are not copied anywhere else.
• Zoho, Australia. Holds our mailbox, contact@jobtracker.co.nz. Anything you email us arrives there, and so does each message sent through the contact form (your name, your email address, what it is about and your message) and a note of each quote request (the organisation, its sector, about how many seats and when, with your email address to reply to; your name, phone number and message stay in our own records), so we can reply. Both reach it through Brevo, below. It holds those emails and our replies, and nothing from your account.
• Brevo, France. Delivers our email, and sends the ones that go out on a date, like the reminder before a trial ends. For that it holds, for every account, your email address, your first and last name, your mobile if you gave one, when and how you signed up, your plan and the dates that matter to it (when a trial, a Founding 100 price or an employer seat ends), the name of the organisation that gave you an employer seat, if one did, and whether you have said yes to marketing, texts, the Monday email, the tips and career mode's reminders. It also holds where your account is in its life with us, which our server works out each night: a lifecycle stage (new, active, quiet for a while, trialling, subscribed, cancelling, lapsed, trial ended, or found work), the day you last used jobtracker.co.nz, whether your board has got going, whether you have ever paid, and when and why a paid plan ended (you cancelled, or a payment failed, and the reason you picked from Stripe's short list when you cancelled, if you picked one), so we can write to you differently at those moments if you said yes to that. If you answered "where did you hear about us", it holds that answer too. It sees the contents of the messages we send you, and of the contact form and quote messages it carries to our mailbox, and records whether each one is opened and which link in it is pressed, which is how we know an email is working. It holds the Founding 100 waitlist for the people who joined and confirmed it before the offer closed on 4 October 2026; nobody new can join it. It is never sent anything from your board, career mode's records or Your Timesheets to keep: no employer, no job, no pay, no win, no note, no count, and no date of anything you did in it. The one exception is the emails you turn on, which Brevo delivers and so sees: the Monday email's counts of what you logged, and the monthly summary's hours, days, number of places and what the hourly work came to. If you turn on career mode's reminders, it is told only which kind of reminder is due. Two things are worked out from your board and passed on only as yes or no: whether it has got going (three jobs, or one with what it pays), and whether you have marked a job accepted, which is the "found work" stage. When you delete your account, Brevo's copy is deleted with it.
• Anthropic, United States. Writes the AI drafts, only on a paid plan, and only at the moment you ask for one. In career mode that is the pay review case, a self-review and a promotion case, for which it receives your job title and employer, your pay figures, and the wins, 1:1 notes, goals and skills that one draft is built from. With On the Move it is also the Cover Letter Writer, the Negotiation Coach, and four drafts in the app (a follow-up, a thank-you note, why you want the role, and a referee request). On the free plan those four are written from our templates, and nothing is sent to Anthropic at all. It receives only what that one draft needs. For the app's drafts that is the job title, the employer's name, how long ago you applied, the first name of the person the draft is to, the first line of what you noted they asked at the interview, and what you wrote under "Why I want this one". For the two tools it is the text you typed into them. Never your board, your other applications or your salary history. CV Match and Tailor My CV (On the Move and the Career and Timesheets plan) run only when you press their button, and send the job ad, the CV you choose and the records listed beside the button to Anthropic to write the answer: the records of yours most relevant to that ad, at most 50, chosen on our server from your evidence index (your wins and skills in Your Career, certificates, CPD entries, the titles, employers and dates of jobs you have held but never their pay, your other CVs and your prepared interview answers, and never your 1:1 notes), and for tailoring only the experience you ticked. Both also send your answer about your right to work in New Zealand (a citizen, a resident, an Australian citizen, a work visa with its expiry date, or needing a visa), if you have given one in your profile, so a match can count it and a tailored CV can say it; that answer is kept in your profile on your device, and a line a tailored CV says about it is kept with that CV. Scoring a tailored CV again sends the job ad and the tailored CV the same way. Nothing sent to Anthropic for them is kept by us except a fingerprint for 7 days, so a re-check is not charged, and, for Tailor My CV, what it suggested and what you decided. The scam check (On the Move and the Career and Timesheets plan) runs only when you press its button, and sends the job ad and its listing details (the title, the employer, the link, the pay, the location and where it was listed) to Anthropic to read the ad. Nothing else about you or your job hunt goes with it, and nothing of it is kept by us except a fingerprint for 7 days, so checking the same ad again is not charged. Your top 10 interview questions (On the Move and the Career and Timesheets plan) runs only when you press its button on a job, and sends the job ad, the CV you choose and the records of yours most relevant to that ad (at most 50, chosen on our server from your evidence index in the same way as for CV Match, and never your 1:1 notes) to Anthropic to pick the questions and point at your own evidence for each. The company brief (On the Move) runs only when you press its button on a company's page, and sends the ads of your jobs at that employer, your notes on those jobs and on the employer, and what you wrote in your interview debriefs there to Anthropic to write the brief. Never your contacts, the pay you asked for, or who was in the room. For both, nothing sent is kept by us except a fingerprint for 7 days, so asking again with nothing changed is not charged. The CV Builder's AI tidy (On the Move and the Career and Timesheets plan) runs only when you press its button, and sends the text of the CV you chose to Anthropic to sort it into the builder's fields: the CV's text only, and nothing else about you or your job hunt. It is offered only when our own reader cannot place part of your CV, and nothing of it is kept by us. If you never ask for one of these drafts, nothing of yours is ever sent there.
• Google, United States. Only if you choose "Sign in with Google", and only to confirm you are you. Use a password or a sign-in link instead and Google is not involved in signing you in. (Google's advertising tag is a separate thing, covered below this list.)
• Cloudflare, United States. Checks that a sign-in, a new account, a message through our contact form, a survey answer or a praise note comes from a person and not a script, so nobody can use our forms to send floods of email to other people's inboxes. It runs invisibly, on the sign-in page, the contact page, the survey and the two pages where a colleague writes or changes a praise note, and nowhere else. To tell a person from a script it looks at your connection and your browser as the page loads: your IP address, the name your browser gives itself, and how it sets up a secure connection. What you type into the form is never sent to it. Cloudflare also uses those same connection details, on its own account, to improve how it tells people from scripts, and says it cannot identify anyone from them. All of this is under its Turnstile Privacy Addendum.
• Stripe, New Zealand and the United States. Our contract is with Stripe New Zealand Limited, and Stripe processes payment details in the United States and other countries. It takes card payments: a paid plan, an AI top-up, a koha, employer seats and Team seats. It also holds a referral credit on your account until it comes off a payment. The first time you go to its checkout, it is given your name and email address, so its invoices and receipts can name you. Card numbers go straight to Stripe and never touch our server, so we could not leak one if we tried. We keep the plan, its dates and what was paid, which the tax rules require us to keep for seven years. When a free trial starts, we keep Stripe's fingerprint of the card, a code that tells us the same card was used again without ever showing its number, so a card has one free trial only. It is kept even after you erase your account, with nothing beside it but the Stripe subscription it was first used on, because that is how a card that has had its trial is recognised.
• Sentry, Germany. Tells us when something on our server breaks, so we hear about it before you have to tell us. It receives the kind of error, where in our code it happened, and which part of the site, with every id taken out. Never your name, your email, your address, anything you typed or anything from your board: those are removed on our server before the report leaves it.

Where we advertise: Google Search, Microsoft Advertising (Bing search), Meta (Facebook and Instagram) and TikTok. These are not suppliers acting for us. Their tags are on our public pages so we know which ads bring people (TikTok's only on the page its ads link to, and Microsoft's only on the pages our Bing ads link to), and they use what they receive under their own privacy policies, which is why we keep it to what "Almost nothing else" above sets out: a public page visit, and, only if you came from one of their ads, that the click became an account, a trial or a payment. Microsoft is told less: that a page our Bing ads link to was seen and whether its start button was pressed, and nothing after that. None of these tags is used to show you ads later. Never the app, your account, or anything you type.

Analytics is not on that list because it is not a third party: it runs on our own server in Auckland, counts pages and the few steps listed above rather than people, records the heatmaps and replays described above with everything typed hidden, and sets no cookies.

Each of these is a supplier acting on our instructions, not a partner we share data with, and none of them may use your job hunt for anything. Three keep a narrow use of their own, for safety, stated here plainly: Stripe uses payment details to stop fraud, as every card processor must; Google keeps its own record of a Google sign-in, because that account is yours with them; and Cloudflare uses the connection details from the sign-in check to get better at telling people from scripts. None of them ever receives your board, notes, contacts or salaries.

Your data is portable, and deletable

• Export everything any time: jobs as CSV, the lot as a JSON backup, including how you found us and where you said you heard about us. Your history is yours to take with you.
• Erase everything with one button that actually works, and doesn't route you through a retention offer or a seven-screen guilt trip. A few things outlive an erasure, each for a reason, and none of them holds your job hunt or your career record: Stripe's record of you as a customer and its invoices, which tax rules require for seven years; our own record of each payment, with your account taken off it; if you bought employer seats, the order (above); an anonymous note of any invite credit (above); a one-way scrambled form of your email address, which can tell us an address was erased but not what it was, so that if a backup is ever restored your account is erased again before anything is served; Stripe's fingerprint of a card that had a free trial (above); the virus check's security record, if it ever found something in a file of yours (below); if you shared hours with a team, the copy that team keeps, with its record of your approvals (above); and our web server's log of requests, until its 30 days are up (above).
• Delete a file and it is removed from the server straight away, and erasing your account removes every file with it. Our nightly backups copy the database and your uploaded files, exactly as stored: the files and the words you wrote in career mode stay encrypted, and the key that opens them is not kept with the backups. Each backup is deleted after 90 days, so a deleted file leaves the backups as they age out, and if a backup is ever restored, any account erased since is erased again before anything is served.
• For people 16 and over. jobtracker.co.nz is not meant for anyone under 16, and we do not knowingly keep information about them. If we learn an account belongs to someone under 16, we close it and delete what it holds.
• If we ever close. You get at least 30 days' notice to export everything, and it stays available to export for 30 days after the service ends. Then it is deleted from our server, and from our backups as they age out within 90 days. It is never sold or handed to anyone else as part of closing down.
• Our virus check keeps a record of what it finds. Every file you upload is scanned for viruses before it is read or stored, and every stored file is scanned again each night. If a file is found to carry a virus, or an upload is refused because the check could not run, we keep a permanent security record: when it happened, what was found, the file's name and your email address. A stored file found to carry one is held, so it can't be opened or sent, and we email you about it. That record is kept even after you erase your account, because it is how we notice the same harmful file being tried again. It never includes the file itself.

Your rights: seeing it, and fixing it

Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct anything that is wrong. Both are free, and neither needs a reason.

• A copy, instantly. The export button on your account gives you the whole file straight away, so you do not have to ask us at all. If you would rather ask, write to the Privacy Officer below and we will answer within 20 working days, which is what the Act allows.
• A correction. Almost everything here is yours to edit in the app. If something we hold about you is wrong and you cannot change it yourself, tell us and we will correct it, or attach a statement of the correction you asked for if we disagree.
• If something goes wrong. If your personal information is ever accessed or lost in a way that is likely to cause serious harm, we will tell you and the Privacy Commissioner as soon as we practicably can, as the Privacy Act 2020 requires, and say what happened and what we are doing about it.
• A complaint. If you are not happy with how we handle it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909. We would rather hear it first, but that route is always open to you.

Who's accountable

jobtracker.co.nz is operated by Crucible Investments Limited, a New Zealand company (company number 9401778, NZBN 9429053412676, GST number 147-904-258), and is built and run in New Zealand by the maker of Calculate.co.nz, under the same fifteen-year standard: primary sources, routine accuracy checks, and "if you find a problem, tell us and it gets fixed promptly". Here's who's behind it.

← Back to the site