Privacy

Harry Russell, based in Aberdeen, Scotland, is the data controller for everything described here.

Contact: harryrussell081203@gmail.com. Questions about your data go to the same address as everything else — there is one person, and he reads it.

You can send from an address we issue instead of your own. If you do, there is no password for us to hold, because there is nothing of yours to authenticate as.

What we do hold is the address itself and the real address your replies go to. Your letters carry that on Reply-To, so an employer answering one writes straight to your own inbox — the reply does not come to us and we do not keep a copy.

The trade is that the letter leaves through our mail provider rather than your mailbox, so that provider processes it — the same as your own provider would.

This section applies only if you connect your own mailbox. Doing that means giving this site something that can send mail as you, because there is no way to send as somebody without it. So, plainly:

Use an app password, not your account password. It can be revoked on its own, without changing your password or touching another device.

It is stored encrypted, with the key held in the server's environment and never in the database — so the most likely breach by a distance, a leaked database dump, yields ciphertext.

It is still access to your mailbox. An app password can generally read that mailbox as well as send from it. That is the honest summary, and it is why the by-hand route exists and always will: the app writes the letter, you press send from your own mail client, and nothing of yours is stored.

Disconnecting the mailbox deletes the stored credential.

The database is Supabase, hosted in Ireland (eu-west-1). The app itself runs on Render, in Frankfurt. Both are inside the EEA.

All set by this site and read only by it, and the analytics one only if you say yes. There is no tracking pixel and no third-party script on any page.

• Your answer to the cookie question, so you are not asked again. Lasts six months.
• Only if you tap Accept: a visitor code. A random code that lets us see how one browser moves through the site across visits: which pages, which section of a page was on screen when you left, how long you stayed, whether you went on to make an account, and which of two headlines you were shown. It never contains your name or email and is never joined to your account. Kept in our own database, deleted after 90 days. Tap “No thanks” and none of this is recorded; clear your cookies and it starts again.
• Your sign-in, so you stay signed in. Lasts a month.
• Where you first arrived from: the page you landed on and the campaign or referral code in the link, if there was one. Not who you are. It is read once, if you make an account, so we know which links work. Lasts a month.
• A sign-up in progress: a random code, so the sign-in link we email you can find the answers you just gave. Lasts a day.

Two notes are also kept in your browser's own storage, never sent to us: that you closed the “add to home screen” bar, and that you have already been asked what's stopping you, so you are not asked twice.

A tally is kept of how many times each page was opened, in which hour, and which website linked here. The free address search, here and on Telegram, adds one more tally: whether it found an address, never what was searched for. That is the whole record: a number.

Nothing identifies you. No cookie is set for it, your IP address is not stored with it, and there is no marker of any kind that could pick you out of the count or follow you from one page to the next. It cannot be used to work out that the person who read one page also read another.

The deliberate cost of that is a counter which cannot tell one person opening a page four times from four people opening it once. That is the trade, and it is the right way round: knowing whether a link worked is not worth holding a record of who read what.

The landing and sign-up pages add a few tallies of the same kind: how far down the page people scroll, which button they tap, and which step of sign-up they stop at. Still numbers, still nothing about who.

“What's stopping you?” If you answer that question, the answer is counted. If you choose “something else” and type a line, that line is kept as you wrote it, with the page and the time, and nothing else: no address, no cookie, nothing tying it to you. Please leave personal details out of it.

Kept for 60 days, then deleted.

While you have an account. Delete your account and it goes — the user row, the profile, the CV, the drafts, the contacted list and the stored mail credential, in one operation, from your account page. It is not a request queued for somebody to action; the rows are removed.

What cannot be pulled back: letters already sent are in the recipient's inbox, and Stripe keeps its own payment records for as long as its own obligations require.

What stays because it is not about you: for every letter sent, a few facts about the letter itself, so the machine can learn what gets replies — roughly how long it was, whether it asked a question, the kind of subject line, the kind of address it went to (a careers inbox, a general one, a named person), the day and time it went, and whether anybody wrote back. Never the letter, never a name or an address, never which account sent it. Once your account is deleted nothing in it can be tied to you.

Under UK GDPR you can ask for a copy of what is held, ask for it to be corrected, ask for it to be deleted, ask for it in a portable form, object to processing based on legitimate interests, and withdraw consent for automatic sending at any time.

Ask at harryrussell081203@gmail.com.

If the answer is unsatisfactory you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. You do not have to ask here first.

This is a service for people looking for work and is not intended for anyone under 16.