Privacy policy

1. Information we collect

The Site has no accounts, and a visitor who only reads it is asked at most one thing: whether Google Analytics may run (section 1.7). Personal information reaches us in four ways, each of them something you choose to do, and each is described here with what it is used for.

1.1 Email subscriptions.

When you subscribe to the email digest, from the footer or from the job alerts offer on the board, we store your email address; the search you saved with it, meaning the filters in force at the moment you subscribed, or everything when you subscribed from the footer, as you last changed it; a random token that identifies your subscription in the links we send you to unsubscribe or to change your search; the date you subscribed; the dates the welcome message, the most recent digest and the most recent quiet-month note were sent to you; and a keyed one-way hash of your network address (section 1.4). The address and the search exist for one purpose: sending you the roles that match, once a week. If an address that already has a subscription is entered again with a different search, the saved search is not replaced: we send that address one message with a link, at most once a day, and only saving on the page it opens makes the change. We record the date that message was sent. Every email links to a page where you can change the saved search. Opening that page changes nothing; only saving a new search does, and saving one after you have unsubscribed subscribes you again.

When you unsubscribe, we keep the record and mark it unsubscribed, together with the reason and the note you may choose to give on the unsubscribe page. That mark is what stops the address being mailed, and it lets the Site recognise the address if it is entered again. A signup form cannot put an unsubscribed address back on the list: entering one sends that address a single message with a button, at most once a month, carrying the search asked for, and only pressing the button turns alerts back on; nothing stored changes until then. We record the date that message was sent. To have the record deleted entirely, email us (section 9): we then keep only a keyed one-way hash of the address (section 1.4), which lets the Site recognise it if it is entered again without holding the address itself, so that nobody but you can put it back on the list.

1.2 Job reports.

When you report a listing, we store the reason you picked, the note you may add, the listing it concerns, and a keyed one-way hash of your network address (section 1.4). The hash lets repeated reports of one listing from one person count once, so that three reports mean three people, and it caps the number of reports one person can file in a day. A report starts an automated check of the listing; the check reads the listing and its apply page, and your note is read by us alone. It is never handed to the automated classifier. Reports are kept as part of our record of the listing.

1.3 Picture submissions.

When you send in a picture for the homepage backdrop, we store the picture file, the name of the piece, your name, your email address, your portfolio address if you give one, and a keyed one-way hash of your network address (section 1.4), which caps the number of pictures one person can send in a day. The name of the piece, your name and your portfolio address are published as the credit wherever the picture appears: on the homepage, in the email digest and in our own social media posts, as section 4 of the Terms describes. Your email address is never published and is not added to the digest. It exists so that we can reach you about the picture, and for nothing else.

The picture file is held in a public storage bucket from the moment it arrives, so anyone holding its exact address can open it, but the Site shows it only once we have approved it. A picture we decline can be deleted permanently, file included, and you may withdraw a picture at any time (section 4.5 of the Terms).

1.4 Network address hashes.

Every request to a website arrives from a network (IP) address. When you subscribe, report or submit, when a page is counted (section 1.6), and when a wrong password is entered at the sign-in to the administration area, our server computes a keyed hash (an HMAC) of that address with a secret that never leaves the server, and stores the result. The address itself is not stored, and without the secret the stored value cannot be matched back to an address. It is used only to count: one open report per person per listing, a daily cap on signups, reports and pictures from one place, so that a script cannot flood the forms, a limit on guesses at the administration password, and one visitor per day. It is never used to identify you or to build a profile of you.

1.5 Server logs.

Like any website, the Site runs on servers that keep short-lived request logs: the network address, the page requested, the time and the identification string your browser sends. These logs exist to run and protect the service and are kept by our host under its own retention policy (sections 4 and 8). We do not use them to identify visitors.

1.6 Site counts.

The Site counts how it is used, by itself: pages opened, listings opened, Apply buttons clicked, the address of a listing that applies by email copied, searches that found nothing, the controls used, whether the screen was a phone's, and how long each page was on screen while its tab was in view. For the first page of a visit it also counts the site the visit began on (or the app, where the browser is one an app opened), the page it began on, and the campaign tags in the link that brought it, if any (the labels beginning utm_ that the author of a link may add to say where it was posted). Once a day for each visitor it counts the country that the network address belongs to, as our host reports it, and the browser and operating system named by the identification string the browser sends. Each of these is kept as a number per day, never as a record of what one person did, and the numbers are kept indefinitely. The numbers of visitors and of Apply clicks are also kept per hour, and per five minutes for two days, after which the five-minute numbers are deleted. To count a visitor once a day rather than once a page, the keyed hash of section 1.4 is kept for ninety days and then deleted. So that each act on a Featured listing is also counted once a day for each visitor, a hash of that keyed hash together with the listing and the act is kept for the same ninety days. No cookie is set and nothing is stored in your browser for this. A browser sending a Do Not Track or Global Privacy Control signal is not counted at all.

1.7 Google Analytics.

The Site also uses Google Analytics, a measurement service provided by Google, so that its figures can be compared with our own. Where it runs, your browser loads a script from Google, which sets the two cookies of section 2.5 and sends Google the pages you open on the Site, the site a visit began on, how long pages were on screen, the type of device, browser and screen, and a rough location that Google works out from your network address. Google does not keep the network address itself. We use Google Analytics for totals and trends, never to identify anyone, and it is set up so that none of it is used for advertising: Google signals and ad personalization are switched off in the script itself, and every advertising consent it can be given is refused.

In the European Economic Area and the United Kingdom, and wherever our host cannot tell which country a visit comes from, Google Analytics does not load until you say yes to the question the Site asks on your first visit. Say no, or do not answer, and it never loads. Elsewhere, Switzerland included, it runs unless you turn it off. Either way the Cookies link at the foot of every page asks the question, and a no takes effect at once: the script stops sending and its cookies are deleted. Google Analytics does not load at all for a browser sending a Do Not Track or Global Privacy Control signal, in the administration area, or on the pages that manage an email subscription, whose addresses carry the token of section 1.1.

1.8 What we do not collect.

There are no accounts, so there is no profile. There is no advertising network and no advertising tracker on the Site, the only script from anyone else is the Google Analytics script of section 1.7, and we do not collect precise location, payment details or any category of sensitive personal information. The listings on the Site are about employers, not about you: they are gathered and classified by automated systems (section 4), and nothing about a visitor is part of that process.

1.9 Featured posts.

When an employer pays to feature a job (section 2 of the Terms), we store the email address the employer gives us beside the post, kept apart from the listing itself and never published. It exists so that we can tell the employer, once, a few days before the featured period ends, and offer another one. It is deleted with the post. Payment details are taken by Stripe on its own pages and never reach us.

2. Cookies and browser storage

The Site sets four cookies of its own, and a visitor receives one only by doing something: choosing a theme, or answering the question about Google Analytics. Where Google Analytics runs (section 1.7), its script sets two more.

2.1 Theme.

Choosing light or dark with the toggle in the navigation writes a cookie (jij_theme) holding that one word, so that the next page arrives already painted in your choice. It is set only when you use the toggle, it carries no identifier, and it lasts a year.

2.2 Administration.

Signing in to the administration area, which only we can do, sets a signed session cookie (jij_admin) scoped to that area and a matching preview cookie (jij_preview), which lets the signed-in browser see the full Site while the coming-soon page is up and keeps its visits out of the counts of sections 1.6 and 1.7. Both last thirty days, both are cleared on signing out, and neither is ever set for a visitor.

2.3 Browser storage.

One thing is kept in your browser itself rather than sent to us. When you follow a listing from the board to its own page on a phone, the browser keeps the filters, the page number and the scroll position of the board in session storage for the trip back; it is used up on your return and is discarded with the tab. It never leaves your browser.

2.4 Your answer about analytics.

Answering the question of section 1.7, or changing the answer with the Cookies link, writes a cookie (jij_consent) holding either “granted” or “denied”, so that the Site does not ask again on every page. It carries no identifier and lasts six months, after which the Site asks again wherever it asks at all.

2.5 Google Analytics.

Where Google Analytics runs, its script sets _ga, a random identifier that lets it recognise a returning browser, and _ga_T4YX1X203Y, which keeps the state of the current visit. Both last up to two years, and both are deleted when you answer no. We use no advertising cookies, and no other cookie is set on the Site by us or by anyone else. The Site's own counting (section 1.6) sets no cookie and stores nothing in your browser, and a Do Not Track or Global Privacy Control signal from your browser switches off both it and Google Analytics.

3. Email we send

We send email only to addresses that subscribed to the digest: a welcome message when you subscribe (or, for those who subscribed before the board opened, once it opens), and the weekly digest on Mondays when the week brought roles that match your search. A week with no match sends nothing, except that after four such weeks in a row we send one short note with the closest roles on the board and a link to change your search. An address that has unsubscribed gets nothing, with one exception: if it is typed into a signup form again, we send it a single message asking whether to turn alerts back on, and nothing resumes unless the button in that message is pressed (section 1). We send nothing else to the list, no announcements and no marketing from us or from anyone else, and we do not rent or share the list.

Every message carries an unsubscribe link in its body and the List-Unsubscribe header that lets a mail client offer its own one-click unsubscribe button. Unsubscribing takes effect immediately by either route.

The links in a message that lead to the board carry campaign tags naming the kind of message they are in, such as the weekly digest (section 1.6). They say nothing about who it was sent to.

Email is delivered through Amazon SES (section 4), which records whether each message was delivered and whether it bounced, and which stops delivery to an address that bounces. If a message cannot be sent, our own run log records the address and the reason so that we can see what failed. The digest shows company logos and the picture of the week, set in the typeface of the Site. The images and the typeface all load from the Site itself, never from a third party, subject to the image settings of your mail client.

4. Service providers

We share personal information only with the companies that run parts of the Site for us, each bound by its own contract to process it on our instructions and for no purpose of its own:

• Supabase, the database and picture storage. Everything described in section 1 lives there.
• Vercel, the host. It serves the pages, keeps the short-lived server logs of section 1.5, and resizes the picture of the week for the digest.
• Amazon Web Services, email delivery through its Simple Email Service, as section 3 describes.
• Anthropic, the automated classifier. It reads job postings (their title, employer, location and description), the careers pages of employers, and lists of employer names, and it translates a posting on request. It never receives anything about a visitor: not an address, not a report note, not a subscription.
• Bright Data, from which we buy LinkedIn and Indeed listings as data. That exchange runs one way, from them to us, and carries nothing about visitors.
• Google, which provides Google Analytics under its data processing terms (section 1.7), and whose public favicon service our server asks for a company mark when a listing has no logo of its own (section 5). Google Analytics is loaded by your browser, directly from Google; the favicon request comes from our server, not from your browser.

We do not sell personal information, and we do not share it with anyone for advertising.

5. Company logos and links to other sites

Some company logos on the Site are served from the Site itself: your browser asks our server for the image and our server fetches the mark, so no other party sees your request. The others your browser fetches directly, and the server holding the image sees an ordinary image request from your network address, as it would for a picture on any web page. They are the logo addresses that listings from LinkedIn or Indeed carry, on servers belonging to those companies; the logos of some employers, read from the website of the employer; the marks of some larger companies, taken from Wikimedia Commons; and a logo an employer has sent us, held in our picture storage with Supabase (section 4).

Every apply button leaves the Site, in a new tab, for the page of the employer or of the source the listing came from. A credit on a picture leaves for the portfolio address the maker gave. Once you have left, the site you land on is governed by its own privacy policy, not by this one.

6. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, the law asks us to name a legal basis for each use of your personal information:

• Consent, for the welcome message and the digest, and, in the European Economic Area and the United Kingdom, for Google Analytics (section 1.7). You give it by subscribing, or with the Accept button, and withdraw it by unsubscribing, or with the Cookies link at the foot of every page, at any time.
• A request you made, for publishing a submitted picture with its credit, for holding your email address so that we can answer you about it, and for filing a report you chose to make.
• Our legitimate interests in running an accurate board and keeping its forms open to everyone: checking a reported listing, counting reports and capping the daily use of each form, counting how the Site is used (section 1.6) and, in Switzerland, through Google Analytics until you turn it off (section 1.7), keeping server logs, and keeping the Site secure. In each case we hold the least we can, a keyed hash rather than an address, and you may object (section 9).

No decision producing legal or similarly significant effects on you is made about you by automated means. Our automated systems judge job postings, not people.

7. Where information is stored

We are based in the United States, and the providers named in section 4 store and process personal information there; a provider may also process it in other countries where it operates. If you are in the European Economic Area, the United Kingdom or Switzerland, this means your personal information is transferred to a country whose law may not protect it in the same way as your own. Those transfers rest on the standard contractual clauses approved by the European Commission, and their United Kingdom equivalent, as included in the data processing terms of each provider.

8. How long we keep it

• Email subscriptions: for as long as you are subscribed. Once you unsubscribe, the record stays, marked unsubscribed and holding any reason and note you gave, until you ask us to delete it.
• Job reports: as part of our record of the listing they concern, until you ask us to delete yours.
• Picture submissions: for as long as the picture is in our library, whether on the homepage, waiting for its turn or retired. A withdrawn picture is removed as section 4.5 of the Terms describes. A declined picture may be deleted permanently, file included, after which nothing of the submission remains.
• Network address hashes: with the record they belong to, and deleted with it; the daily visitor hashes of section 1.6, ninety days; those recorded with a wrong administration password, a day.
• Run history: our log of each email run, including the address of any message that failed, is kept as an operating record; an address in it is deleted on request.
• Google Analytics: the records Google keeps for us, no longer than fourteen months under the retention setting of our account, and the totals in its reports after that. Its cookies last as section 2.5 says, and your answer about them six months (section 2.4).
• Server logs: briefly, under the retention policy of our host.
• Backups: copies in routine backups are deleted on our ordinary backup cycle.

9. Your rights

Wherever you live, you may email us to see what we hold about you, to correct it, or to have it deleted, and we will do it. Unsubscribing needs no email at all: the link is in every message.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have in addition the right to restrict our processing, to receive the information you gave us in a portable form, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting what was done before. You may also lodge a complaint with the supervisory authority where you live.

To exercise any of these rights, email hello@justidjobs.com from the address in question, or with enough detail for us to find your records. We may ask you to confirm that the address is yours, and we answer within one month, usually much sooner.

10. California residents

The California Consumer Privacy Act, as amended, gives California residents the right to know what personal information a business collects about them and how it is used and shared, to delete it, to correct it, and not to be treated differently for exercising those rights. Sections 1, 4 and 8 of this Policy are that disclosure.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have done neither in the preceding twelve months; Google Analytics is set up so that it does neither (section 1.7). We collect no sensitive personal information. There is therefore nothing to opt out of, though a Global Privacy Control signal is honoured all the same: it switches off both the Site's own counting and Google Analytics. To exercise any right, email hello@justidjobs.com; an authorized agent may do so on your behalf with your written permission.

11. Security

Traffic to the Site is encrypted in transit. Every write to the database goes through our server, holding a key that is never sent to a browser, and the administration area sits behind a password and a signed session. No system is perfectly secure, and we cannot promise that information will never be lost or misused, but we hold as little as the Site needs and each form is built to accept no more.

12. Children

The Site is for people looking for work, and it is not directed at children. You must be at least 16 to subscribe to the digest, report a listing or send in a picture (section 1 of the Terms), and we do not knowingly collect personal information from anyone younger. If you believe someone under 16 has given us personal information, email us and we will delete it.

13. Changes to this Policy

We may revise this Policy from time to time. The effective date at the top of this page changes when we do, and material changes will be reflected there before they take effect.

14. Contact

Questions about this Policy and requests under it go to:

Anson Cheung Design LLC
3400 Cottage Way, Ste G2 #10556
Sacramento, California 95825
hello@justidjobs.com