Privacy Policy

Last updated: October 11, 2026

1. Controller

Scalr Ventures LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA, represented by Marcel Jendrusch. Contact: hello@jobscalr.works.

2. What we collect

• Account data: an anonymous account ID created on first launch; optionally your email address and a password hash if you secure your account.
• Profile and onboarding answers: target role, locations, experience level, preferences, and the answers you give during onboarding.
• Your CV: the resume you upload, and the tailored CVs and cover letters generated from it. CV content is encrypted at rest.
• Job activity: jobs you save, analyze, apply to, and your interview-prep progress.
• Usage events: which features you use, to operate, secure, and improve the service. We never sell personal data. To measure which of our ads lead to sign-ups and purchases, we share a small set of conversion events with Meta and Google (see section 6).
• Web sign-up (website): if you start on our website, we store your quiz answers, the ad click identifier in the link you arrived through (for example fbclid), and, when you go to checkout, your IP address and browser user agent. The website sets no cookies and loads no third-party tracking scripts.
• Payment data (website): if you subscribe on our website, your email address, billing details and payment method are collected by Stripe. We receive the subscription status and the amount, never your full card number.
• Device basics: timezone and language, to show weeks and dates correctly.
• Waitlist email (website): if you enter your email on our website to join the waitlist, we store that address, your language, and the time you signed up, and send you a confirmation link (double opt-in). We use it only to tell you when JobScalr is available. You can unsubscribe at any time by contacting us; we never sell it.
• Reminder emails (optional): if you turn on email reminders in the app, we store that choice, when you made it, the address it applies to, and your timezone. If your address isn't verified yet, we first send a confirmation link (double opt-in). We then email you at most one reminder a day (for example a job that fits your profile, a follow-up that's due, or your weekly recap), sent through our email provider Resend. Every email has an unsubscribe link, and you can also turn reminders off in the app at any time. We record when you tap the button in a reminder email, so we know which reminders are useful. We don't track whether you open an email. If an email bounces permanently or is reported as spam, Resend tells us and we turn reminders off for that address.

3. Why we process it (legal bases, Art. 6 GDPR)

• To provide the service (Art. 6(1)(b)): matching you with jobs, generating documents, tracking your application progress.
• With your consent (Art. 6(1)(a)): processing your uploaded CV, and sending you reminder emails if you turned them on. You can withdraw consent at any time by deleting your CV or account, or by unsubscribing from the emails.
• Legitimate interests (Art. 6(1)(f)): preventing abuse, securing the service, fixing errors.

4. AI processing

When you use an AI feature (match analysis, CV tailoring, cover letters, interview prep), the relevant content (your CV text and the job posting) is transmitted to an AI provider to generate the result. We send only what the feature needs.

We currently reach the AI models through OpenRouter (OpenRouter, Inc., USA), a service that forwards each request to the model provider. Depending on the feature, the model is run by OpenAI (OpenAI, L.L.C., USA) or Google (Google LLC, USA). We may also use Anthropic (Anthropic, PBC, USA) or Google directly. We have configured OpenRouter to exclude model providers that use request content to train their models. These providers process your data on our behalf.

5. Analytics and diagnostics

To understand how the app is used and to keep it stable, we process pseudonymous usage and diagnostic data. This includes which screens and features you open, funnel steps (e.g. onboarding, purchase), and — if the app crashes — a technical crash report. Events are tied to a random account identifier, never to your name, and never include your CV, job, or cover-letter text.

We use the following processors for this:

• PostHog (EU-hosted) — product analytics, processed on our servers and forwarded to PostHog in the EU.
• Google Firebase Analytics and Crashlytics (Google, USA) — in-app usage analytics and crash diagnostics.

Legal basis: our legitimate interest in measuring, securing and improving the service (Art. 6(1)(f) GDPR). You can object to this processing or delete your account at any time (see section 11).

6. Advertising measurement

We advertise JobScalr on Meta (Facebook, Instagram) and Google. To learn which ads lead to installs, sign-ups and purchases, and to show our ads to people more likely to find the service useful, we share conversion events with:

• Meta (Meta Platforms Ireland Ltd., with transfers to Meta Platforms, Inc., USA): the Meta SDK in the app reports app installs, app opens and purchases, together with your device's advertising identifier where your device settings allow it. Our servers additionally send purchase events through Meta's Conversions API with a hashed account ID, your email address in hashed form once you have added one, the ad click identifier, and, for website purchases, the IP address and user agent from checkout.
• Google (Google Analytics 4, via Firebase): our servers send a short list of events, such as account creation, the first analysis and a subscription purchase with its value, linked to the app's Firebase installation identifier.

We never share your CV, job or cover-letter content for advertising. Legal basis: our legitimate interest in measuring and improving our advertising (Art. 6(1)(f) GDPR). You can object at any time by contacting us. On iOS you can also turn off tracking in Settings → Privacy & Security → Tracking, and on Android you can reset or delete your advertising ID in the device settings.

7. Subscriptions

If you buy a subscription, purchase and entitlement data is processed through Adapty (Adapty Tech Inc., USA), which manages subscriptions on top of the Apple App Store and Google Play. Adapty receives a pseudonymous account identifier and the purchase details needed to grant and validate your subscription. The payment itself is handled by Apple or Google, not by us.

If you subscribe on our website instead, the payment is processed by Stripe (Stripe Payments Europe, Ltd., Ireland, with transfers to Stripe, Inc., USA). Stripe collects your payment details directly, may use them to prevent fraud, and tells us whether the payment succeeded. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

8. Storage and security

Your CV text is encrypted at rest. All transfers between the app and our servers use TLS. Access to production systems is restricted.

9. Retention

• CV text of anonymous accounts that have been inactive for 30 days is automatically deleted.
• Deleting your account in the app removes your personal data.
• If you don't sign in to a registered account for 24 months, we email you a warning and delete the account 30 days later unless you sign in before then. An account with an active subscription or unused credits is not deleted this way.
• Invoices for purchases are kept for as long as tax law requires.
• Aggregated, non-personal usage statistics may be kept longer.

10. Sharing and transfers

We never sell your data. We share it only with the parties needed to run the service: our hosting provider Hetzner (Germany), OpenRouter, OpenAI, Google and Anthropic (AI processing), PostHog (product analytics), Google Firebase (in-app analytics and crash diagnostics), Adapty (subscription management), Stripe (website payments), Resend (email), and Meta and Google for advertising measurement (section 6). Where a recipient is located outside the EU/EEA (OpenRouter, OpenAI, Google, Anthropic, Adapty, Resend, and Meta and Stripe for their US transfers), transfers are safeguarded under the EU–U.S. Data Privacy Framework and/or standard contractual clauses.

11. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time with effect for the future. You can delete your CV or your entire account directly in the app (Profile → Privacy & data) — see our account deletion page for the full process — or contact us at hello@jobscalr.works. You also have the right to lodge a complaint with a data-protection supervisory authority.

12. Changes

We will update this policy when the service changes. The current version is always available at this URL; material changes are announced in the app.

Terms · Privacy · Imprint · Verträge hier kündigen