How this site handles your data

The short version

• Your conversations with the AI assistant are stored, and Edward can read them.
• What you type to the assistant is sent to Google's Gemini AI to generate replies. The site uses Gemini's paid API, under which Google doesn't use your content to train its models.
• If you tell the assistant where you work, or sign in with a work email and accept its offer, it researches your company from public sources. It never researches you as a person.
• The assistant remembers a few things you tell it about yourself and your work (like your company or the role you're hiring for) across conversations, for up to 12 months.
• How each reply is produced (your message, the assistant's steps and its answer) is recorded in LangSmith for about 14 days, to debug and measure the assistant's quality.
• IP addresses are recorded to limit abuse and costs, and used to estimate roughly where you are (your city and country) — which the assistant only brings up if you talk about location.
• There are no analytics or advertising trackers, and nothing is sold or shared for marketing.
• You can ask for your data to be deleted at any time through the contact form.

What's collected, and why

Visiting the site

A random identifier stored in a cookie (device_id), so the site can keep your conversation and apply fair-use limits without an account. No analytics or tracking scripts run.

Chatting with the AI assistant

Your messages and the assistant's replies, the time, token counts and technical traces of how each reply was produced, and your IP address. Stored so the conversation continues across visits, so Edward can review conversations to improve the assistant and follow up on opportunities, and to enforce usage limits. Your messages are sent to Google's Gemini API to generate replies. While you chat, the assistant also keeps a short-lived working copy of the conversation, including the results of any lookups it made and, in longer conversations, a summary of the earlier part, so it can pick up where you left off.

Company research and role comparisons

When you name your company or its website, or accept the assistant's offer to research the company in your work email's domain, the site reads that company's public website and searches the web about the company, and stores the resulting company profile (shared across visitors, like a cache). It records that you asked about that company. A job description you paste is sent to Gemini to compare it with Edward's experience. None of this looks up information about you personally.

The research lab

The company you enter, the research steps, and your review decisions. The step-by-step record of a run is deleted after 7 days; the resulting company profile joins the shared company cache.

Opening a link from one of Edward's job applications

Edward puts a personal link on the job applications he sends. If you open one, the site remembers which application you're looking at (in a cookie) and records when the link was opened, so the assistant can talk about that role and Edward can see that the application was viewed. The record is tied to your visitor identifier, not your name (unless you sign in). Visits by link-checking services that don't run a browser aren't recorded.

Signing in

With Google: your name, email address and profile picture, your Google account ID, and the sign-in tokens Google issues. With an email code: your email address and a hashed, short-lived code. For security, each sign-in attempt is logged with its IP address and browser type, and signed-in sessions are stored (with IP and browser) so they can be revoked. Signing in raises your usage limits and, with a work email, lets the assistant offer to research your company.

The contact form

Your name, email and message are emailed to Edward and aren't stored by the site.

Long-term memory

A few short notes about you that you've told the assistant — for example your name, your company, your role, or the role you're hiring for — so a later conversation can pick up where you left off. It never keeps sensitive details (health, finances, family and the like), contact details or anything the assistant itself said, and you can see what it recalled in each reply's details. This applies whether you're signed in or not; without an account the notes are tied to your browser's device_id cookie. To have them deleted, use the contact form.

Visitor profile

A few plain fields, so the assistant knows who it's talking to and Edward can see who's visiting: your name (from Google sign-in, or if you tell the assistant), and your company, your role and the role you're hiring for, only if you tell the assistant. Also your approximate area (city, region and country), estimated from your IP address by the hosting provider — it can be wrong, and it's never used to look you up. The assistant uses these to tailor its answers, never mentions your area unless you bring up location, and never researches you as a person. To correct or delete them, tell the assistant ("forget my role") or use the contact form.

Usage records

Each AI action (a chat turn, a company lookup, a lab run, a role comparison) is logged with your visitor identifier, IP address and token count, to enforce per-visitor, per-network and site-wide daily limits.

Who else processes it

These service providers process data on the site's behalf, under their own terms. Some are outside Canada, so your data may be processed in other countries, including the United States.

Google

The Gemini API (generating replies, company research and role comparisons, and the embeddings used to search Edward's portfolio and your long-term memory), on the paid tier, under which Google doesn't use prompts or responses to improve its products. Also Google sign-in, reCAPTCHA (bot protection on sign-in), and a favicon service used to show company logos.

Vercel

Hosts the website and runs its server code.

Neon

Hosts the database where the data above is stored.

Resend

Delivers sign-in code emails and contact form messages.

LangSmith (LangChain)

Records how each reply is produced — your message, the assistant's steps, the tools it used and what they returned, and the reply — so problems can be debugged and the assistant's quality measured. It doesn't receive your name, email or account details. Traces are kept for about 14 days.

Exa

Web search for company research and company lookups. It receives the search queries — the company name or website being researched and the topics being looked into — not your messages or who you are.

Cookies and local storage

device_id

Identifies your browser as a visitor. Lasts one year.

session_token

Keeps you signed in. Lasts 30 days, or until you sign out.

Sign-in cookies

Short-lived cookies that secure the Google sign-in flow.

application

Set only if you open a personal link from one of Edward's job applications: which application you're looking at. Lasts 90 days.

Theme preference

Your light/dark choice, kept in your browser's local storage.

All of these are needed for the site to work; none are used for advertising or to track you across other sites.

How long it's kept

An automatic cleanup runs every day and deletes data once it reaches these limits:

• Conversations: 12 months after the last message.
• Visitors without an account: removed entirely once they have no conversations left and were first seen over 12 months ago.
• Usage records and sign-in attempt logs: 12 months.
• Records of an application link being opened: 12 months.
• Expired sign-in sessions: 12 months after they expired. Sign-in codes: a day after they expire.
• The assistant's working copy of a conversation: 7 days after the last message.
• Long-term memory notes: 12 months after they were last updated, or straight away if your visitor record is removed.
• Visitor profile (what you told the assistant about yourself, and your approximate area): 12 months after it was last updated. A name from your Google sign-in stays with your account.
• Traces of how replies were produced (at LangSmith): about 14 days.
• Research lab run records: 7 days.
• Accounts (if you signed in): until you ask for your account to be deleted.
• Company profiles: refreshed after 30 days; they describe companies, not people.
• Contact form messages: in Edward's email, not on the site.

Your choices and rights

You can ask what data the site holds about you, ask for it to be corrected or deleted, or withdraw your consent to its use. Use the contact form and say what you'd like. If you've been chatting without an account, include roughly when you chatted and something you asked, so your conversation can be found. You'll get a reply within 30 days. If you're not satisfied with the response, you can complain to the Office of the Privacy Commissioner of Canada.

You can also clear the site's cookies in your browser at any time; you'll start a fresh conversation.

Security

Data is sent over encrypted connections. Sign-in codes are stored only as hashes, sessions can be revoked, and only Edward has administrative access. No system is perfectly secure, so please don't share passwords, financial details or other sensitive information with the assistant.

Children

This site is intended for adults and isn't directed at children.

Changes

If what the site collects changes, this page will be updated and its date changed. Questions? Use the contact form.