Privacy policy

Last updated: 2 August 2026

This app is under active development. Job Crafter is a private, non-commercial project in a closed testing phase (invite only). Features, wording and data structures change continuously, errors and outages are possible, and nothing is promised about availability, correctness or permanent storage. Please don't store anything here whose loss you couldn't live with.

This English text is a convenience translation. In case of doubt, the German version prevails.

This policy describes which personal data Job Crafter processes, why, on what legal basis and for how long. It is deliberately written in plain language.

1. Controller

The controller under the GDPR is:

Tim Strupat
Laan van Nieuw-Oost Indie 232A
2593CD Den Haag
The Netherlands
Email: tim@strupat.de

The controller is established in the Netherlands. No data protection officer has been appointed — the conditions of Art. 37 GDPR are not met for a project of this kind. Please direct all requests to the address above.

2. What "in development" means for your data

The app is being developed continuously. Concretely: data structures may change, features may appear or disappear, and in the event of a fault data loss cannot be ruled out. New features may process new kinds of data — this policy is updated when they do.

Access is limited to invited people. There is no public sign-up and no public content.

3. Principle: as little data as possible

An account needs no email address — the username is free to choose and may be a pseudonym.
There is no tracking, no analytics, no advertising and no sharing for advertising purposes.
Your content is visible only to you. It is never published or shared with other users.
Content is sent to an AI provider only if you have explicitly consented.

4. What data is processed

Account and sign-in

Username (free to choose, pseudonym possible)
Password — stored only as a bcrypt hash, never in clear text
Time of registration, approval status, admin rights if applicable
Sessions: a random session id and its expiry date
Invite and password-reset links: only a hash of the token is stored; single-use and expiring

Your content (everything you enter yourself)

Notes including their classification (dimension, energy, "more/less" wish) and tags
Role profile: e.g. first name, job title, organisation, responsibilities, goals, motives, strengths, interests, skills, growth areas, contract details and free-text notes
Task blocks of the week overview (today's week and your ideal week)
Tiny challenges including your reflections
Coaching conversations with Sprout: the full transcript and the summaries of wrapped-up conversations
AI-generated documents (reflection, clustering, conversation guide) and the cached synthesis for the Insights page
Settings: language, reminder days and times, progress, and the time you gave AI consent

Notes and conversations can contain sensitive information — about strain, health, conflicts or your professional situation. That is a special category of personal data (Art. 9 GDPR). You decide what you enter. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting the content or your account.

Technical data

AI usage log: time, feature used, model name, number of tokens processed and estimated cost — needed for the weekly AI budget. No conversation content.
Push subscriptions (only if you enable notifications): the delivery address of your browser's push service and the associated encryption keys
Abuse protection: counters for failed sign-in and sign-up attempts. The counter key contains your IP address or the username used; the window is one hour.
Server and proxy logs of the hosting system: IP address, time, requested address, browser identifier

5. Cookies and local storage

jc_session — sign-in cookie, HttpOnly and SameSite=Lax, valid for 60 days. Signing in is impossible without it.
jc_locale — your language choice, valid for one year (also a cookie so the page renders in the right language immediately)
In your browser's local storage: language, colour scheme (light/dark), your first name for the greeting, whether you have seen the coach introduction, reminder settings, when the install hint was last shown, and a queue for notes captured while offline
A service worker cache so the installed app (PWA) also works offline

All of these are necessary to provide the service you explicitly requested (Article 11.7a(3) of the Dutch Telecommunications Act, implementing the ePrivacy Directive), so no consent banner is required — there are no cookies for analytics, profiling or advertising.

6. Purposes and legal bases

Account, sign-in and providing the app — Art. 6(1)(b) GDPR
Storing and displaying your content — Art. 6(1)(b) GDPR; for sensitive information additionally Art. 9(2)(a) GDPR (explicit consent)
AI features (transmission to the AI provider) — Art. 6(1)(a) GDPR (consent, withdrawable at any time)
Push notifications — Art. 6(1)(a) GDPR (consent, withdrawable at any time)
Abuse protection, logs, operational security — Art. 6(1)(f) GDPR (legitimate interest in secure operation)

7. AI features in detail

AI features only work after you have explicitly consented; the server checks that consent on every single request.

What is transmitted is the slice of your context the feature needs: role profile, current notes, task blocks, challenges and the transcript or summaries of earlier conversations. Your username, your password hash and technical identifiers of your account are not transmitted.

Provider in use: Google (Gemini API; models: gemini-2.5-flash, gemini-2.5-pro). Depending on the account, the contracting entity is Google Ireland Limited or Google LLC (USA). A transfer to the USA is based on the EU-US Data Privacy Framework adequacy decision or the EU standard contractual clauses.

Important: on the free Gemini API tier, Google may use the transmitted content to improve its services; on the paid tier its terms exclude this.

The model's answer is stored in your account (e.g. as a transcript or a document). You can withdraw consent at any time under Settings → AI data processing. All AI features are then blocked; content already generated remains until you delete it. Withdrawal takes effect for the future.

8. Recipients

Hosting: Hetzner Online GmbH, Nürnberg (Germany) — runs the server hosting the app and database (processing under Art. 28 GDPR)
AI provider: see section 7 — receives the content described there once you have consented
Push services of the browser vendors (e.g. Google, Mozilla, Apple, Microsoft): they deliver notifications and receive the delivery address and the notification's content. That is why notifications contain only short, general prompts and never note content.

No other data is shared. Data is never sold, and no analytics or advertising services are used.

No external resources: fonts, icons and everything else the page needs are served by this app itself. Opening the app therefore creates no connection to any third party — apart from the cases named above (an AI request after your consent, and push delivery).

9. Transfers to third countries

Where the AI provider processes data in the USA, the transfer is based on the EU standard contractual clauses or the EU-US Data Privacy Framework adequacy decision. Despite these safeguards it cannot be fully excluded that US authorities access the data and that legal protection against this is weaker than in the EU. If you'd rather avoid that, use the app without AI consent — capturing, structuring and the week overview work without AI.

10. Retention and deletion

Account and content: until you delete them. Settings → Delete account removes your account and all related data (notes, profile, conversations, documents, challenges, push subscriptions, AI usage log) immediately and irreversibly.
Individual notes, conversations and documents can be deleted in the app at any time.
Sessions: 60 days at most; immediately on sign-out.
Abuse counters: a one-hour window; the entry is overwritten on the next request.
Server and proxy logs: 7 Tage
Database backups: 14 Tage — deleted data may still be contained there until then.
Invite and reset tokens: until used, at most until they expire.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Any consent you have given can be withdrawn at any time with effect for the future (Art. 7(3) GDPR).

Deletion and withdrawal are available directly in the app. Access and copy requests are currently handled manually — please write to the address in section 1; an in-app export is planned.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). As the controller is established in the Netherlands, the competent authority is the Dutch data protection authority Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ The Hague, Netherlands, autoriteitpersoonsgegevens.nl). You may also contact the supervisory authority where you habitually reside.

12. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The AI coach only produces suggestions and questions you can accept or discard; no decisions with legal effect are derived from them.

13. Security

Transmission is encrypted throughout (HTTPS/TLS)
Passwords only as bcrypt hashes; session cookies signed, HttpOnly and SameSite=Lax
The database is not reachable from the internet; only the operator has access
Access to the app only by invitation or approval; revoked approval takes effect immediately
Your content is passed to the AI model structurally separated from the instructions

Nobody can guarantee absolute security — and that holds all the more while this app is in development.

14. Changes to this policy

As the app evolves, this policy may be amended. The version published here applies; the date at the top shows when it was last changed. We will point out substantial changes — such as switching AI provider — inside the app.