Privacy Policy

Ferret is a private, invite-only tool for running a job search. It is not a commercial service and it does not offer accounts to the public: nobody can sign up. Sign-in is refused unless the address is named in the deployment's own configuration or has been sent an invitation from inside the application by somebody who already has an account.

The application is open source, and anyone may run their own copy. This policy describes the instance you are reading it on. A separate deployment is operated by whoever runs it, and its data never reaches this one.

Three kinds, and nothing else:

• Your Google email address – and nothing else about the account. It is received when signing in and used to establish the session and to confirm the account is one that may sign in, which is the decision the address exists here to make. Sign-in does not ask for your name or your profile picture: the application displays neither, and asking for information in order to ignore it is worse than not asking.
• Information you enter – career history, skills, preferences, notes about employers, and writing samples supplied deliberately. Each account's material is its own: an account can read only what it created, and removing an account deletes its searches and everything they accumulated.
• Public job postings – retrieved from public job-board APIs and public careers pages. This is published employer information and contains no personal data about anyone else.

There is no analytics, no advertising, no tracking, and no third-party telemetry of any kind.

Ferret requests the https://www.googleapis.com/auth/drive.file scope at sign-in, alongside your email address. That scope reaches only files this application itself created, plus any folder you hand it deliberately – and nothing else in your Drive. It cannot list, open, or search the rest of it.

You choose that folder through Google's own file picker, in Settings. Choosing a folder there is what grants access to it, so the grant is something you perform on one folder rather than a permission over everything.

What the application does with it is narrow: it creates and updates draft résumés, cover letters, and research documents inside that folder. Reading the documents you already keep there is done by a separate read-only credential, and only for a folder you have explicitly shared with it.

Sign-in previously requested drive, the broad Drive scope. Grants issued then still carry it until the account next consents, at which point they narrow to the above. If you would rather not wait, revoking access at the link below and signing in again reissues the grant immediately.

Limited Use: Ferret's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never transferred for advertising, and never used to train any machine-learning model.

Data is stored in a private PostgreSQL database hosted on Amazon Web Services (us-east-1), encrypted at rest and reachable only over TLS. Three processors are involved, each for a single purpose:

• Amazon Web Services – hosting and storage.
• Anthropic – job postings and the operator's own profile text are sent to the Claude API to score role fit and draft documents. Sent under the Anthropic API terms, which do not permit training on it.
• Google – authentication, and creating documents in the operator's own Drive.

Data is not sold, rented, or disclosed to anyone else, in any circumstance.

Data is kept while the tool is in use. You can delete any of it at any time from within the application. An administrator can remove an account entirely, which deletes that account's searches and everything cascading from them, and withdraws its invitation so the address cannot return without being invited again. Revoking access at myaccount.google.com/permissions immediately ends this application's access to Google data.

Questions about this policy: brodydittemore@gmail.com.