Security.

Your account is yours.

Every row carries the account it belongs to. Each request runs as a restricted database role that names your account, and a policy on every table (row-level security) refuses any row that is not yours, even if a query forgets to ask for yours. The queries name your account too, so both layers would have to fail before one account saw another account’s rows. Tests try to read, change and delete across accounts, and must fail.

Every private page and request checks your sign-in itself, rather than trusting a check made earlier.

Your connected AI app signs in, and you can take it back.

Your AI agent connects with OAuth 2.1: it sends you to sign in to Jobs.Dog and approve it, so no password or key is pasted anywhere. Its access is checked on every request against the sign-in service’s published keys, and lasts an hour at a time. Press Disconnect on Settings, Connections, and it stops on its next request.

It can add and correct facts. It can also save, pass or star a role through one separate call, and the role shows the name the AI gave itself. It is refused if it tries to set the day you applied, or read or change your settings, email or password.

Unless Muttly is on for you, Jobs.Dog sends nothing you store to any model. Your connected AI app’s vendor sees what your connected AI app reads, under that vendor’s terms.

Muttly.

Muttly is on unless you turn him off, on Settings, Muttly. When he is on, hereads your account as you, through the same database rules and the same reads a connected AI app uses, so he cannot reach another account. He reads your jobs, companies and applications, with your saves, passes, stars and application stages, only as a question needs them. He is never sent your name, email address, application details, current pay or the reasons you gave for passing on a job.

He reaches the company that runs his model with a short-lived credential, obtained for each request from our host’s own identity for that deployment. No long-lived key for him is stored in production.

Your conversations with him are encrypted with a key made for your account before they are stored, deleted 400 days after a conversation’s first message while chat sharing is on or 30 days after it while sharing is off, and deleted at once when you press Clear conversations.

He cannot save, pass or star a job, mark one applied, or change your criteria or settings. He can suggest one of those, and nothing changes until you tap it. A summary or fit note he writes is shown as Jobs.Dog’s. He takes a limited number of questions a minute, has a daily and a monthly allowance and a ceiling across the whole service, and one switch turns him off for everyone at once. We may pause or suspend access to him if he is misused.

No master key in the app.

The site holds only the public database key a browser is allowed to see, and it opens nothing: the database’s direct web interface is off and every table sits behind row-level security. The service-role key, which would skip those rules, is not in the app.

What your browser may load.

Every page carries a content security policy that allows scripts, styles, fonts and images from this site only:

script-src 'self' 'unsafe-inline'
style-src 'self' 'unsafe-inline'
img-src 'self' data:
font-src 'self'

No other site may frame a page here, and forms post only to this site. Private pages are never kept by a shared cache or shown to search engines.

Passwords and sessions.

Passwords are at least 12 characters, checked against known leaks, and held only as a hash by our sign-in service; the site never stores one. Your sign-in cookie cannot be read by page scripts, travels only over HTTPS, and lasts 30 days from your last visit. Sign out everywhere, on Settings, Account, ends every signed-in session the account has. To stop a connected AI app, press Disconnect on Settings, Connections.

What we keep, and for how long.

• Everything in your account, for as long as it exists.
• Delete your account on Settings, Account, with your password and DELETE typed out, and everything on it is deleted at once. A copy can remain in our backups for up to 90 days, and then it is gone.
• Sign-in records, which hold an IP address and a browser name, for 7 days.
• Conversations with him, if he is on for you, for 400 days from a conversation’s first message while chat sharing is on, 30 days while it is off.
• Error records and our host’s request records, which hold a code, a reference and the page address, never your roles or notes, for about a day.
• Download everything as one file on Settings, Account, whenever you like.

Whoever runs Jobs.Dog holds the database credentials and could read any row. We look at an account only when its owner asks for help with it, when we need to investigate a security problem or abuse, or when the law requires it.

No system is perfectly secure. If a breach affects your information, we will tell you without unreasonable delay and within the time the law sets, and say what happened and what we are doing about it.

Reporting a problem.

Write to security@jobs.dog with what you found and how to see it. If the site showed you an error, use Contact us in the account menu, or write to us. Anything that is not a security problem goes to hello@jobs.dog.