Privacy

If you have an account

Stored in the dashboard’s database, visible only to you:

Your GitHub login and numeric GitHub id

To sign you in and tell accounts apart even when a login changes. Your name, avatar and e-mail are not written to the database: GitHub sends the public profile at sign-in and it stays in the encrypted session cookie in your browser for up to 30 days. Devtriage never sees your GitHub password; you can revoke it in GitHub → Settings → Applications at any time.

Or, signed in with Google: your Google account id and name

Devtriage asks Google for the basic profile only, never your e-mail address. The account id tells accounts apart; your name is shown in the dashboard instead of a login. Your profile picture stays in the encrypted session cookie only. Devtriage never sees your Google password; you can remove its access in your Google Account → Security → Third-party apps at any time.

Or, signed in with LinkedIn: your LinkedIn account id and name

Devtriage asks LinkedIn for the basic profile only, never your e-mail address. The account id tells accounts apart; your name is shown in the dashboard instead of a login. Your profile picture stays in the encrypted session cookie only. Devtriage never sees your LinkedIn password; you can remove its access in LinkedIn → Settings → Data privacy → Permitted services at any time.

Your criteria

Minimum salary, technologies, title words to skip, locations, agencies and companies to hide, the searches and careers pages you follow, your hours, tax form, ZUS stage and costs, and, if you enter it, your current contract.

Saved views

The names you give to sets of filters on All offers, and the filters themselves.

Your statuses, notes and their history

Interested, Applied, Interview and so on, with the date of each change, where it came from (dashboard, extension or a forwarded e-mail) and a short note of the evidence, such as the page it was seen on.

Applications you add by hand

Where they came from (a board, a company, a referral, a recruiter), the name you give that source and, if you fill it in, the contact person. Add only what you need to follow up.

Offers you bring in

An offer Devtriage has not seen (from LinkedIn, pracuj.pl, theprotocol.it or a forwarded alert) is stored once, shared, with its title, company, place, published pay, named technologies and link, so every account can see where else the same job is posted. These rows say nothing about you and stay after you delete your account.

Extension tokens

Stored only as a one-way hash, with the name you gave, creation date, last use and the browser’s user-agent string from its last call. You can revoke them in Connections.

Extension activity

Per job board: when the extension last talked to the dashboard and how many offers and applications it recorded. No browsing history.

Days you used it

The dates (not times) you opened the dashboard or the extension talked to it, so the owner can count active accounts. Nothing about what you did.

Your account row

When it was created, when you last opened the Inbox, the random key of your alert address, and whether the owner added you to the daily scan or blocked the account.

Your corrections

“Not the same?” and “Same offer?” answers on matched offers.

Job alerts you forward

Only the offers found in them (title, company, place, published pay, link); the e-mail itself isn’t stored. Devtriage never reads your mailbox: it sees only alerts you upload or forward to your private alert address, which is random and can be ignored or filtered away at any time.

Kept until you delete your account. Account downloads all of it as JSON (and the offers as CSV), can put a JSON export back, and deletes it; deletion removes your criteria, statuses, notes, applications, tokens, notifications, activity and corrections at once, and sessions issued before the deletion stop working. Offers and fingerprints you brought in, and messages sent while signed out, stay.

Shared by everyone

Read from public job lists by the scanner, or brought in from browsers and forwarded alerts, and used by all accounts. It contains no personal data about you:

Offers from public job lists

Title, company, location, technologies, the published salary and the link to the original ad. Ad text is not copied.

Description fingerprints

To spot the same job on other boards, the text of an ad is reduced to 128 numbers (a MinHash signature) and thrown away; the numbers cannot be turned back into the ad. Fingerprints come from the browser extension (computed in your browser on offers you open) and, for a few JustJoin.it and NoFluffJobs offers a day that matched someone’s criteria, from the scan opening the ad’s page.

Scan records

When each scan ran, which lists it read and how many offers it found. Each account sees only its own lists in them.

How long these are kept

Records of public job ads and their history (rates, reposts, where else the same job appeared) are kept indefinitely, as the market statistics behind Market pulse. They say nothing about anyone using Devtriage.

Market pulse shows only aggregates of these offers (counts, shares and rate ranges for stacks with enough offers), never single offers or anything about users.

The browser extension

Without an account (the default)

Your criteria (including the contract amount you may enter) and statuses are kept in Chrome’s storage and follow you to your other Chrome browsers if Chrome sync is on, which means Google’s sync servers hold a copy. Offers you saw on job lists and their fingerprints stay in this browser only. Nothing is sent to Devtriage.

What it reads

Only pages you open on JustJoin.it, NoFluffJobs, pracuj.pl and theprotocol.it, and on LinkedIn only if you turn that on in the popup (Chrome then asks for access to linkedin.com; its lists need a second switch): the offer list data the board embeds in its page, the title and company of the offer you view, and its description to compute a fingerprint. When you add an offer Devtriage hasn’t seen (e.g. from LinkedIn), it also sends the location, workplace and salary line the page shows, and the names of technologies the description mentions, never the description itself. It never clicks, submits or applies.

What it sends

With or without an account: at most one request a day to the National Bank of Poland’s public API for exchange rates. With an account, to your own dashboard only, with your token: the addresses of every offer link on the job pages you open (so they can be scored), the statuses you set, and description fingerprints. For pracuj.pl, theprotocol.it and LinkedIn, which no scan reads, it also sends the offers on those lists (title, company, location, technologies, published salary, link); if your account has no scans, the same applies to JustJoin.it and NoFluffJobs. On LinkedIn, when the page confirms an Easy Apply, the application is recorded automatically; you can undo it. Nothing is ever fetched from a job board in the background.

Removing it

The extension’s settings page exports everything as JSON and deletes it (the dashboard address and token stay until you disconnect). Removing the extension from Chrome deletes its data too.

Cookies and local storage

Session cookie

Keeps you signed in for up to 30 days. Set only after you sign in.

Theme cookie

Remembers light or dark mode.

Language cookie

Remembers English or Polish once you choose one; until then the browser’s language decides.

Not-counted cookie

Set only if you add ?count=off to an address (the owner uses it on test devices): page loads from that browser are left out of the totals. It holds no identifier.

Local storage

A few flags in your browser, such as that you have seen the help card or the setup checklist, and the rate you type into Market pulse. Nothing in it is sent to Devtriage.

Fonts are served by Devtriage itself; pages load nothing from third parties. There are no advertising or analytics cookies, so there is no cookie banner.

Counting page loads

The server adds one to a daily total each time someone loads About, Guide, Market pulse, Privacy, Terms, Contact or Sign in (in either language) or follows the link to the demo, kept per page and per source: the referring site’s name (e.g. google.com, never the page you came from), a ?ref= tag on the link, or “direct”. Nothing that tells visitors apart is stored: no IP address, cookie, browser details or script, and crawlers are left out. Only the owner sees these totals.

The help chat

“Ask” in the header answers questions about Devtriage with an AI model. What you type there, and the answers in the same conversation, are sent to the model provider, Groq (United States), set not to keep them, to produce the answer; Devtriage stores none of it, and the conversation stays only in this browser tab until you reload the page or start over. To limit use, a salted hash of your IP address is held in memory for an hour. Don’t type personal details there; for anything about your account, use the contact form.

Who runs it, where the data lives, and why

Devtriage is run by Adrian Zawadzki, a private person in Poland, who is responsible for the data in it (the controller under the GDPR). Write to hello@adrianzawadzki.dev or use the contact page.

The data lives with these providers: the database at Neon (AWS, Frankfurt); the dashboard at Vercel (functions in Frankfurt; Vercel keeps standard request logs for a short time); the scanner on GitHub Actions; sign-in through GitHub, Google or LinkedIn; forwarded alerts through Cloudflare Email Routing, where the deployment has mail; and notifications through your browser’s push service. Some of these companies are based in the United States and process data under their EU data-transfer terms. Devtriage’s own code makes no other copies, and nothing is sold or passed on for marketing. A weekly encrypted backup of the database is kept for 90 days.

Legal basis: your account data and the features you turn on are processed to provide the service you asked for; page-load counts, rate limiting and the owner’s ability to block an account rest on the legitimate interest of running and protecting a free service. Your rights to see, export and erase your data are built in (Account), and anything else can be asked by e-mail.

A message sent from the contact page is stored with the topic, the text, the e-mail address you give (optional), your account if you are signed in, and the technical details (page, browser, screen size, extension version) only if you tick that box. Your IP address is kept only as a keyed hash for 24 hours, to limit messages per hour, then removed. Messages linked to an account are deleted with it; other messages are deleted within twelve months of being answered, or earlier if you ask.

If you turn on notifications in Account, Devtriage stores that browser’s push address (issued by your browser’s push service, e.g. Google, Apple or Mozilla), its keys and the browser’s user-agent string, and sends one notification after a scan with something new for you. Turning them off or deleting the account removes it.