Privacy notice

In short

XCRS is a free, non-commercial project run by one person. It works without an account. If you sign in, we keep what is needed to show you your results again, and nothing more. There are no ads, no analytics and no tracking cookies, and nothing is sold or shared.

Without an account

When you ask for recommendations, we store the skills on your board, your optional years of experience, the results, any thumbs or comments you give, and when this happened. Nothing links this to you. Anyone with a result's link can open it, so share links with care. To limit abuse, your IP address is held briefly in memory for rate limiting; it is not stored in the database.

With an account

You can sign in with GitHub, Google or LinkedIn. From them we keep:

• your name and the provider's id for your account;
• your email address, only if the provider has verified it (accounts with the same verified email are joined into one);
• when you joined and last signed in.

We don't keep passwords, profile pictures or the provider's access tokens. Your board and the results you make while signed in (or save to your account) are linked to your account.

Importing your CV or LinkedIn PDF

If you're signed in, you can let XCRS read a CV or LinkedIn's "Save to PDF" of your profile, or text you paste, to suggest skills for your board. The file is read in memory on our own server, and our own language model (running on that server, not a third-party service) picks out skills and the dates of your jobs. Nothing from the file is stored: not the file, its text or what the model found. The suggestions are kept in memory for at most 15 minutes, until you see them, and our logs record only the size of the text, not its content. Only the skills you choose to add to your board are kept, like any board, and saved to your account. Hidden text and lines written as instructions to an AI are ignored, and we tell you when that happens.

Cookies

Only cookies the site needs: when you sign in, an encrypted session cookie (for 30 days) and, during the sign-in itself, short-lived cookies that protect it. No cookies are set if you don't sign in. Your colour-mode choice is stored only in your browser (localStorage) and is not sent to us.

Your rights

On your account page you can download everything we keep about you (as JSON), delete single results, sign out on all devices, and delete your account. Deleting the account deletes your board, your results and the feedback on them, at once. Backups of the database are kept for up to 14 days and then replaced, so deleted data leaves them within that time.

For any other question about your data (access, correction, objection), open an issue or contact the maintainer through the project's GitHub page.

Where the data is

On servers the project runs itself. The explanations are written by a language model on those servers; your data isn't sent to an outside AI service. Visitors reach the site through Tailscale Funnel, which relays the encrypted connection without reading it.