DOORHUNTER

Privacy Policy

1. Core Privacy Architecture

Doorhunter is engineered around three non-negotiable architectural principles: per-hunter encryption, client-side inference, and absolute human authority. We believe your career history and job search strategy belong solely to you, not to a centralized platform or AI training pipeline.

2. Information We Process

• Authentication Data: When you sign in with Google OAuth, we receive your email address and unique subject identifier (under scopes openid and email). We do not request access to Google Drive, contacts, or calendar.
• Career Dossier: Resumes and career documents you explicitly upload to the console. These are parsed into factual claims and skill citations.
• Hunt Ledger: Job postings evaluated, search watches, triage notes, and application events you record in the system.
• Job Listings: Doorhunter reads whole job boards, so most of the doors it finds aren't for you. It keeps every one anyway (public listing information only, never anything about who was looking) in one pool that every hunter's search draws on. One hunter's pass is another hunter's next door. What you save, pass, hide or apply to stays yours.
• Passkey Records: For each passkey you add: its public identifier, the name you gave it, when it was added and last used, and a copy of your key that only that passkey can open. The passkey itself stays with your device or password manager.

3. Encrypted Storage & Key Custody

Each hunter profile is provisioned with an isolated database and an independent 256-bit AES-GCM encryption key made in your browser when you create your hunt.

• Your uploaded documents and sensitive notes are encrypted at rest using your key. Facts and short quotes extracted from your resume are stored unencrypted so they can be searched and cited.
• The server never stores your key. It holds the key in memory only while your hunt is unlocked, so your agent can read your hunt, and forgets it when you sign out, after eight hours without use, and when the service restarts. While your hunt is unlocked the operator could technically read it; while it is locked, nothing on the server or in a backup can open it.
• Your account stores a check value that recognises your key without being able to open anything, and, for each passkey, a copy of your key that only that passkey can open. Neither opens your hunt on its own. If you lose every passkey and your key, your data cannot be recovered.

4. Zero Server-Side Generative AI

The Doorhunter host executes zero generative LLM models. Your career documents and notes are never sent to server-side AI endpoints or used to train public models. All generative reasoning, fit appraisal, and synthesis occur within your private Claude client session via Model Context Protocol (MCP) stream (/mcp_stream).

5. The No-Send Boundary

Doorhunter will never contact employers, submit job applications, or email recruiters. The application has no outbound transmission mechanisms to third-party hiring systems. You retain exclusive control over when, where, and how you apply.

6. Subprocessors & External Integrations

• Google Identity: Used strictly for OAuth 2.0 authentication verification.
• Cloudflare: Cloudflare Turnstile provides privacy-preserving bot detection at registration without tracking cookies. Cloudflare Tunnel secures incoming network traffic.
• Zero Trackers: Doorhunter uses no third-party analytics, no tracking cookies, no advertising beacons, and no external web fonts or CDNs. Every interface style and script is inlined.

7. Data Portability & Takeout

You have full sovereignty over your data. You may download a complete, machine-readable JSON archive of your career claims, watches, notes, triage decisions, and applications at any time by visiting /console/export while authenticated.

8. Crypto-Shredding & Right to Be Forgotten

Under GDPR, CCPA, and architectural design §4.4, you hold an absolute right to permanent deletion. Triggering account deletion in the console erases your hunt:

• Your hunt's database is dropped, and your account and passkey records are removed.
• The server never held your key, so no copy of it remains anywhere to decrypt anything.
• Your session cookies are cleared and a SHA-256 deletion receipt is generated for your audit records. You may sign up again.

9. Contact & Inquiries

If you have questions regarding this privacy policy or cryptographic guarantees, you may contact the system administrator or review the open architecture documentation.