What no, but collects and why.

If you request an invitation, we use the email address you submit to send a confirmation link. We add it to the request list only after you confirm that you control the address.

Invited participants may choose to share hiring-related correspondence. We receive the message text, subject, return address, delivery metadata, and attachment metadata. Our app does not retrieve or copy attachments.

We also ask participants to confirm the company, role, interview stage, decision date, and outcome. After a private result is delivered, we may record one answer about whether it helped the participant decide what to do next.

We also collect limited interaction events, such as page views and whether an interest form started, sent a confirmation, was confirmed, or failed. We do not send your email address, form text, URL queries, URL fragments, referrers, or campaign parameters to analytics.

We use email addresses to manage invite requests and send occasional pilot updates. We use aggregate interaction data to understand whether this page is clear and useful.

Materials shared by invited participants are reviewed by a human. Nothing is published or used in company-level reporting automatically, and we do not contact the employer.

Participants may separately opt in to future anonymous, aggregate analysis. That choice is off by default. Declining does not affect the private review, and forwarding a message is never treated as consent.

We do not sell your email address. Every marketing email will include a way to unsubscribe.

Resend sends confirmation emails and stores the confirmed request list. For invited participants, Resend also receives pilot messages, including any attachments, and currently retains inbound email data for up to 30 days. Neon stores private pilot materials; message text, subject, and return addresses are encrypted by no, but before storage. PostHog processes limited site analytics with session recording, autocapture, referrer collection, campaign collection, and persistent browser storage disabled. Vercel hosts the site and may process standard request logs needed to operate it.

These providers process data under their own terms and privacy policies.

You can unsubscribe from updates at any time. You can also ask us to remove your invite-request address or private pilot materials by writing to privacy@nobut.fyi.

Unreviewed pilot materials are scheduled for deletion after 30 days. Source-message text for completed reviews is also removed after 30 days. Private results remain available through their secure link for 90 days after delivery, then the associated pilot record is deleted.

PostHog is disabled throughout both the private participant experience and admin area. It never receives message text, company names, roles, secure-link tokens, or email addresses. It is configured to respect supported Do Not Track signals on public pages.