Last updated: 5 September 2026
Everything you type stays on your phone. Only if you switch on anonymous statistics does the app add which answers you gave about employer behaviour to a count. Your profile is never part of that. There is no account, no tracking, and no way for anyone to find your answers again, including us.
Your profile answers, the companies you add, every audit you complete, and the whole dossier (names, emails, phone numbers, salaries, interview notes, saved job adverts and screenshots) are stored only on your device, in the app’s private storage, protected by Apple’s on-device encryption.
We cannot see this, access it, or recover it. There is no account and no cloud sync, and the app never uploads any of it. If you lose the phone, that data is gone; there is no backup on our side because there is no our side.
The app can show you how common something is: “4% of people asked this said they were asked about their marital status too”. That only works if people contribute, so we ask once, after your first completed audit. The answer is no until you say otherwise, and the app is fully functional either way.
Anonymisation usually fails because answers are stored together. “Senior, needs sponsorship, asked about children, audited in March” is a fingerprint even with no name attached.
So our server does not store a record per person or per audit. It stores one number per possible answer, and adds one to it. Across the whole app that is a few hundred integers per country. Your submission becomes part of a total and then no longer exists separately.
Because nothing is ever stored together, there is no combination left to re-identify: not by us, not by a court order, not by anyone who might acquire this in the future. The guarantee is structural, not a promise you have to take on trust.
The trade-off is real and we accept it deliberately: we can never break the data down by anything except country, never correct a submission, and never go back and ask last year’s data a question we did not think of at the time.
Data that cannot be linked back to a person is not personal data under the GDPR, so strictly we do not need your consent for the counts described above. We ask anyway, because a privacy promise you have to read the small print to discover is not much of a promise.
You can withdraw at any time in Settings. That stops all future counting immediately.
We cannot delete past contributions on request, and we will not pretend otherwise. It is not that we refuse. It is that a number which went up by one cannot be traced back to whose answer raised it. That is the same property that makes the data safe.
For everything else, your rights are straightforward because we hold nothing about you: we have no personal data to give you access to, correct, or export.
An open endpoint that accepts counts can be flooded with false ones, which would ruin the figures for everyone. To prevent that, submissions carry an Apple App Attest assertion, which proves the request came from a genuine copy of this app on a real device. It authenticates the app, not you: it does not identify your device to us and is not used for tracking or linked to your submission.
If you unlock the full version, the transaction is handled entirely by Apple through the App Store. We never see your name, payment details or Apple ID. The app stores only an on-device flag recording that it is unlocked. See Apple’s Privacy Policy for how Apple handles payments.
There are no analytics SDKs, no advertising SDKs, no crash reporters that phone home with your content, and no third-party services embedded in the app. Nothing you do is used to build a profile of you, and nothing is sold or shared with anyone. The app shows no adverts. You will never see an App Tracking Transparency prompt from us, because there is no tracking to ask about.
The app works fully offline. It contacts the network in only three situations: when Apple processes a purchase or restore; when it downloads the small file of published percentages; and, if you have switched statistics on, when it submits the counts described above.
In the app, Settings → Delete everything permanently erases your profile, every company and every dossier. Deleting the app removes it too. Because none of it was ever uploaded, deleting it on your device deletes it everywhere.
Job Counselor is intended for people old enough to be looking for work, and is not directed at children. We do not knowingly collect information from anyone, of any age.
If this policy changes, we will update this page and the date above. The promise that your profile never leaves your device is the core of this app; if that were ever to change, it would be announced prominently in the app itself, not buried here.
Questions about privacy? Reach us through the contact form on our support page and we will reply, usually within 48 hours.