Privacy policy

Effective 13 September 2026. Firsthand (firsthandcareers.com) is run by the operator of Firsthand, who is the data controller. Write to hello@firsthandcareers.com about anything here.

The short version

You can use the site without an account and we keep nothing about you. If you sign in, we keep your email address, the searches you save, and a record of the alert emails we sent you — and you can delete all of it yourself, at once, from the Account menu. We do not sell or share personal data, and we run no advertising or analytics trackers.

What we hold, and why

If you only browse

Nothing that identifies you. The web server keeps the ordinary access log (address, page, time, browser) for up to 14 days to keep the site running and to spot abuse; that is our legitimate interest, and it is not joined to anything else. A press of the "Apply on company website" button is counted per posting, so the site can say which roles readers went on to apply for; when you are not signed in that count has no one attached to it.

If you sign in

• Your email address, because that is how you sign in (a six-digit code, no password) and where alerts go. Sign-in codes are deleted after ten minutes. Your session cookie (fh_session) keeps you signed in for up to 400 days on that device.
• Saved searches and, if you ask for them, the alert emails that match them each morning. We keep a log of what each alert contained so we can answer a complaint about one. Each alert carries a one-click way to stop it.
• Apply-button presses you make while signed in are attached to your account so the site can, in future, show you what you applied for. Deleting your account detaches them.
• If we offer a CV check and you upload a CV, it is kept to give you the check and deleted with your account or on request. Nothing is uploaded without your doing it.

The legal basis for all of this is the agreement between us: you asked for an account, saved searches and alerts, and this is what running them takes. Alerts are sent only for searches you saved and only until you stop them.

If you are an employer correcting an estimate

The "Correct this" form on a role page asks for a work email address so we know it is the employer speaking. We keep the address and the figure you gave, use them only to review the estimate, and delete them on request.

Cookies

Two, both ours: fh_session when you sign in, and fh_gate if you were given early access before launch. No third-party cookies, no advertising, no analytics scripts.

Who else sees data

• Resend delivers our email (sign-in codes and alerts). They see the address and the message, as any mail carrier must.
• OVH hosts the server, in France.

Nobody else. The page's typefaces, images and scripts are all served from our own server, so reading it asks no third party for anything. We do not sell, rent or share personal data, and we do not use it for advertising.

How long

Account data stays until you delete the account. Sign-in codes: ten minutes. The access log: 14 days. Employer corrections: until reviewed and then on request.

Your rights

You can see, correct, export or delete everything we hold about you. Deletion is a button: Account → Delete my account removes your address, sessions, saved searches, the alert log and any CV, at once and for good; apply-button presses stay counted but with no one attached. For anything else, or if you would rather we did it, write to hello@firsthandcareers.com. If you think we have handled your data wrongly you can complain to your data protection authority — in the UK the ICO, in the EU the authority of the country you live in.

Job postings

The roles on the site are public job advertisements read from employers' own careers pages, with a link back to the employer for every one. Names of hiring managers that appear inside an advert are the employer's words, not ours. An employer that wants a posting taken down can write to hello@firsthandcareers.com; our crawler identifies itself and honours robots.txt (see /bot).

Children

The site is for people looking for work and is not meant for anyone under 16.

Changes

If this policy changes in a way that matters, the date above changes and signed-in users are told by email.