Privacy Protocol

What the site stores today

If you pick a language, the choice is saved in your browser's local storage so the site remembers it. If you are signed in, it is also saved with your account, so that the next time you sign in, on any device, the site opens in it.

The site loads no analytics, advertising or third-party scripts of its own, and sets no cookies for them. Fonts and icons are served from the site itself. The one exception is the map described below.

If you ask for a sign-in link, your email address is sent to Muninn, which emails you the link. Opening the link creates your account. An account created this way holds your email address and, if you choose to save them, your name and your language.

If you sign in with GitHub or Google, you confirm the sign-in on their own pages, and Muninn never sees your password there. GitHub or Google then gives Muninn your name or username, your email address, the address of your profile picture and the identifier of your account there, together with the tokens issued for the sign-in, which allow reading your profile and email addresses there and nothing more. Muninn stores these with your account.

While you are signed in, one cookie keeps you signed in. It lasts 7 days, is renewed while you use the site, and is removed when you sign out. Muninn stores each session with your IP address and your browser's user agent, the text a browser identifies itself with.

The email with the link is sent through Resend, an email service, so Resend receives your email address and the message.

If you share a snapshot of your analytics, Muninn stores that snapshot (counts of your applications, how far they got, the channels and technologies, and no salaries or company names) behind a link with a random code, which it keeps only as a hash. Anyone who has the link can see the snapshot, signed in or not, until the link runs out, which the page shows when you make it, or you stop it. The snapshot is deleted with the link, and with your account.

You can delete your account on your profile page. That deletes your account, the GitHub or Google sign-ins linked to it and your sessions.

On the page of an application that has a location, and only when a Google Maps key is set for the site, the page shows a Google Maps map in a frame. Loading it sends the location, your IP address and your browser details to Google, which may set its own cookies, under its own privacy policy. Nothing is sent to Google for an application without a location, and the links to OpenStreetMap and Google Maps send nothing until you click them.

As with any website, the server that delivers these pages receives your IP address and basic browser details with each request.

What Muninn will store

Once the product is built, Muninn will keep what it needs to track your applications:

• Your account: your email address and how you sign in.
• The postings you add: the link or text you paste, and the details extracted from it, such as company, position, location, salary and tech stack.
• What you add yourself: status, history and rankings.

An AI model reads each posting to extract those details.

Before the product opens

This page will become the full policy. It will say who is responsible for your data, where it is stored, which services process it, how long it is kept, and how you can export or delete it.