Privacy policy

1. Who we are

Teleport ("we", "us") provides the Teleport browser extension and the Teleport cloud service (accounts, plus optional sync). Contact: privacy@teleport.example (placeholder).

2. What the extension does on your device

• Detects job postings on pages you visit and shows an "Add to Teleport" button and a fit score. Detection runs locally. Page content is not sent anywhere unless you take an action described below.
• Stores your profile, resume text, saved jobs, notes and settings in your browser's local extension storage.
• Computes fit scores locally with an on-device algorithm.

2a. Your Teleport account (required)

To use Teleport you create an account:

• With email and password: we store your email address (lowercased) and a one-way hash of your password (scrypt). We never store your password itself.
• With Google sign-in: we store your email address and Google's account identifier for you, and record that Google verified the address. We do not receive your Google password. We request only the "openid", "email" and "profile" scopes and do not store your name or photo.
• We also store when the account was created and last signed in, and hashed sign-in credentials for each browser you are signed in on.
• Purpose: to provide the service to you and secure your access. Legal basis (where GDPR/UK GDPR applies): performance of a contract (Art. 6(1)(b)).
• Your account alone does not upload your resume, profile or saved jobs; those stay on your device unless you turn on sync (section 4).
• We do not currently send email, so there is no email verification or password reset by email.

3. Optional AI analysis (bring your own key)

If you add your own API key for an AI provider (for example OpenAI, Anthropic, xAI, OpenRouter or a local model), the job description and your resume/profile text are sent directly from your browser to that provider to produce an analysis. We do not receive this data or your key. The provider's own terms and privacy policy apply. Your key is stored only in local extension storage and is never synced.

3a. Job tools (revise, company insights, ask, share)

• Resume revisions, chat conversations, company insights and review captures are stored only in your browser's local extension storage, per job or per company. They are included in "Download my data" and removed by "Wipe this device".
• Revise my resume and Ask a question send your resume/profile text, the job posting and (for Ask) your fit analysis and any loaded company insights to your own AI provider only when the AI engine is on (section 3). Without it, they run on your device.
• Company insights fetch public information about the employer named in the posting, directly from your browser, after you allow each source once: Wikidata, Wikipedia, Google News RSS, and the Greenhouse, Lever and Ashby public job board APIs (and the company's own website if you grant it and its robots.txt allows). These requests contain the company name, not your personal data.
• Teleport never fetches Glassdoor, Indeed, LinkedIn or Comparably in the background. When you visit a company's reviews, interviews or salaries page on Glassdoor, Indeed or Comparably yourself, Teleport can save what is visibly on that page (ratings, pros and cons, interview and salary notes) locally, with the page address and date, so it can show them in Company insights. You can undo each capture and turn this off in Settings.
• Share this job builds a message and image on your device. Nothing is shared until you choose a channel. Your resume and profile are never included, and your fit score is included only if you tick it. An optional referral code you set is added to the link as ?ref=<code>; Teleport adds no tracking and records nothing about who opens the link.

4. Optional cloud sync (opt-in)

Only if you switch on "Back up & sync":

• We store your profile (including resume text), saved jobs, notes, statuses and fit results, linked to your account.
• Purpose: backup, multi-device access, and (if separately enabled) talent pools.
• Legal basis (where GDPR/UK GDPR applies): your consent (Art. 6(1)(a)). You can withdraw it at any time.

5. Optional talent pools (separate opt-in)

Only if you also switch on "Include me in recruiter talent pools":

• We derive a pseudonymous summary: role family, seniority band, years-of-experience band, top skills, coarse region (state/country), work-mode preference, highest degree level, and the kinds of roles you save.
• We group these summaries into talent pools. Recruiters and hiring teams who are our customers can see pool statistics and pseudonymous candidate summaries. Pools with fewer than a minimum number of members are hidden.
• Recruiters never see your name, email, phone, resume text, employers, or individual saved jobs, unless you also enable "Let recruiters request to contact me". In that case your name and email may be shared with recruiters who request contact for a pool you belong to.
• We do not sell your personal information, and we do not use it for cross-context behavioral advertising. Providing pseudonymous summaries to recruiters happens only with your opt-in consent. Where local law (e.g. CCPA/CPRA) treats this as a "sale" or "sharing", we treat your opt-in as consent, and you can opt out at any time.
• Withdrawing consent removes you from pools immediately for future recruiter queries.

6. Retention

Local data stays until you delete it or uninstall the extension. Your account is kept until you delete it. Cloud data is kept while sync is on. After you delete your account and cloud data it is erased from active systems immediately and from backups within 30 days.

7. Your rights and controls

In the extension, open Privacy & data to:

• Download a copy of your local data (JSON) and your cloud data (JSON).
• Delete everything on this device.
• Delete your account and cloud data.
• Turn each sharing choice on or off.

Depending on where you live, you may also have rights to access, correct, delete, port and restrict processing, and to complain to a supervisory authority.

8. Security

Data in transit to our service uses HTTPS. Passwords are stored only as scrypt hashes. Sign-in credentials are random and stored only as hashes on the server, and the access tokens issued from them expire after an hour. Signing out or deleting your account revokes them immediately. Sign-in attempts are rate-limited. Recruiter access requires an API key, which is also stored hashed, and every recruiter access is logged. Requests are rate-limited.

9. Children

Teleport is not intended for anyone under 16.

10. Chrome Web Store Limited Use

Our use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the features you enable. It is not used for advertising, it is not used to determine creditworthiness, and it is not transferred except as described above with your consent.

11. Changes

We will notify you in the extension and ask for consent again before any material change to how your data is shared.