Privacy Policy
Last updated 27 September 2026
This policy explains what Hopefully Works collects, why, how long it is kept, and the choices you have.
What we collect, and why
| Data | Why we need it | How long we keep it |
|---|---|---|
| Email address | To create your account, confirm it, let you sign in, and send receipts and service notices | Until you delete your account |
| Password | To authenticate you. Stored only as a salted hash by our identity provider, we never see it | Until you delete your account |
| Payment record (Razorpay order and payment identifiers, amount, status) | To activate your membership, issue receipts, handle refunds, and meet tax and accounting obligations | Eight years, as required for financial records |
| Anonymous daily page and sample-interaction totals | To understand page visits, interaction with the free sample, and clicks on pass details after that interaction. These counts have no account, visitor, IP, search, listing, employer, URL or referrer attached. They measure accepted page-interaction attempts, not unique people or purchases | 13-month retention target; stale rows are removed during service activity or operator maintenance |
| Purchase-linked job-detail measurement | To review the refund rule: purchase reference, one-way job-identity hashes and first detail acknowledgement time, capped at 20 distinct jobs. Delivery receipts that are not acknowledged identify incomplete measurement | 13-month retention target after the refund window; stale rows are removed during activity or operator maintenance |
| Keyed IP/account hashes and delivered-listing keys | Rate limiting and fair-use protection. List delivery is separate from refund detail opens. We do not store raw IP addresses for analytics or record raw searches in measurement | Rolling one-day windows, with stale rows removed during activity or operator maintenance |
Maintenance removes old measurement in bounded batches. During inactivity or a maintenance failure, stale records may remain until cleanup runs. Anonymous totals are separate from purchase-linked usage. Sample-interaction measurement uses document memory only, without cookies or browser storage; it does not delay or block links, filters or checkout. We do not record raw searches or email addresses in either measurement store.
We do not ask for, collect or store your CV, résumé, work history, identity documents, or card details. When you apply for a job you do so on the employer's own website, and anything you submit there is governed by that employer's privacy policy, not ours.
Who we share it with
Only the processors we need to run the service: Razorpay (payments), Netlify (hosting, accounts, database and account emails). Each receives only what its function requires. We do not sell your personal data, and we do not share it with employers or advertisers. We may disclose data where the law requires it.
Your rights
Under the Digital Personal Data Protection Act, 2023, you may ask us to give you a copy of your data, correct it, delete it, or tell you who we have shared it with, and you may withdraw consent at any time. Account deletion and removal of purchase-linked usage require a support request; there is no self-service deletion form. Anonymous daily totals cannot be linked to an account. Payment records are kept for the statutory period above because the law requires it.
Support contact setup is in progress. Support, refund, privacy and removal requests cannot be submitted here yet. We have no public inbox or request form. Check Contact for availability.
Cookies
We use a sign-in cookie that keeps you logged in, and local browser storage for your table preferences. Both are necessary for the site to work. We do not use advertising or third-party tracking cookies.
Security and transfers
Traffic is encrypted in transit. Access to the database is restricted and rate-limited, and sessions can be revoked. No system is perfectly secure; if a breach affects your data we will notify you and the Data Protection Board as the Act requires. Our hosting and payment providers may process data outside India under their own safeguards.
Children
This service is not directed at children under 18 and we do not knowingly collect their data.
Privacy questions and complaints
See Contact for the current support channel.