JATABack to home

Privacy Policy

Last updated July 16, 2026

Overview

JATA is an open-source job application tracker. Because JATA is self-hosted, the data you enter is stored in your own Supabase project and processed by your own Cloudflare Workers deployment. This policy describes what data the application handles, how it is processed, and your rights over that data.

Data We Collect

JATA collects the following categories of information when you use the application:

  • Account information. Email address, display name, and profile image (when signing in with Google). Managed by Supabase Auth.
  • Application data. Company name, job title, job description text, application URL, and application status for each position you track.
  • Resume files. PDF resumes you upload for ATS scoring. The file is stored in Supabase Storage and its text content is extracted for processing.
  • Generated content. Cover letters, cold emails, LinkedIn messages, and other documents created by JATA's AI features.

How Your Data Is Used

Your data is used solely to power JATA's features. It is not sold, traded, or used for advertising or profiling purposes.

Specifically, the following data is sent to Cloudflare Workers AI for processing:

  • Job description text is parsed to extract requirements, skills, and qualifications.
  • Resume text and parsed job descriptions are compared to produce ATS scores, keyword analysis, and improvement suggestions.
  • Your name, job details, and resume summary are used to generate tailored application documents.

Cloudflare processes this data in accordance with their privacy policy. JATA does not retain AI inference logs beyond what is stored in your own database.

Data Storage and Security

All application data, including your account details, application records, resume files, and generated documents, is stored in the Supabase project you configure during deployment. Supabase provides encryption at rest and in transit.

Supabase Row-Level Security policies ensure that each user can only access their own data. Application-level ownership checks provide an additional layer of access control.

Because JATA is self-hosted, you are responsible for the security of your Supabase project, Cloudflare account, and deployment environment. We recommend enabling two-factor authentication on both accounts and restricting API key access.

Third-Party Services

JATA integrates with the following third-party services:

Supabase

Authentication, database, and file storage. Data is stored in your Supabase project. Supabase's privacy policy applies to data stored on their platform.

Cloudflare Workers AI

AI inference for resume scoring, job description parsing, and document generation. Resume text and job descriptions are sent to Cloudflare for processing. Data is not retained by Cloudflare beyond the inference request.

Google (optional)

Used for OAuth sign-in. When you choose to sign in with Google, your email, name, and profile image are shared with Supabase Auth to create your session.

Data Retention

Your data is retained for as long as your JATA instance is active. There is no automatic expiration or deletion of data.

You can delete individual applications, resumes, and generated documents at any time from the application dashboard. Deleting a resume removes both the file from Supabase Storage and its associated record.

AI inference requests sent to Cloudflare are not stored persistently by JATA. Cloudflare's own data retention policies apply to processing logs on their infrastructure.

Your Rights

Since JATA is self-hosted, you have direct control over your data. You can:

  • Access all your data through the JATA dashboard or directly via your Supabase project.
  • Export your application data and resume files at any time.
  • Delete any or all of your data from the dashboard or your Supabase database.
  • Revoke OAuth tokens and sign-in methods through your Supabase project settings.

If you are subject to GDPR, CCPA, or other data protection regulations, your rights under those frameworks are preserved. Because you control the deployment, exercising these rights does not require contacting JATA's developers.

Children's Privacy

JATA is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated revision date. Continued use of JATA after changes constitutes acceptance of the revised policy.

Contact

For questions about this privacy policy or JATA's data practices, open an issue on the GitHub repository.