Privacy Policy.

We store all of this with our infrastructure providers,encrypted in transit and at rest.
→ Review Supabase’s and Vercel’s security pages

• Account info. Your email address, session and refresh tokens, and sign-in timestamps, handled by Supabase Auth.
  → Services used: Supabase Auth
• Profile data. The skills, work history, and job preferences you enter, or that get discovered from a work story.
  → Services used: Supabase
• Work stories. Read once by a local LLM then deleted after discovered skills are applied to your profile.
  → Services used: Supabase (temporary), local LLM
• Usage data. Basic metrics via Vercel Analytics, which is cookieless and does not track you individually.
  → Services used: Vercel Analytics
• Billing data. If you subscribe, Stripe processes the payment. We never see or store your card details.
  → Services used: Stripe

• To run the matching engine, show you ranked roles, and operate the product.
• To send emails: we currently send wave invitations and, if you’ve opted into it, a matches digest.
• To improve matching quality over time.

We do not sell your data.

matcher uses one language model, open-weight and running on our own hardware; we don't use a third-party service.

It is used for two purposes:

• reading your optional work story once, to discover skills and add them to your profile,
• acting as a classifier for each job posting, reading it once to structure its data for use.

Neither use trains a model, and nothing you write is sent to an outside AI provider.

We use a small set of subprocessors to run matcher, each only for what it does:

• Supabase: database and authentication.
  → Review Supabase’s privacy policy
• Stripe: payment processing.
  → Review Stripe’s privacy policy
• Resend: transactional email delivery.
  → Review Resend’s privacy policy
• Vercel: hosting and analytics.
  → Review Vercel’s privacy policy

We don’t share your data with anyone else.

We never send your profile to an employer.
“Apply” links take you straight to the employer’s own site, and you apply there, not through us.

If matcher is ever acquired, merged, or has its assets sold,
your data may transfer to the new owner under this same policy.
We’ll notify you in the unlikely case that happens.

Work story text is deleted immediately after the deep read processes it.
Account and profile data is kept while your account is active.

• Email us any time to see, correct, or delete what we have on you.
  We don’t yet have a self-serve tool for this, apologies.
• Every digest email has an unsubscribe link.
• Reply to any wave-invite email to get off that list.

These rights are available to everyone who uses matcher, wherever you live,
and we include rights guaranteed under laws like the EU’s GDPR and California’s CCPA.

• Children.
  matcher isn’t directed at children, and we don’t knowingly collect data from anyone under 16.
• International use.
  matcher is available globally. Your data is processed and stored in the United States by our infrastructure providers.
• Changes to this policy.
  We’ll update the date at the top of this page whenever this policy changes,
  and try to let you know directly if a change is significant.

Questions, or a data request? admin@barelybrand.co.
We’ll always try to make it right directly.
If we can’t, EU/UK residents can contact their local data protection authority,
and California residents the California Privacy Protection Agency.