Privacy policy
Last updated November 15, 2026
CareersFresh (careersfresh.com) is an independent service operated from Canada. It lists internships from employers’ own career sites and lets you keep an application tracker and email alerts. This page explains what personal information that involves, in plain terms. We handle it under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
The short version
- You can browse every listing without an account. We count visits to see how the site is used, without cookies and without storing your IP address.
- With an account we keep your email address, your tracker, your saved searches and the alerts we send you.
- No ads, no third-party analytics or tracking pixels, and we never sell or rent your information.
- You can download all of it or delete your account at any time from Account settings.
What we collect
| What | Why |
|---|---|
| Email address, and whether and when you verified it | To sign you in, send the links you ask for, and send your alerts. |
| Password, if you set one | Stored only as a salted scrypt hash. We can’t read your password. |
| Google sign-in, if you use it | Google tells us your email, name and profile photo, and an account identifier we use to recognise you next time. We don’t receive your Google password, and we don’t keep Google’s access tokens. |
| Name and photo, if you add them or Google provides them | Shown in your account menu. |
| Your tracker: roles you save, their status, dates, next steps, referral flag and notes | To keep your tracker in sync across your devices. |
| Saved searches and their alert settings | To show your searches and email you new matches. |
| Alert emails: a copy of each alert we send you, when it was sent, and what our email provider reports back (delivered, bounced, marked as spam) | To send each alert once, retry safely, and stop emailing an address that bounces or complains. |
| Security records: recent sign-in failures and link requests, keyed by a scrambled (keyed-hash) form of your email address and network (IP) address | To slow down password guessing and email abuse. |
| Sync receipts: technical IDs of tracker changes | So a change sent twice by a flaky connection is applied once. |
| Visits, with or without an account: the page you viewed and how long it stayed open, the website or tagged link that brought you here, whether you’re on a phone, tablet or computer, your browser and operating system, your device’s time zone setting (which tells us roughly where visitors are without looking up your IP address), and which job links you open. Each visitor is counted with a code made from your network address and browser that changes every day; the address itself isn’t stored, and once the day is over the code can’t be traced back to you. When you’re signed in, your visits are linked to your account. | To see how the site is used (which pages and jobs people find useful, and where visitors come from) and to improve it. |
| Account activity: when you sign in, and when you save, rename or remove a search or turn its alerts on or off | To understand how the service is used and to help if something goes wrong with your account. |
Like any website, our hosting provider records technical request logs (such as IP address, the page requested and browser type) to run and protect the service.
Cookies and browser storage
We only use cookies the site needs to work, all set by our own domain:
- a sign-in session cookie that keeps you signed in, for up to 30 days;
- a security token that protects sign-in forms, and a cookie that remembers where to return after signing in;
- short-lived cookies during “Continue with Google”, which make sure the sign-in that comes back is the one you started.
We use no analytics, advertising or third-party tracking cookies. Counting visits uses no cookies or browser storage at all, and if your browser sends a Global Privacy Control or Do Not Track signal, we don’t count your visits. Without an account, your tracker and saved searches are kept in your own browser’s storage and never sent to us. When you’re signed in, unsaved tracker changes wait in your browser until they reach our servers.
Who processes it for us
- Render hosts the website, the job checker and the database. Our servers are in the United States (Virginia).
- Resend delivers our emails (sign-in and recovery links, and alerts). It receives your email address and the content of each email, and tells us whether it was delivered.
- Google, only if you choose “Continue with Google”, to confirm who you are.
Because these providers operate in the United States, your information is stored and processed there and may be accessible to authorities under the laws that apply there. We don’t share your information with employers: applying always happens on the employer’s own site.
How long we keep it
- Your account, tracker, saved searches and alert history: until you delete your account.
- Sign-in, setup and recovery links: they stop working after 30 minutes and are deleted when used or replaced.
- Security records of sign-in attempts and link requests: at most 24 hours.
- Sync receipts: 30 days.
- Delivery reports from our email provider: up to 30 days, or 7 days when they can’t be matched to an alert.
- Visit and account activity records: 12 months. The daily code used to count visitors is deleted at the end of each day.
When you delete your account, all of the above is removed straight away. Copies in our hosting provider’s backups expire on the provider’s backup schedule.
Your choices and rights
- See your data: “Download my data” in Account settings gives you a copy of everything above that belongs to your account.
- Correct it: edit your tracker and searches directly, or write to hello@careersfresh.com for anything else.
- Stop emails: every alert has a link to stop that search’s emails and one to stop all of them.
- Delete your account: in Account settings. It removes everything listed above.
- Withdraw consent: you can stop alerts or delete your account at any time; the service can’t keep an account without an email address.
If you have a privacy concern, please contact hello@careersfresh.com first. If it isn’t resolved, you can complain to the Office of the Privacy Commissioner of Canada.
Security
The site is served over HTTPS. Passwords are stored only as salted hashes, emailed links only as hashes, and “Sign out everywhere” ends every session on every device at once. No system is perfectly secure; if we learn of a breach that puts you at real risk, we’ll tell you and the Privacy Commissioner as the law requires.
Children
CareersFresh is meant for students looking for internships and isn’t directed at children.
Changes
If this policy changes, we’ll update the date above, and email account holders before any change that affects how their information is used.
Contact
Questions about privacy: hello@careersfresh.com.