Ungated keeps your job search so you can work on it from any device and share it with the people helping you. This page says what it keeps, who can see it, which outside services touch it, how long it's kept, and how to get it deleted. It's written to be read, not to cover us.
Last updated 18 October 2026.
The short version
- We keep what you put on your board, your name and email address, and the few things it takes to sign you in and keep the service running.
- We use it only to run Ungated. We don't sell it, rent it, or use it for advertising. There are no ads and no tracking cookies.
- Your board is seen by you and by the people you share it with, and no one else. You choose who, and you can take access back.
- Some outside services handle parts of the job: Cloudflare (the network in front of the site), Amazon Web Services (the server and email), Google (only if you sign in with Google), Stripe (only if you buy a pass) and Zoho (only if you write to us).
- You can download all of your data at any time, and delete your account yourself.
What we keep
Your account
Your name and email address, whether you're a job seeker or a coach, and when you signed up. If you sign in with Google, we also keep the ID Google gives your Google account, so we can recognize it next time. From Google we receive your name, email address and that ID, and nothing else: no contacts, no mail, no files.
Your board
Everything you add: jobs, companies, contacts and their details, notes, salaries, dates, statuses, interview dates, and the other work search activities in your log. It's stored on our server so it can sync between your devices and reach the people you share it with.
When you delete a card, we keep its last copy for as long as the board exists, so you can restore it. Only the board's owner can see a deleted card in full.
Signing in and keeping accounts safe
- A sign-in key for each browser you use, stored only in scrambled form (a SHA-256 hash), with the identification your browser sends (which names the browser and system) and when it was last used.
- Emailed sign-in and signup links, which work once and expire after 15 minutes.
- For short periods, the internet (IP) address of whoever is signing in or getting a code wrong, so we can slow down anyone trying to break in.
Passes, codes and referrals
- What you bought, when, the price and any discount or code used. Card details go to Stripe, never to us.
- Free days you were given, and the codes you redeemed.
- If you used a code from an organization (an outplacement firm, a program, an employer), that its code was used and that you're one of the people it gave Ungated to. Each night we work out its totals from those people's boards, as for a school (below). The days are yours.
- If you signed up with a school's address (one it has arranged with us), that you're one of its members, what you told us you are there (your class, graduate student, alumni, or faculty or staff), and the free days it gave you. Each night we work out the school's totals from its students' boards (how many jobs are at each stage, applications, interviews, offers and jobs accepted) and keep them as counts. Faculty and staff are never counted, and nothing about their boards is kept.
- If you joined through a friend's link, that you did and whether the referral counted. Your friend sees only dates and whether it counted, never your name or what's on your board.
- To stop people farming free days with fake accounts, we compare the networks a new account and its referrer use. We store this as a salted fingerprint of the network, never your IP address itself.
- If you ask for hardship days, your request and any note you add.
When you contact us
- What you write in Contact us, your email address and name, and, if you leave "Include these details" ticked, the details the form lists before you send: the page you were on, whether your board was syncing, your browser, your time zone, recent errors on the page, and, signed in, your account number and your boards' roles, passes and card counts. Never what's on your cards or your sign-in key. These go to our helpdesk (Zoho Desk), where we answer them.
- Our own server keeps only that you wrote, when, and the helpdesk's number for it (and, if you weren't signed in, a salted fingerprint of your network, never the IP address itself, to slow down spam). Signed in, that's how Support shows you your requests and our replies: it reads them from the helpdesk when you open it, and keeps no copy.
Running the site
Like most websites, the server writes a log of requests: the IP address, the page asked for, the time and the browser's name. We use it to fix problems and stop abuse.
What stays in your browser
The app keeps a full copy of your board in your browser's own storage (not a cookie), so it works offline. It also keeps your sign-in key for that browser and your settings there, such as theme, weekly goals and which columns are collapsed. Your settings stay on your device. The board goes to our server to sync, the sign-in key goes with each request so the server knows it's you, and a job link you ask it to fill in from goes to our server so it can visit the page.
The chart maker needs no account and sends nothing anywhere: the numbers you type stay in your browser's storage, so a reload doesn't lose them, and the picture is made on your device.
Signing out removes that browser's copy of the board, after a last sync. Your board stays safe on the server.
Who can see your data
- You. Everything on your board, including deleted cards.
- People you share your board with. A viewer (for example a coach) can read your board. An editor (for example a recruiter) can also add and change cards. For cards you've deleted, they see only the company, the role, when it was deleted and by whom. You can remove anyone at any time, and they lose access immediately.
- A coach's clients see nothing of the coach's other clients.
- An organization that gave you a code sees how many of its codes were used, and totals and averages for everyone who used them, by year and by batch of codes: how many jobs are at each stage, applications, interviews, offers and jobs accepted. Never your name, that you used one, your own figures, or the companies and notes on your board. A batch with fewer than 10 people is shown together with others, and under 10 people in all nothing is shown.
- A school whose address you signed up with sees totals and averages for all its students together, by academic year and class: how many joined, how many jobs are at each stage, applications, interviews, offers and jobs accepted. Never your name, your own figures, or the companies and notes on your board. A class with fewer than 10 students is shown together with others, never alone, and under 10 students in all nothing is shown. Faculty and staff are never part of it.
- Us. Our admin tools show accounts, card counts, passes and payments, and never what's on a card. The person who runs the server can technically reach the database and its backups, as with any web service. We only look at board contents when you ask us to (for example, to help you recover something), or if the law requires it.
We don't sell or share your data with anyone else. If the law ever requires us to hand data over, we'll tell you unless we're forbidden to.
Outside services
| Service | What it does | What it sees |
|---|---|---|
| Cloudflare | The network every visit passes through: it protects the site and speeds it up. It also counts page views (Cloudflare Web Analytics, which uses no cookies). | Everything that passes between your browser and our server. Cloudflare decrypts traffic to protect and deliver it, then encrypts it again on its way to us, so it handles what you send to the app, as well as your IP address and the pages you load. It processes this only to run its service for us, under its data processing terms, and doesn't use it for advertising. See Cloudflare's privacy policy. |
| Amazon Web Services | Runs the server and database (in the United States) and sends our emails (Amazon SES). | The stored data, and the emails we send you. |
| "Continue with Google", only if you use it. | That you signed in to Ungated. Google's own privacy policy applies to your Google account. | |
| Zoho | Our helpdesk (Zoho Desk, in the United States), only if you write to us. | What you write, your email address and name, and the details you chose to include (see what we keep). See Zoho's privacy policy. |
| Stripe | Takes payment when you buy a pass. No card is kept for later. | Your email address, the amount, and the card details you type on Stripe's page. See Stripe's privacy policy. |
Apart from Cloudflare's page-view counter, pages load nothing from other companies: no advertising, social or tracking scripts.
Job links. When you ask us to fill in a job from its link, our server visits that address once and reads what the page says about the job. The site you link to sees a visit from our server, not from you, and nothing about you is sent to it. We don't keep the link or the page from that visit, only that you asked and when (for a day, so nobody can use our server to flood a site). The link is kept only if you save it on the card, like anything else you type.
How long we keep it
| What | How long |
|---|---|
| Your account, boards, cards and activities, deleted cards included | Until you delete them or your account |
| Sign-in keys | Until you sign out on that browser, or ask us to sign you out everywhere |
| Emailed links, including the address of someone who asked for a signup link but never finished | A day after the link expires |
| IP addresses used to slow down break-in attempts | 15 minutes to a day |
| Network fingerprints for referral checks | 30 days |
| Messages you send us, in our helpdesk | Two years after your last message, so we can see what we told you before; ask and we delete them sooner |
| That you wrote to us, on our server | Signed in: as long as your account, so Support can list your requests. Signed out: 30 days |
| Server request logs | Two weeks |
| Database backups | 14 days, so anything deleted is gone from backups within two weeks |
| Purchase records (what was bought, when, the price and any discount) | Kept for tax records. If you delete your account, they're kept without your name or email address. Stripe keeps its own record of each payment. |
Your choices
- Download everything. Account → Download backup gives you every card and activity as a file, at any time.
- Correct it. Change your name and email address in Account, and edit any card.
- Stop sharing. Remove anyone from your board in Share.
- Delete your account. Account → Delete my account. Before you confirm, it lists exactly what will happen. It deletes your account, the boards you own with every card on them, your sign-in keys, and your referral and code records. People you shared your board with lose access and are told. Any days they put on it go back to them. Days you put on someone else's board stay with them. Purchase records are kept for tax records, without your name or email. Copies in backups are gone within 14 days. You can also email us to do it for you.
- Ask. You can ask what we hold about you, and we'll tell you.
Keeping it safe
The site is served over HTTPS only. Sign-in keys, invite codes and emailed links are stored only as hashes, so a copy of the database wouldn't let anyone sign in. Links and codes work once and expire, and repeated wrong guesses are blocked. Every request for a board is checked against who it's shared with. No system is perfectly secure: if something goes wrong that affects your data, we'll tell you.
Children, changes and contact
Ungated is for adults looking for work and the people helping them. It isn't meant for anyone under 16, and we don't knowingly keep their data.
If this policy changes, we'll update this page and its date. If a change affects what we do with data you've already given us, we'll email you first.
Questions or requests: Contact us, or [email protected]. Ungated is operated from Texas, USA.