Privacy policy
Vulture is local-first. This page says exactly what leaves your device, when, and why. Last updated 6 September 2026.
Local profiles
Without an online account, everything (résumés, applications, notes, settings, AI keys you enter) stays in your browser's storage or the desktop app's storage, encrypted with your passphrase. Nothing is uploaded. Clearing the browser removes it; export a backup from Settings first.
Online accounts
With an online account, your profile data is encrypted on your device and the encrypted copy is stored on our database host (Supabase) so your other devices can fetch it. We also store your username, display name, email address, permissions, the plan's dates, and the counts described below. Your AI keys and Apify tokens never reach the server; they are used from your device.
What the server records
- Usage counts for online accounts: how many prompts, tokens, web searches and scrapes per day. Counts only, never the content, for accounts that use their own keys.
- Shared-resource prompts: when you use a resource we pay for (web search on the shared pool, shared Apify tokens, pro AI models), the query or prompt you sent is logged with your account for abuse monitoring and support, capped in length and rotated out after a fixed size. Model replies are not stored.
- Activity events: which features are used (a scrape started, a résumé imported, a payment made), with your account or, for local profiles, the display name you chose. No document content.
- Telemetry: page views and installs with a random install id per device, the app build and rough platform. You can switch it off in Settings.
- Email log: the address, subject and delivery outcome of every mail the server sends you, kept 90 days.
- Payments: the order and payment ids, amount, method and status Razorpay reports. Never card or bank details, which Razorpay alone handles.
Who else is involved
Supabase (database and sign-in), Render (hosting), Razorpay (payments), Resend and Brevo (transactional email). When you use shared resources, your queries reach Tavily (web search), Apify (scraping) or the model provider behind a pro model. When you use your own keys, your requests go straight from your device to that provider under its terms. Job postings come from public boards and company career sites.
Cookies and storage
The app uses browser storage for your data and preferences and a signed session token for online accounts. The admin panel uses a cookie for its own sign-in. There is no advertising and no third-party tracking.
Retention and deletion
Synced data stays while the account exists. Activity and prompt logs rotate at a fixed size; the email log is pruned after 90 days; unpaid orders after 30 days. To delete an online account and everything stored with it, email gixts@hrsraiden.com from the account's address; payment records are kept as the law on accounts requires.
Contact
Questions about anything on this page: gixts@hrsraiden.com. Vulture is made by Harsh Sharma (hrsraiden) under Gixts Labs, India.