Security

Encrypted connection (HTTPS)

All communication between your browser and our servers is encrypted with HTTPS — just like any banking site or other serious service. No one in between can read what you send or receive.

Where your data is stored

Your data is stored with Supabase, a recognized infrastructure provider that encrypts data both at rest and in transit, and meets industry-standard security practices. We don't run our own servers to store your data — deliberately, so we're not inventing security ourselves instead of relying on a provider whose whole job that is.

Separation between users

Every user can see and access only their own data. This separation is enforced at the database level itself, not just in the interface you see — meaning even a direct or indirect attempt to access data won't expose another user's information.

Access controls

Sensitive actions — like deleting an account, or accessing the internal admin panel — are verified server-side against your real, currently signed-in identity every time, never just trusted from what the browser alone claims.

Secure sign-in

Signing in — by email and password, or with Google — is handled entirely by Supabase Auth. We never store passwords ourselves in any form, not as plain text and not any other way.

Deleting your data

You can delete your account and all of its content at any time, including copies saved locally in your browser, via My account. Full detail is in the privacy policy.

Third-party providers

We only work with third-party providers that are actually needed, each for one specific role: Supabase (accounts and data storage), Cloudflare (site hosting), Google (account sign-in), Gumroad (payment processing), Resend (sending DeskKit's emails), Cloudflare Turnstile (invisible bot protection on forms), and OpenAI (in AI-powered tools, like the ATS checker). Each has its own privacy policy.

Found a security issue, or have a question? get in touch and we'll handle it promptly.