Last updated 14 October 2026

Privacy policy

What we collect, why, who else touches it, how long we keep it, and how to get it back or delete it. No ads, no selling data.

1. The short version

• We keep what you give us so the site works for you: account, profile, practice, applications, notes.
• If you don’t sign up, we count visits without cookies and without knowing who you are.
• If you sign in, we log sign-ins and which pages and tools you use, so we can see what works. That log is tied to your account and is deleted with it.
• We don’t sell your data and we don’t run ads or third-party advertising trackers.
• You can download everything and delete your account from your profile.

2. What we collect

Account

Your email address and a password (stored only as a salted, one-way hash), or the verified email from Google, or your mobile number if you sign in by phone. For phone sign-in, a code is sent by Google’s Firebase Authentication, which receives your number for that purpose.

Profile and saved work

What you choose to add: name, college, year, target roles, saved listings and dates, applications and notes, contacts you record, practice answers and scores, stories, portfolio entries, and résumé text you add to job search. The résumé checker reads an uploaded file to produce its report and doesn’t keep the file.

Visits and usage

• Anonymous visitors: page views, referring site or campaign tag, browser, device type, language and time zone. Visitors are told apart by a one-way hash of IP address and browser that uses a salt which changes daily and is never stored, so we can’t follow someone across days or recover an IP address.
• Signed-in students: the same, linked to your account, plus sign-in time and method, failed sign-in attempts, and which tools you open.

Payments

If you pay, Razorpay collects your payment details. We receive and keep the order and payment reference, the amount, the status and the payment method type (for example UPI or card). We never see your card number or UPI PIN.

Messages

If you use the contact form we keep your name, email, topic and message so we can reply.

3. Cookies and similar storage

• session: a cookie that keeps you signed in (up to 7 days).
• oauth_state: a short-lived cookie used only during Google sign-in.
• Session storage: a random id for one browser tab so page views group into a visit. It disappears when the tab closes.
• Local storage: drafts and preferences, such as an unsent practice answer or the job ad you pasted into the decoder. These stay on your device.

We don’t use advertising or cross-site tracking cookies. Google’s reCAPTCHA loads only inside the phone sign-in window, and Razorpay’s checkout loads only when you choose to pay.

4. Why we use it

To run your account and show you your own work; to send reminders you ask for (by email, only if you turn them on); to keep the site secure and prevent abuse; to understand which parts of the site are used so we can improve them; to process payments you choose to make; and to reply to you.

5. Who else handles it

• Microsoft Azure: hosts the site and its database.
• Google: sign-in with Google, and Firebase for phone codes and reCAPTCHA.
• Razorpay: payments.
• An email provider: sends verification and reminder emails, when email is switched on.

They process data to provide those services under their own terms. We don’t share your data with employers, colleges or advertisers. We may disclose information if the law requires it.

6. How long we keep it

Account data stays until you delete your account. Usage and sign-in logs are removed automatically after 13 months. Payment records are kept as long as the law and accounting rules require. Contact messages are kept for as long as needed to deal with them.

7. Your choices and rights

• Access and copy: “Download my data” in your profile gives you your records.
• Correct: edit your profile and saved work any time.
• Delete: “Delete account” in settings erases your account and what hangs off it, including your usage log.
• Email reminders: off unless you turn them on, and you can turn them off any time.
• Questions or complaints, including under India’s Digital Personal Data Protection Act, 2023: the contact form. We aim to reply within 7 days.

8. Security

Passwords are hashed, sessions use HTTP-only cookies, traffic is encrypted, and access to the owner’s dashboard is restricted. No system is perfectly secure; please choose a strong password and tell us if you think your account was accessed by someone else.

9. Children

Shortlists is for college students. If you’re under 18, please use it with a parent or guardian’s knowledge, and have them contact us if they want your data removed.

10. Changes

If we change what we collect or why, we’ll update this page and its date, and tell signed-in students on the site when the change matters.

This page is written in plain language so it’s easy to follow. If anything here is unclear, ask us.