Privacy Policy

Account. Your email address and display name. Authentication is handled by a managed auth service (Supabase) — we never see or store your password.

Assessment inputs. Your job title, industry, seniority, region, and your answers — including free-text answers in your own words (what you want to protect, what you suspect is exposed, your goals and constraints), the AI tools you use, and your self-ratings. The full assessment record is kept so your history and score trajectory work.

Résumé (optional). If you upload a résumé, we extract a structured summary — roles held, employers, years, achievements, tools and skills, certifications, education summary. The raw file is never stored: it is read in memory for a single AI extraction call and then discarded. Re-uploading replaces the previous extraction. You can view or delete your résumé data at any time in Account → Career context; deleting it also removes the profile links derived from it.

What we generate about you. Your capability models (with version history), your Briefs including the Deep Brief narrative, gap analyses, scores and score history, moat analyses, and a compiled profile summary with typed knowledge-graph links built from your assessments, résumé, and learning activity. If you submit work in the Capability Studio, we store your submission, its evaluation, and the resulting demonstrated-capability evidence.

Coach conversations.Coach chats are saved — both your messages and the coach's replies — so the coach has continuity across sessions. They are included in your data export and deleted with your account. Studio tutor messages are not stored; we keep only a monthly message count.

Learning activity. Module completions and check scores, certification links you self-attest, and Program progress.

Outcome reports. If you answer an outcome check-in (typically ~90 days after a recommendation), we store your self-reported outcome — whether you acted on the recommendation, role or compensation changes you choose to report, and your optional notes. These reports are deleted with your account and included in your export.

Billing (One-Week Pass, Pro). Your plan, subscription status, billing period, and Stripe customer reference. We never see or store your full card number — payment details go directly into Stripe's hosted checkout and are stored by Stripe, our PCI-compliant payment processor.

Operational records. Per-month usage counters (coach, tutor, Studio, Program); a log of the emails we send you (address, subject, type, delivery status); a server-side event log of key product actions, which may include your IP address; and a record of each Terms/Privacy acceptance — the document, version, date, IP address, and browser user-agent — kept as evidence of consent. All of these are deleted with your account.

Optional submissions. If you submit a testimonial or feedback signal, we store the quote, optional contact email, and context. On account deletion we detach your identity (email and account link removed); the anonymous quote may be retained unless you ask us to remove it entirely.

Email subscriptions. If you subscribe to the newsletter or Radar, we store your email address and a random referral token (never your email or identity inside the token).

• Research notes — verbatim quotes from public web pages found during report generation. They are keyed to roles, not people, never contain your words or data, and expire after 30 days.
• The evidence graph — capability evidence, adoption signals, and the claim ledger are market claims from public sources. No user data lives there.
• Cohort signals — recorded without user identifiers and surfaced only in groups of five or more.

• To compute your exposure profile, capability model, and scores
• To generate your Brief and Deep Brief, grounded in graph evidence
• To power the coach, Studio, and recommendations with your real context
• To benchmark your role against market data in aggregate only (cohorts of 5+ users, never individually identifiable)
• To send transactional emails, and lifecycle emails capped by a send governor (at most 3 non-transactional emails per rolling 7 days)
• To process billing for paid plans via Stripe
• To improve the scoring engine and assessment experience

What we don't do:

• Sell your data to third parties — ever
• Use your data to train AI models (ours or anyone else's)
• Benchmark you against other users in a way that identifies you individually
• Run advertising trackers or share your data with advertisers
• Record your browsing sessions

Career Runway's results are generated using a combination of deterministic scoring over our evidence graph and AI language models. Results are for informational purposes only and do not constitute professional career, legal, or financial advice.

What we send to Anthropic: the relevant assessment inputs — your role, answers, free-text in your own words, and résumé text you provide — to generate your analysis. For the Deep Brief this also includes live web-search context. This data is not used to train Anthropic's models; under our API terms it is not retained beyond the limited period needed for abuse monitoring. We do not send your name or email as part of this analysis.

What we send to OpenAI: short compiled profile summaries are converted into embeddings (numerical vectors) so search works across your intelligence. Under our API terms this data is not used for training.

Automated decision-making (GDPR Article 22): Career Runway uses automated profiling to generate career intelligence reports. These are informational only and do not produce legal or similarly significant effects. You may request human review of any automated assessment by contacting us.

Nothing about you is public unless you mint a share link. Every share artifact is anonymised (no name, no email, no employer), excluded from search engines, and addressed by a cryptographically random token — never your user ID:

• Headline card — role, score, top signal, top move, frozen at mint. Expires after 90 days.
• Move-plan share — your anonymised plan. Lives until you revoke it; revocation is immediate.
• Employer proof profile — anonymised verifiable record, created only with your explicit consent. Lives until you revoke consent; revocation is immediate and audit-logged.
• Studio result card — role, capability, score band. Expires after 90 days.

Career Runway uses essential cookies for authentication and stores preferences (theme, consent choices, assessment drafts) in your browser.

Product analytics run anonymously by default. We measure product usage (pages viewed, steps completed) with PostHog in cookieless mode: no personal identifiers, no autocapture, no advertising trackers, and nothing written to your device. Any session replay we run to understand where the product confuses people is fully masked — your text, résumé, and form inputs are never captured — and runs only with your consent. If you accept analytics in the cookie banner, we store a small random identifier in your browser so visits link across sessions. If you reject, analytics turn off entirely. You can change this at any time in settings.

We process your data under the following lawful bases (GDPR Article 6):

• Contract performance — to deliver the assessments, Briefs, coaching, and learning you request, and to manage your subscription
• Consent — for the durable analytics identifier, marketing communications, the optional résumé upload, and the employer proof profile
• Legitimate interest — for anonymous product analytics, error monitoring, AI quality assurance, fraud and abuse prevention, and service improvement

Career Runway is operated from Australia and hosted in the United States. Your data may be transferred to and processed in countries outside your jurisdiction, including the United States, where our service providers operate. These transfers are protected by:

• Standard Contractual Clauses (SCCs) where required by GDPR
• Service provider compliance with applicable data protection frameworks
• Contractual obligations requiring equivalent data protection standards

Your data is retained for as long as your account exists. When you delete your account, we first cancel any live Stripe subscription, then permanently remove your profile, assessments, capability models, Briefs, résumé extraction, compiled profile and knowledge-graph links, coach conversations, Studio work, learning records, usage counters, share links, email send log, event log, and acceptance records. If any deletion step fails we stop and report it rather than silently leaving data behind.

What survives deletion: anonymised aggregates that cannot identify you; testimonial quotes with identity detached (removed entirely on request); transaction records our payment processor must keep for financial compliance; and residual copies in encrypted database backups, which are purged on backup rotation.

Time-limited data deletes itself: share cards expire after 90 days, research notes after 30 days. Newsletter email addresses are retained until you unsubscribe or request deletion.

You have the right to:

• Access & portability — download a complete JSON export of your data from your account settings at any time
• Rectify — correct inaccurate data via your account settings
• Delete — permanently delete your account and all data
• Object — turn off analytics at any time via settings
• Withdraw consent — where we rely on your consent, withdraw it at any time without affecting processing already carried out

To exercise any of these rights, use your account settings or contact us at the email below.

Australian Privacy Act (APP): If you are located in Australia, you have equivalent rights under the Australian Privacy Principles. Career assessment data may constitute sensitive information under APP. We collect and process this data only with your informed consent when you initiate an assessment.

Complaints: if you believe we have mishandled your data, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or, in the EU/UK, with your local data protection supervisory authority.

We use row-level security policies in our database so users can only access their own data. All traffic is encrypted via HTTPS. API endpoints are rate-limited to prevent abuse. Administrative actions are recorded in an audit log.

Support access: to resolve a support issue, an administrator may view your account in read-only impersonation mode. This access is cryptographically signed, expires after one hour, cannot modify your data, and is recorded.

Data breach notification: if a data breach occurs that is likely to result in serious harm, we will notify affected users and the relevant regulator without undue delay, in line with the Australian Notifiable Data Breaches scheme and GDPR Articles 33–34.

The following third-party services process data on our behalf:

For privacy-related questions or data requests, email us at [email protected].