What we collect when you submit a message
- The message body and any optional fields you fill in (contact name, email, company, role).
- A SHA-256 hash of your IP address, salted with a server-side secret that is rotated periodically. The raw IP is never written to disk. The hash is used for rate-limiting and to dedup identical submissions.
- The verdict our analysis produced.
What we collect when you visit any page
- A SHA-256 hash of your IP, same as above. Used to count unique visitors over a 30-day window.
- The path you loaded.
- Your country, only when our CDN provides it as a header. The exact IP-to-country mapping is not stored.
- Your browser's User-Agent header, truncated.
- The referring URL, truncated, if your browser sent one.
What we don't do
- We don't set cookies.
- We don't use Google Analytics, Plausible, or any third-party tracker.
- We don't fingerprint you. No canvas, no audio, no behaviour tracking.
- We don't share data with anyone.
- We don't sell anything.
How long we keep it
- Submissions and reports are kept indefinitely. That's the point of the service: a recruiter-scam corpus that compounds over time.
- Visit logs are kept for 90 days, then deleted.
Your rights under GDPR
You can email jakub@isthisjobascam.com for any data request:
- Ask what we have related to a submission you sent (we can search by approximate timestamp + a snippet).
- Ask us to delete a submission you sent.
- Ask for a copy of anything keyed to your account (we don't have accounts, so this is short).
Because IPs are stored only as salted hashes and we don't keep the mapping anywhere, we can't locate or delete a specific visit-log row from an IP alone. The 90-day visit retention handles those automatically.
Legal basis
We process the data above on the basis of legitimate interest: providing a free public scam database requires logging enough to prevent abuse (rate limits, dedup) and to measure that the service is reaching anyone (aggregate counts). No marketing, no profiling.
Controller
Jakub, jakub@isthisjobascam.com. The site runs on a single server in the EU (Hetzner).
Please don't DDoS me. I can easily put a Cloudflare and some other annoying tools, which mostly makes life worse for privacy-oriented users.