Privacy

hiringfeed has no accounts, sets no cookies and shows no ads. This page covers what we collect, who else handles it, how long we keep it, and how to reach us. Last changed October 23, 2026.

For the rules on using hiringfeed, read our Terms of use.

Up to 30 daysIn the feed
Days 30 to 45Kept, not shown
Day 45Deleted

Every post we keep runs on the same clock. It can appear in the feed for up to 30 days and is deleted on day 45, or sooner if its author deletes it on X or asks us to remove it. After that, we keep only the short records described below.

On this page

Who is responsible

Henry Nguyen operates hiringfeed as an individual and is responsible for the personal data described here. Where data protection law uses the term, he is the controller. You can reach him at hello@hiringfeed.app.

The site is for people aged 18 or older. It is not directed to children. If you believe we hold a child's personal data, contact us so we can investigate and remove it where appropriate.

Posts and profiles from X

Every 15 minutes we search X for public posts that look like job openings. For each post we keep, we store:

the post as published: its text, links, links to its pictures, posting time and the IDs of earlier versions
the post it quotes, and job links the author adds in their own thread or replies, with the text around each link
the author's public profile: name, @handle, profile photo, bio, website, verified badge, company badge, follower count and the date the account was created
the same public profile for the author of a quoted post, and for company accounts linked from the post or the author's profile
what we work out from these: the role, company, location, seniority, whether pay is mentioned, whether each job link still works, and spam signals

We use the profiles to show posts the way X requires and to find the company behind an opening. An account younger than 30 days, fewer than 50 followers or a default profile photo is recorded as a spam signal. We never try to infer anything sensitive about an author.

We also keep a short record of every post we check, including ones we skip, such as a job seeker's post, spam or a post from a blocked account. It holds the post's ID, its posting date, usually its author's numeric ID, and what happened to the post: kept, expired, deleted or hidden on X, removed, or skipped. Except for kept posts, it also says why, which for a skipped post can be the model's label. The record has no end date and stays after the post itself is deleted. It stops us from processing the same post twice and lets us spot accounts that post too often. A skipped post leaves nothing else behind unless a post we keep quotes it, takes job links from it, or reads it as part of its author's thread. Profiles we fetched for skipped posts are deleted at the next daily cleanup unless a post we keep still needs them.

What a model reads

We send new posts that pass our first spam and block checks to Grok, xAI's model, which tells us whether each one is a job opening and picks out the role, company and place. We send a post again when it or a post it draws on is edited, and when the author's replies add job links for its roles. The request carries the post's ID, text and links, the titles X gives those links, short snippets of text around links in the author's thread and replies, and the post it quotes or the start of its thread. It carries none of the author's profile fields, so any names or @handles in it come from the posts or from the titles of the pages they link to. It carries nothing about you. xAI handles the request under its own API terms.

What we share with X

Once a day we send X the IDs of the posts we keep, the posts they quote, the thread and reply posts we take job links from, and every account whose profile we store. X tells us which were deleted, made private, suspended or edited, and we delete or update them.
Profile photos and pictures in posts load straight from X's servers. X receives your IP address and browser details, which pictures your browser loads, and that the request came from hiringfeed.
Job links go through t.co, X's link service, as X requires. Opening one tells X which link you opened before it sends you on to the employer's site. Message, Profile and View on X open x.com.
Links you open from hiringfeed send no referrer, so the site you land on isn't told which site or page you came from.

We send X nothing else about you.

If you use the removal form

The form stores what you enter: the post link, profile link or @handle, whether to remove one post or every post by the account, and the reason and contact if you give them. It also stores the time and a keyed hash of your IP address, not the address itself, which lets us limit one network to 10 requests an hour.

The contact field is optional. We use it only to handle and reply about your request, including the removal alert described below. We never add it to a mailing list.

While a request waits for a decision, we email it to ourselves as a removal alert so we can act on it within 24 hours. The alert goes through Resend, an email delivery service, to our inbox. It contains the request number, the post link, profile link or @handle, whether to remove one post or every post by the account, when you sent the request, and any reason and contact you gave. It never contains your IP address or its hash. An alert can still include a request we decided after it was prepared.

We keep every request, including ones we decline and ones still waiting for a decision, with no set end date. To have your contact details or reason deleted from a request, email hello@hiringfeed.app.

What we count

When analytics is on under your privacy choices below, PostHog, a US analytics service, counts page views, time on page and how fast pages load. Requests go through our own domain, and the text of your searches is removed before anything is sent. When you use Apply, Message, Profile or View on X on a card, we send an event saying which of the four you used and a random ID for the card, plus the fields PostHog needs to route the event. The card ID isn't the post's ID on X: only our database links it to a post, and that link is deleted with the post. The event contains no post text, names, @handles, destination links, page details or device properties. Automatic click tracking, heatmaps, session recordings and error reports are off.

PostHog sets no cookies and stores nothing in your browser. To count unique visitors, it hashes your IP address and browser details together with the date, so the count starts over every day, then drops your IP address before it stores the event. Page and performance events keep the page and its title, the site that linked you here, how far down the page you scrolled, your time zone and language, and your browser, operating system, device type, and screen and window size. PostHog keeps events for one year.

We don't load PostHog when your browser sends Global Privacy Control (GPC) or Do Not Track set to 1, and we drop any analytics event, card actions included, while either signal is on. These signals don't change hosting requests, pictures loaded from X, links you choose to open or what the site keeps in your browser.

Your privacy choices

Analytics and remembered feed activity are separate, optional purposes. For visitors in the European Union, the European Economic Area, the United Kingdom, and Switzerland, both stay off until you opt in. We also ask first if we can't tell where you are. To decide whether to ask, we use the country Vercel works out from your IP address. We use it for nothing else and don't save it.

Elsewhere, both purposes start on unless you turn them off. Global Privacy Control and Do Not Track still turn analytics off, as described above. You can accept both, reject both, or choose each separately. Using the feed does not require either one.

Open Privacy choices in the footer or mobile Menu to change your choices or withdraw consent at any time. Turning off activity deletes the saved visit times and opened links from this device. Turning off analytics stops new analytics events from being sent, but does not delete events already sent to PostHog, which keeps them for one year.

Why we use personal data

Where European or UK data protection law applies, we rely on legitimate interests to find and display public hiring posts, keep the feed current, prevent abuse, and handle removal requests and other correspondence. Those interests are running a useful and safe feed, without advertising profiles. You can object as described below. Analytics and remembered feed activity are the exception: where we ask first, as described under Your privacy choices, we rely on your consent for them.

We may also need to use or retain information to meet a legal obligation or establish, exercise or defend legal claims. Some decisions are automated: our spam checks and a model decide which posts appear in the feed, as described above.

Providers and international transfers

The providers named on this page are Vercel (hosting), Supabase (production database), Neon (preview database), PostHog (analytics) and xAI (classifying public posts). They handle the data described in their sections. X supplies public posts and receives image requests, link visits and compliance checks under its own terms. Ko-fi handles tips under its own terms. Our email inbox provider handles messages you send us. Resend and our email inbox provider also handle removal alerts as described above.

hiringfeed is operated from the United States. Providers may process data in the United States and other countries, where privacy protections can differ from those where you live.

Your privacy rights

Depending on the law that applies to you, you may ask to access or receive a copy of your personal data, correct it, delete it, restrict its use, or receive a portable copy. You may object to processing based on legitimate interests. These rights have exceptions, including information needed to meet legal obligations or defend legal claims.

Use the contact route below and say what you want us to do. We may ask for information needed to verify your request; do not send an identity document unless we explain why it is needed. An authorized agent can contact us with proof of authority. If we decline, you can ask us to review the decision by replying to the same contact. We do not discriminate against you for exercising a privacy right.

You can also complain to Henry about how we handle your personal data, using the same contact below.

You can also complain to your local data protection regulator. In the UK, this is the Information Commissioner's Office. In the EEA, contact your country's supervisory authority. In the US, you can contact your state attorney general.

We do not sell personal data or share it for cross-context behavioral advertising, and do not use it for targeted advertising. Our GPC handling goes further by turning off our analytics. Do Not Track is handled the same way. Other sites you visit from hiringfeed follow their own policies.

If you support the feed

Tips go through Ko-fi under its own privacy policy; hiringfeed never sees your payment details.

What stays in your browser

We save your privacy choices on this device so we can honour them, including a rejection. This necessary choice record stays until you change it or clear this site's browser data. It does not enable analytics or remembered activity by itself.

With remembered activity on, local storage keeps your last visit and the job links you opened, and session storage keeps a visit baseline for the current tab. This lets the feed mark new posts and opened links. The saved activity never leaves your device. Opened links older than 30 days are cleared the next time you open a job link. With activity off, we do not read or write that optional storage, even if older values exist, except to delete it.

Choosing Light or Dark saves your requested theme on this device. System removes the saved theme and follows your device's appearance setting. The theme control explains this before you choose.

Clearing this site's browser data removes these records. We may ask for your privacy choices again afterwards.

Where it lives, and for how long

Vercel hosts the site and runs the jobs that read X. Like any web host, it receives your IP address and browser details with each request. Supabase hosts the production database. Our test site at dev.hiringfeed.app and other preview copies use a separate test database hosted by Neon, so anything submitted on them is stored by Neon.

Posts, pictures and job links: Deleted 45 days after posting, and shown in the feed for at most 30 of those days. Deleted sooner at the next daily check after the author deletes or hides the post on X, or when a removal request is carried out.
Quoted posts: Kept while any post we keep quotes them, then deleted at the next daily cleanup.
Profiles: Deleted at the next daily cleanup once we store no post by the account, quoted from it, or naming it as the company.
Records of checked posts: No end date. Each holds a post ID, its posting date, usually its author's numeric ID, and what happened to the post. The IDs of posts we quote and of the author's thread and replies we read, with their earlier versions, are kept the same way.
Removal requests and blocks: No end date, including declined and waiting requests. A blocked account is stored as its numeric ID and @handle.
Analytics events: One year, at PostHog.
Your browser's storage: Privacy choices and a chosen theme stay until you change or clear them. Saved activity stays until you turn it off or clear it. Opened links older than 30 days are cleared the next time you open one.
Removal alert emails: Resend keeps each alert's content and delivery logs for 30 days, and its backups for up to 7 days after that. Our inbox keeps alerts until we delete them. Deleting a removal request from our database does not delete these copies.

What we don't do

We don't sell or rent any of this, show ads, build profiles of readers, or match anyone's X account to information from outside X.

Questions and requests

Email hello@hiringfeed.app to ask what we hold about you, to correct it or to have it deleted. To take a post or an account off the feed, use the removal form. If this page changes, the date at the top changes with it.

If you email us about privacy, copyright, accessibility, security or another question, the services delivering and storing email handle your address, delivery details and anything you include in the message or attachments. We use the message to handle and reply to your concern, not to add you to a mailing list. Messages stay in our inbox until deleted; email providers may keep delivery records and backups under their own policies. Please send only what we need to understand the issue.