Privacy
What Tripwire stores, who else sees it, and for how long. Last updated August 26, 2026.
Tripwire is a private job tracker run by one person for a small group of people who know each other. It is not a business, it sells nothing, and it has no advertising, analytics or tracking of any kind.
What it stores
- Your account — email address, display name, and a hash of your password. The password itself is never stored.
- Your resumes — the file you upload and the text extracted from it. Uploaded files are kept in a directory the web server is configured to refuse, in a folder per account, and are not reachable by URL.
- Your job search — the companies you watch, the jobs you save, the status you set on each, and any notes you write.
- Anything the AI features produce for you — tailored resumes, cover letters, answers to application questions, interview prep, and which model produced each.
- Your preferences — role keywords, minimum salary, location and work-type filters.
- Contact details you enter for the browser extension to fill in application forms, and any contacts you record against a job.
- Failed sign-in attempts — the email address tried and the IP address it came from, to stop password guessing. Kept 30 days, then deleted automatically.
What leaves this server — read this part
When you use Tailor resume, Write cover letter, Draft an answer or Interview prep, Tripwire sends the full text of the resume you selected and the full job description to an external AI provider, along with your question where there is one. It cannot do those things without sending them.
Two providers are used:
- Google (Gemini) — tried first.
- Groq — used automatically when Google fails or is unavailable, which happens often enough to matter. You are not asked which one; whichever answers is recorded alongside the result.
Your resume typically contains your name, contact details, employment history and dates. All of it goes in the request. What those companies do with data sent to their APIs is governed by their terms, not by this page: Google's and Groq's.
Nothing is sent to either provider unless you press one of those buttons. Browsing, saving jobs, writing notes and everything else stay on this server.
Other things the server talks to
- Job boards and aggregators — Greenhouse, Lever, Ashby, Workable, SmartRecruiters, Workday, HireHive and several public job feeds. Tripwire reads postings from them on a schedule. Nothing about you is sent.
- OpenStreetMap (Nominatim) — used to turn a place name into coordinates so distance filtering works. Place names only, never anything identifying you.
- Google Fonts — the web pages load fonts from Google, which means your browser contacts Google when you visit. The iOS app does not.
- Email — sent from the server that hosts Tripwire, for new-account details and job digests.
The site is hosted on shared hosting, so the hosting provider can technically reach the server and its database, as with any hosted site.
Who can see your data
Other users cannot see your resumes, notes, saved jobs, generated documents or preferences. The list of companies being tracked is shared across the install so one poll serves everybody, but which of them you follow is private.
The administrator can sign in as another user for support, and every time that happens it is recorded. Administrators can also see account emails and failed sign-in records.
Deleting your data
Ask, and the account and everything attached to it is deleted. Resumes, notes, generated documents and saved jobs are removed with it. Text already sent to Google or Groq is not something Tripwire can reach back and delete — that is between you and their retention policies.
Security
The site is HTTPS only. Passwords are hashed. App and extension tokens are stored as hashes, so the database does not contain anything that can be replayed as a login. Repeated failed sign-ins are throttled, with lockouts that expire rather than locking an account permanently. Accounts can turn on a second factor, and the administrator account has one.
Contact
Questions, or a deletion request: schtoboy@gmail.com.