Privacy Policy

When you browse as a guest

Career Universe stores your starred career identifiers, filter settings, and shortlist display preference in your browser's local storage. Small browser-only flags remember whether you have seen the save notice and help keep account status consistent across tabs. This lets the same browser remember your choices after you close it. We do not receive those browser-only values. Separately, the app sends the anonymous usage counts described under “Anonymous usage counts” below; they are not linked to you or to your shortlist. If you later create an account and explicitly choose items to sync, we receive only the selected career identifiers.

During the account flow, the browser also keeps your age-screen choice in session storage so it does not ask again during the same browser session. That session value is not sent to us unless you continue with account creation.

You can remove starred careers inside the app. You can remove all locally stored Career Universe information by clearing this site's data in your browser. Private-browsing sessions and school-managed devices may clear this information automatically.

If you sign in and choose to import guest shortlist items, the selected career identifiers are uploaded to your account. After the upload is confirmed, Career Universe removes only those selected identifiers from that browser. Unselected guest career identifiers and local preferences remain in the browser. They are hidden while you are signed in and reappear when you sign out.

When you save across devices

Account sync is optional. When you choose it, we process:

• Your email address, used to send a one-time sign-in code and identify your account.
• Your age range, either 13–17 or 18 or older. We do not ask for your birth date. For ages 13–17, we also record your confirmation that a parent or guardian approved the account.
• The career identifiers in your synced shortlist.
• Your account creation time and the version and acceptance time of the Terms of Use.
• One cookie, named cu_session, that keeps you signed in. Scripts on the page cannot read it, it lasts up to 30 days, and it is removed when you sign out. We set no other cookies.
• Short-lived, unreadable verification values used to check a sign-in code.

Cloudflare hosts the site, account service, and account database. Resend delivers the one-time code and receives your email address, the message, and delivery information needed to send it. These companies process information for us under their own service terms and privacy commitments.

Age and family use

Synced accounts are for people age 13 and older. If you are under 13, continue as a guest with a parent, guardian, or teacher and do not enter your own email address. A parent or guardian may use their own email for a family account. If we learn that we collected account information directly from a child under 13, we will delete it.

Technical and security information

Our hosting, network, database, and email providers may process technical information needed to deliver and protect the service. This can include IP address, browser and device information, request time, requested page, error records, and security events. We use this information to operate the site, prevent abuse, investigate failures, and protect accounts.

For sign-in abuse prevention, the account service stores rate-limit counters keyed to protected versions of the email address and IP address. The raw IP address is not stored in those counters. Inactive counters are removed after about two days.

Fonts, icons and data files are served from Career Universe's own address. The one exception is the sign-in form: when you ask for a sign-in code, it loads Cloudflare Turnstile, a check that the request comes from a person and not an automated script. Turnstile is run by Cloudflare, our hosting provider. It looks at technical signals from your browser and does not use cookies for advertising or build a profile of you. We do not send your IP address with the check. Other pages do not load files from other companies' servers.

How we use information

• Remember guest choices in the browser.
• Send sign-in codes and sync a shortlist when you request it.
• Record agreement to the Terms of Use.
• Secure, maintain, troubleshoot, and improve the pilot.
• Add up anonymous usage counts to see which careers and filters are used and which searches find nothing, so we can fill gaps and improve the explorer.
• Respond to requests and comply with applicable law.

We do not use a synced shortlist to make admission, employment, credit, insurance, or another eligibility decision about you. We process a minor's information only as needed to provide the features they ask for, and never for advertising or sale.

When information is shared

We share information only with:

• Service providers that host the site and account database, deliver one-time codes, or provide necessary site resources, under instructions to provide those services.
• Authorities or other parties when reasonably necessary to comply with law, protect people, or protect the service.
• A successor involved in a merger, financing, acquisition, reorganization, or sale of the service, subject to this notice and applicable law.

We do not sell personal information, rent email addresses, or share personal information for cross-context behavioral advertising. The pilot does not send marketing email.

Anonymous usage counts and browser privacy signals

To learn what to improve, the app counts a few things people do and sends those counts to us in one small batch when you leave or switch away from the page. We add them up by day. The counts are:

• A page visit.
• Which careers and sectors are opened, and which careers are starred.
• Which filters are turned on (for example, “No 4-year degree”).
• Searches that find nothing, so we can find careers we are missing. Only searches made of letters, 3 to 40 characters long, are counted. A search containing any number or an “@” sign is never sent.

The counts do not include your IP address, a cookie, a device or advertising identifier, your account or email, or the time of day. We store only the date, what was counted, and a running total, for example “Marine Biologist was starred 14 times on November 9.” They are not designed to identify anyone, and we do not use or combine them to work out who did something or to follow one person through the site. A search counts once per visit, however often it is retried. Search words that were not used in at least five searches on at least three different days are deleted after 30 days, and we look only at search words that meet that bar. To stop floods of fake counts, our hosting provider briefly checks how many requests arrive from the same network address; that check happens in Cloudflare's memory and the address is not saved with the counts. The sign-in cookie is never sent with the counts. Our hosting provider may still process technical information for each request as described above.

The pilot does not use advertising trackers, marketing analytics, or third-party analytics services. If your browser sends a Global Privacy Control or “Do Not Track” signal, the app does not send usage counts at all. We also treat a legally recognized opt-out signal, including Global Privacy Control where applicable, as an opt-out from any covered sale or targeted-advertising use. We do not currently engage in either use.

How long information is kept

Guest information remains in your browser until you remove it, clear site data, or the browser or device removes it. A one-time sign-in challenge expires after 10 minutes and is removed when it is used successfully, after five incorrect guesses, or when an expired challenge is cleaned up. Sign-in sessions expire after 30 days. Inactive rate-limit counters are removed after about two days. Anonymous daily usage counts are kept for about 25 months, except rarely used search words, which are deleted after 30 days. Synced account information and shortlists are kept while the account remains open.

When an account deletion succeeds, Career Universe immediately deletes the active account record, including its email address and shortlist, and ends its sessions. Cloudflare's always-on database recovery history may retain a recoverable copy for up to 30 days. We do not use recovery history to operate a deleted account. We do not keep separate copies of account data beyond this recovery history; if that changes, we will update this notice first. Cloudflare and Resend may keep limited service records under their own retention practices. We may also retain information when required by law or needed to protect the service from abuse.

Your choices

• Browse as a guest and keep your shortlist on one browser.
• Turn on Global Privacy Control or “Do Not Track” in your browser to stop anonymous usage counts.
• Sign out on a shared device after using a synced account. Signing out removes the sign-in cookie.
• Review and remove careers from your shortlist.
• Delete a synced account and its shortlist from the account controls.
• Ask for access, correction, or deletion when applicable law provides that right.

We respond to privacy requests within 45 days. We may ask you to verify control of the account email before acting on an account request.

Security

We use safeguards designed for the limited information in this pilot, including encrypted connections, password-free sign-in, short-lived codes, unreadable stored verification values, access controls, and rate limits. No online service can promise absolute security. Please sign out after using a shared computer and protect access to your email account.

Schools and educators

A student or educator using the public site independently does not make Career Universe a school records provider. If a school later contracts for accounts, dashboards, roster data, or student records, that program will need a separate school privacy review and agreement before those features are enabled.

Changes to this notice

We will post the updated notice here and change its effective date. If a change materially affects account information, we will provide notice in the account flow and ask account holders to accept updated terms when appropriate.

Contact

Email privacy@tarvacore.ai to ask a privacy question or make an account request.