Your job search is nobody else's business.

Your data is yours alone

Every record Rolehound keeps carries the id of the account that owns it, and every query the application makes is filtered by that id in the database layer itself — not by a check written into each screen, which is the kind of thing that gets forgotten when a new screen is added.

That filter fails closed. If a query ever runs without a signed-in account resolved behind it, the filter compares against nothing and matches no rows at all. The worst a mistake of that shape can do is show you too little of your own data. It cannot show you somebody else's.

What Rolehound stores

Plainly, so there are no surprises:

• Your account. An email address, a password hash, and — if you turn on two-factor authentication — your two-factor settings and your recovery codes. Your password itself is never stored, and cannot be read back by anyone.
• Your CV and profile. The text of the CV you import, and the structured version built from it: headline, summary, skills, sectors, must-haves, dealbreakers, work history, education, certifications — and the contact block on the CV, which is your name, email address, phone number, location and links.
• Your criteria. Your search titles and keywords, your salary floor, your home postcode and the coordinates it resolves to, and your maximum commute.
• Jobs and scores. The roles found for you, and for each one the fit score, the summary, the strengths and the concerns.
• Applications. Which role, which stage, and the documents generated for it — both the text and the finished PDF.
• Email. For each message, the sender, the subject, a short preview, the time it arrived and what Rolehound decided it meant. Not the body of the message.
• Connections and billing. Your mailbox host, port and username, with its secret encrypted; your payment provider's references for you; your credit balance and your metered usage.
• An audit trail. What ran on your account, and when.

Two things about that email row are worth being exact about, because the honest version is broader than you might assume. First, Rolehound classifies every message that has arrived in the connected inbox since it last looked, not only the ones that turn out to be about a job — so a row with a sender, subject and short preview is written for personal mail too, marked irrelevant. Second, when a message is classified as a job alert, its full text is then fetched and passed to the extraction model to pull the roles out of it. That text is read in flight and is not written to the database; what is kept is the roles it produced, and the sender, subject and preview above.

Because of that, a mailbox you use only for your job search is a better thing to connect than your main personal one.

If you arrive through someone else's referral link, a one-way hash of the address you signed up from is kept as an abuse signal. The address itself is not.

These pages load no analytics or advertising scripts from anyone.

What Rolehound does with your mailbox

This is the part that deserves the most care, so here is exactly what the code does.

The connection is read-and-file only. Rolehound opens a TLS connection to your mail server, reads messages, and files each one it has classified into a folder under Rolehound/ in your own mailbox, named for what it decided the message was — Rolehound/Acknowledgement, Rolehound/InterviewInvite, Rolehound/JobAlert, Rolehound/Irrelevant and so on. Reading a message never marks it as read.

Filing happens one of two ways, and both are safe by construction. Where your server supports the IMAP move command, the message is relocated in a single server-side operation. Where it does not, Rolehound copies the message into the target folder first, and only once that copy has come back confirmed does it flag the original and expunge it. If the copy fails, nothing is flagged and nothing is expunged: the message stays exactly where it was, and the failure goes into the server log rather than onto any page you can see.

There is no delete path and no trash path. The interface Rolehound uses to speak to your mailbox exposes no such operation at all, so there is no code that could take one.

Rolehound never sends email from your account. That interface has no send method either. The email Rolehound does send you — confirming your address, resetting your password, a two-factor code if you have the emailed-code option turned on — goes out through the operator's own mail server, never through yours.

Your connection secret, whether an app password or an OAuth refresh token, is encrypted before it is stored, using ASP.NET Core's Data Protection, and it is never shown back to you or written to a log. Connect Gmail or Outlook with OAuth and there is no password for Rolehound to hold in the first place. Disconnecting the mailbox on the Mailbox tab removes the stored connection and its secret.

Be clear about what that encryption is worth, because the honest answer is narrower than the word suggests. It puts the secret out of reach of anything that can see one row without being able to read the whole database — a stray log line, a partial backup, a bug in the application. It does not put it out of reach of whoever runs the server: the key that unwraps it is kept in the same database as the ciphertext it protects, and that key is itself only wrapped with a certificate of its own where the operator has configured one. So anyone who can read the database can recover the secret. The same is true of your AI provider key, and it is the same disclosure as the one further down about operator access — the two are really one fact.

AI providers

Rolehound runs no models of its own. Four jobs go to an AI provider: reading a CV or a job page into structured detail, scoring a role against your profile, working out what an incoming email means, and drafting your tailored CV and cover letter. Each call carries what that job needs and no more — your profile and the role for scoring and drafting; for classification, the sender, subject and preview of the message plus the company and title of your open applications.

On Rolehound's own key, those calls go to Anthropic and nowhere else. That is a property of the code rather than a setting: the platform path resolves to Anthropic before a request is built, and the router refuses outright to dispatch a platform call to any other provider.

Add your own key on the Billing page — Anthropic, OpenAI or Google Gemini — and every one of those calls runs on it instead. Your content then goes to a provider you hold your own account and contract with, on their terms rather than through ours, and Rolehound meters none of it. Your key is encrypted before storage on exactly the same terms as your mailbox secret above — including what that does and does not protect it from — never shown back to you, and cleared from the Billing page whenever you want it gone.

Rolehound trains no model on your data, and never uses one account's data for another account's benefit.

Payments

Card details never reach Rolehound. Paying takes you to a checkout page hosted by Stripe; you enter your card there, on Stripe's page, and Rolehound is told only the outcome. What comes back and is stored is a customer reference, a payment or invoice reference, an amount, a currency and a date. There is no card number, no expiry and no security code anywhere in the database, because none is ever sent to it. Changing or cancelling a subscription works the same way, in Stripe's own billing portal.

Who else is in the loop

A job-board aggregator receives your search titles and criteria to run searches — never your CV. A UK postcode lookup turns your home postcode into coordinates, and a routing service estimates commute times from them. The careers boards on the watchlist are read once for everyone who follows them rather than once per follower, so following a company tells that company nothing about you. Stripe handles payments. An AI provider does the four jobs above. That is the whole list.

Signing in

Registration confirms your email address before the account can be used. Passwords are stored only as hashes, by the framework's own identity system, and a forgotten one is reset through an emailed token rather than by anyone looking it up. Two-factor authentication is opt-in, on the Security page under the account menu: an authenticator app, an emailed code where this instance sends email at all, or both. Where it is turned on, signing in stops at a second step and asks for a code — from an authenticator app, an emailed code, or a recovery code if you have one — before any session is issued. Sign-in, registration, password reset and two-factor attempts are all rate limited.

Running it yourself

Rolehound is a small, self-contained stack: an API, a background worker, a Postgres database and a reverse proxy, brought up from a single compose file. Every external service is configuration you supply, and the stack still runs without any given one — the loop that needed it simply stops rather than the whole thing failing. If you would rather your CV and your mail never left a machine you control, hosting your own instance is a real option; ask on the contact page.

What this page does not claim

Rolehound has been through no external security audit and holds no security certification, and nothing above should be read as suggesting otherwise. This page describes what the code does — which is the part that can be checked, and the part you can check yourself by running your own copy.