Privacy policy

Referizz for Android

The Android app sends searches and filters to Referizz to retrieve jobs. Signing in uses your browser and Firebase Authentication; the app stores its session credential using encrypted device storage. Account preferences and Saved/Applied records are shared with the website. Preview builds can store fictional sample saves and a selected server on the device. Local settings and data may be included in backups managed by your device; the encrypted session credential is excluded from Android backup. The app does not request your GPS location, microphone, contacts or photo library. Locations typed into search or preferences are information you choose to provide. The native app contains no advertising, analytics or session-replay SDK. Website features opened in your browser follow the website disclosures below.

To request deletion of your account and associated data, use Account → Delete account in the app or visit Delete your Referizz account. You do not need to sign in to request deletion.

Information involved in using Referizz

• Searches: standard job-search pages process the keywords, location, employer, and filters you enter to return results. These appear in the page URL and may remain in your browser history or links you share. Avoid including personal information in a search.
• Technical information: our hosting and security systems process information such as IP address, request details, browser information, and errors to deliver and protect the service. Operational logs may contain technical information.
• Messages: if you email us, we receive your email address, message, and any information you choose to include.
• Community content: referral requests and replies are stored by Referizz and visible to signed-in members under your generated community user ID. Your email and Firebase identifier are not displayed with posts. Reports are stored privately with the reported entry, reason, reporter account identifier, time, and review status. We use them for moderation and abuse prevention; they are not shown to other members. Report records may remain after review and in backups, and you may request deletion by contacting us. Blocking stores the two account identifiers and the time privately so we can hide each member's posts from the other. Your blocked-member list is visible only to you. Unblocking removes your block; account deletion removes blocks involving that account. Backup copies follow the account-data recovery policy.

Resume matching is unavailable in this version. We will update this policy before introducing features that change how personal information is handled.

Referizz accounts

After a verified deletion request, we retain a minimal private record of the account identifier and deletion status to prevent old backups from restoring deleted account data. Account backups may retain older data until their retention period expires.

Firebase Authentication, provided by Google, handles email/password and Google sign-in. Your password is sent directly from your browser to Firebase; Referizz does not receive or store it. Firebase maintains your account identifier, email address, authentication information and any profile information returned by Google sign-in. Referizz verifies your email and account status and displays your email on the account page.

We use a secure, HttpOnly login cookie that expires after five days and a separate same-site form-protection cookie that expires after 30 minutes. An optional HttpOnly cookie remembers the local page to return to after sign-in for up to 30 minutes; it is cleared after returning or signing out. The login cookie is sent only to Referizz.

Our server stores its hash, Firebase account identifier and expiry so sign-out invalidates that session. Expired session records are removed on the next sign-in or sign-out. Firebase sign-in tokens are held in browser memory, not deliberately saved by Referizz to local storage. Firebase and Google may use their own cookies or browser storage during sign-in.

Creating an account does not save your resume or matching profile. If you choose to add job preferences, Referizz stores your desired job title, preferred location and work arrangement with your Firebase account identifier in its private account database. “Find jobs using my preferences” puts these choices into search filters and the results URL; the URL may remain in browser history or links you share. Preferences are optional and are not sent to the AI provider.

Your job tracker stores posting identifiers, the time saved and, when you mark a job as applied, the time of that update with your account identifier; Referizz uses its current catalog to display those postings. Preferences and Saved/Applied tracker records remain until you clear or remove them, or request account deletion; signing out does not erase them.

Referizz stores a stable, randomly generated community user ID with your Firebase identifier. This ID identifies your posts and replies to other signed-in members; it is not a login credential. Community content is stored in the private account database, separate from the job catalog.

Request account deletion by emailing [email protected]; signing out does not delete your Firebase account. Restarting signup with a different email does not delete an earlier unverified account. See Firebase's privacy information and Google's privacy policy.

How information is used

We use information to provide search and community functionality, respond to requests, diagnose problems, prevent abuse, and meet applicable legal obligations. We do not sell personal information or use search activity for targeted advertising.

Community participation and browser storage

The main job-search pages do not currently use analytics or advertising trackers. Requests and replies require a verified Referizz account to view or post. The referral page no longer loads Giscus or requires a GitHub account.

Community content is shared with other signed-in members, not a private message. Do not post resumes, addresses, phone numbers, confidential information, or other people's personal data. Moderators can review and remove content. A generated user ID does not guarantee anonymity or verify employer affiliation. You can browse jobs without signing in.

Service providers and external sites

We use Google Cloud for hosting and backups, Firebase Authentication for accounts when enabled, and Zoho Mail for email correspondence. These providers process information under their own terms and privacy practices. We may disclose information when required by law or to address fraud, security incidents, or misuse.

Applying for a job takes you to the employer's website. The employer controls its application process and information you submit there. Referizz does not receive your job application through the current app. Services and providers may process information in the United States and other countries.

Retention and security

We keep correspondence and operational information for as long as reasonably needed for support, security, and legal obligations. Community posts remain until removed by their author or a moderator, or through an account-deletion request. Removing a request also removes its replies. Removal clears message text from current storage; limited metadata remains for abuse prevention and threading.

Account and community data require separate private backups from the job catalog; retained backup copies and copies made by other members may persist after removal. Earlier GitHub community comments, if any, remain on GitHub until managed there.

We use access restrictions and encrypted connections to protect the service. No storage or transmission method is completely secure.

Your choices and requests

You can remove your own Referizz requests and replies, and contact us about moderation, access, correction, deletion, or other privacy requests. Earlier GitHub comments must be managed through GitHub. Depending on your location, you may have additional rights under applicable law. We may need to verify your request and may retain information where legally required. We cannot delete employer application records or control third-party copies; contact the relevant provider or employer for those requests.

Send privacy requests to [email protected]. Please do not include unnecessary sensitive documents.

Children and policy updates

Referizz is not directed to children under 13. If you believe a child has provided personal information, contact us. We will update this page when our practices change and change the date above. For material changes, we will provide additional notice where required.

Sign-in security checks

We use Cloudflare Turnstile on account forms to help detect automated abuse. Cloudflare processes connection, browser and device signals for these checks under its privacy policy. Referizz sends the security token to Cloudflare for validation; your password, email address, resume and community messages are not included in that validation request.

Our server stores hashes of short-lived security passes and their form bindings, with expiry times, in its private account database. Passes expire after four minutes and can be used only once to obtain a Referizz login session. Expired passes are removed on the next successful issuance; operational backup copies may persist.

Security logs and abuse prevention

Our server access logs record client addresses, request methods and paths, response status, and timing. Search query strings, request and response headers, cookies, resume documents, and matching profiles are excluded from these access logs. Logs rotate at 10 MiB with up to three rotated copies; rotated copies expire after seven days. The current log remains until rotation. Other operational logs and incident records may be kept as reasonably needed for security and support.

We use your connection's network address to limit searches, account and community requests, matching forms, uploads, and AI requests. These request counters store keyed hashes rather than raw addresses. Search, form, and upload counters expire after an hour of inactivity on the next successful state update. AI counters use a rolling 24-hour window; entries outside that window are removed on the next successful state update.

These counters may be retained in operational backups. Shared networks can share a limit. This information is used for security, not advertising or analytics.