Version 2026-08-19
Privacy Policy
Shortlist is an invitation-only beta. This policy sets out what
is collected, where it goes, and how long it is kept.
Who operates Shortlist
Mike Ferris, as an individual, not a company.
Contact: shortlist@mwferris.com.
The beta is open to people in the United States only. You must be 18 or over.
What is collected
- Your username, and a hashed form of your password. The password itself is
never stored and cannot be recovered.
- Your email address, used only to send password reset links.
- Your resume as uploaded, which typically contains your name, phone number,
address, and work history.
- Your search preferences, and the jobs you save: company, title, posting
text, your notes, status, and application dates.
- Material generated for you: fit ratings, tailored resumes, cover letters,
and contact research.
- The times of your recent searches. Times only.
No analytics, advertising, or tracking of any kind is used. IP addresses are
not written to any persistent store.
Disclosure to Anthropic
Every AI feature transmits text to Anthropic, the provider of the Claude
models, governed by their
privacy
policy. That text includes the full contents of your resume, your search
preferences, and the job postings you save.
The tool cannot be used without this transmission.
Job discovery and contact research also issue web searches and retrieve public
pages on your behalf.
Data concerning third parties
The contact research feature records the name, job title, employer, public
LinkedIn URL where available, and an email address for recruiters and hiring
managers at companies you save.
Email addresses are either published on a public source or inferred from an
employer's address pattern. Inferred addresses are labelled as such in the
interface and may be inaccurate or belong to another person.
Shortlist does not send email. It opens a draft in your own mail client; any
message sent is sent by you.
Third-party contact data is deleted 90 days after the related job is archived,
and immediately when the job or your account is deleted.
Recruiters and hiring managers: to request confirmation of,
or deletion of, your details, contact
shortlist@mwferris.com.
Storage and retention
Data is held on a single virtual private server located in the United States,
administered solely by the operator. Backups are encrypted. Connections to the
service are encrypted in transit.
| Category | Retention |
|---|
| Account, jobs, resumes, generated documents |
Until deleted by you, or until the beta ends |
| Third-party contact data |
90 days after the related job is archived |
| Deleted account |
Removed immediately; no copy retained |
All accounts and data are deleted when the beta ends. Notice and an
opportunity to export will be given beforehand.
Your rights
- Download my data (Settings): a zip archive of everything
held about you.
- Delete account (Settings): removes your account record and
all associated files. Immediate and permanent.
Requests may also be sent to
shortlist@mwferris.com.
Security
Measures in place include hashed passwords, signed session cookies, per-account
file isolation, login rate limiting, restricted filesystem access for AI
processes, and owner-only file permissions.
The service has not been independently audited or penetration tested. Do not
upload material you cannot afford to have exposed. In the event of a breach
affecting your data, you will be notified by email.
Changes
Material changes are published with a new version date, and acceptance will be
requested again. The version you accepted is recorded on your account.