Privacy
Without an account, your profile, pasted jobs and notes stay in this browser and nobody receives them. With an account, they are stored on JLocate’s own server so they follow you between devices. Below: what the browser keeps, what leaves it and when, and how to take or delete your data.
What this browser keeps
Apart from unsaved wizard answers, everything sits in this site’s local storage under jlocate.state.v1. JLocate sets no cookies until you sign in, and then only the one that keeps you signed in. Nationality is asked for only if you opt into the nationality statistics on the paid plan.
- Your profile
- Name, country, immigration status, visa expiry, graduation date, date of birth or age, degree, route history, target roles, locations and minimum salary. Status and route history pick the route and the new-entrant allowance, age and graduation date pick the salary rate, and the expiry drives the dashboard countdown. The name only labels the dashboard. Nationality only if you choose it on the Outlook page, where it picks which Home Office figures you see; no check reads it.
- Pasted vacancies
- The text you paste, your corrections to it, and what the sponsor register said about the employer, so a check still works after you close the tab.
- Saved roles
- Status, notes, follow-up dates and any recruiter contact you type. A contact is someone else’s personal data, so keep it to what you need to follow up.
- Dashboard
- Reminders, your weekly target, reports of wrong results and display settings.
- Your sign-in
- With an account: one cookie from the JLocate API that keeps you signed in. It is HTTP-only, first-party and set only after you sign in. The browser also keeps the account’s email, name and plan to label the screens.
- Unfinished forms
- Answers in the setup wizard, and the fields of a vacancy you are still reviewing, so a refresh does not wipe them. Kept in session storage, which the browser clears when the tab closes.
What leaves the browser
- Page requests
- Opening JLocate asks Vercel, the US company that hosts it, for the app’s files. Vercel logs each request with your IP address, browser type, the address you opened and the time, and keeps those logs for a limited period set by the hosting plan. Job search filters, the job details on the calculator and a search on the sponsor licence checker are part of the address, so a reload sends them. They describe a job or an employer, never you. Your profile and notes never go into an address.
- Your account
- Only if you create one. Your profile, pasted jobs, saved roles, notes and settings are sent to JLocate’s own API and stored under your account, so a change on your phone shows on your laptop. The API runs on Vercel with its database at the provider named on the Sources page, both under contract with JLocate. Nobody but you and the person who runs JLocate can read it, and it is used for nothing except showing it back to you. Download everything or delete the account at any time; deletion removes it from the server and from this browser. If you pay for the Pro plan, your card details go to Stripe and never reach JLocate, which keeps only a Stripe customer reference and the plan status.
- Links you paste
- If you paste a vacancy’s link instead of its text, JLocate’s API opens that page once, from its own server, only through the site’s public API or where its robots.txt allows, and hands the text back to you. The link and the text are then kept in your job record like any paste. Sites whose terms forbid this, LinkedIn, Indeed and Glassdoor among them, are never opened; you copy the text instead. Reading a link needs an account, and each account can read a limited number of links a day.
- Employer lookups
- Checking a pasted vacancy’s employer downloads a copy of the public sponsor register into this browser and looks the name up there, so the employer name is not sent anywhere.
- Share links
- A link you create carries the audit after the
#in its address, and browsers do not send that part to any server. Whoever opens it sees the job, the result and which salary rate applied to you, but not your name, age, dates or route history. Anyone with the link can read it, so send it only to people you choose. - Recruiter emails
- Email the recruiter opens your own email app with the questions filled in. Nothing goes anywhere until you press send there.
- Official sources
- Links to GOV.UK and other official sites open in a new tab without telling them which JLocate page you came from.
- Nothing else
- No analytics, no advertising, no fonts or scripts from other servers. The site’s security policy stops the app loading anything from, or sending anything to, another server; the JLocate API is served under this site’s own address.
Take your data or delete it
- Download my data on the Profile page (or the Account page, with an account) saves everything listed above as one JSON file.
- Delete local data on the Profile page removes all of it from this browser, including unfinished forms. Clearing this site’s data in your browser settings does the same.
- Delete my account on the Account page removes the account and everything stored under it on the server, and clears this browser.
- On a shared or library computer, delete before you leave, or use a private window, which forgets everything when you close it.
Results decide nothing about you
The checks run automatically and stay with you. No employer, university or the Home Office sees them, and nobody makes a decision about you from them. Each result names the rule and the source behind it, so you can follow the reasoning yourself.
Who runs JLocate, and your rights
JLocate is published by its author. The personal data the author holds about you is the Vercel request log described above, used to deliver the site and keep it secure, on the basis of legitimate interests under Article 6(1)(f) of the UK GDPR; and, if you have an account, the account and workspace described above, held because you asked for the service, under Article 6(1)(b), for as long as the account exists.
You can ask for a copy of that data, or for it to be deleted or no longer used, through the project’s GitHub page . If you are unhappy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
When this page changes
If JLocate starts sending anything new off your device, such as analytics or a live job feed, this page changes first and says what goes where and why. Analytics would also ask your permission before it starts.