Privacy policy

Digital Cotton, operating as tokens to agents, is the data controller for the job index at tokenstoagents.ai/jobs. Questions, access requests, and deletion requests go to ryan@tokenstoagents.ai.

When you create an account we store your email address, the name you give, and a handle if you claim one. Your password is handled by our authentication provider and stored only as a hash; we never see it in readable form and never store it ourselves. You can change your name, email, or handle, or delete the account outright, from your settings.

The Profile Record is the work history, credentials, and links you enter or confirm. We store it so we can show your profile to you and draft applications from it. You put it there and you can edit or remove any entry at any time. Nothing in it is published to anyone else in this release.

When you upload or paste a resume, we read it to propose entries you then review and confirm. The resume text itself is not stored: only the proposals you are shown, in one working buffer, and that buffer is cleared the moment you act on it. A cover letter you save is kept on file as a writing sample, so a drafted letter can match your own voice, until you remove it.

Drafting runs on your own AI provider key. If you connect an Anthropic, OpenAI, Kimi, or DeepSeek key, it is encrypted at rest and decrypted only at the moment it is used to draft for you. We never log it and never send it anywhere but the provider it belongs to. You can delete it at any time.

When you draft, the posting and the parts of your record the draft needs are sent to that provider under the provider's own terms, and the cost is billed to your key, not to us. A key you have not connected means no draft is ever sent anywhere.

When you save a posting, track an application, record an outbound click, a status, or the pay you were offered, we store it so the Desk can show two things side by side and never merged: what you did, and what the machine observed. This is your own record of your own search.

Signing in sets a session cookie through our authentication provider so the login works. After a form submission that did not validate, we set a short-lived cookie that carries your entries and the error back to the page so you can fix them; it expires in minutes. We set no advertising cookies and do not track you across other sites.

No advertising trackers. No third-party ad networks. No selling or renting your data to anyone. We do not use your data to train models. Nothing the machine observes about you is sold back to you. These are the same lines the covenant states, and this is where they bind the data itself.

Vercel hosts the site and Neon hosts the database. Both act as our processors, handling data only to provide their service to us. When you draft with your own key, the AI provider you connected receives that request as an independent controller under its own privacy policy, which is why the key and the billing are yours and not ours.

We operate from the United States and store data there. If you are outside the United States, your data is transferred there. Where the UK GDPR or EU GDPR requires a transfer mechanism, our processors rely on the European Commission's Standard Contractual Clauses. You may ask which mechanism applies to a given processor.

We keep your account and its data for as long as your account exists. Delete your account and its record, saved postings, applications, cover letters on file, and any stored provider key are removed. You do not have to ask us to do it: the control is in your settings.

Wherever you live, you can ask for a copy of what we hold, correct it, delete it, or ask us to restrict a particular use. Two of these are self-serve today: your settings page downloads everything we hold about you as one file, and deletes your account outright. For anything else, email ryan@tokenstoagents.ai. If you are in the UK or the EEA you also have the right to object to processing and to complain to your local supervisory authority.

This is a tool for people looking for work. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us data, email us and we will delete it.

If this policy changes, the date above changes with it, and a material change will be noted on this page. Questions, requests, and complaints go to ryan@tokenstoagents.ai. This policy is current as of September 5, 2026.