Privacy Policy

Draft revision October 8, 2026

1. Who we are

scrubs.careers LLC, a California limited liability company (“scrubs.careers,” “we,” or “us”), operates the scrubs.careers website and career platform. Questions or privacy requests may be sent to legal@scrubs.careers.

2. Information we handle

Account and profile: identifiers supplied through our sign-in provider; your name, professional title, specialties, location, career goals, profile photo, and profile preferences.
Career materials and compensation: résumés and other files you upload; information you enter for career tools; voluntary pay reports, including role, location, experience, base pay, and other compensation.
Community and communications: connection requests, posts, photos, comments, reactions, messages, blocks, reports, and inquiries submitted through our contact form.
AI and voice features: prompts, résumé text used for analysis, interview answers and transcripts, generated feedback, and voice audio processed during voice sessions. Our app stores interview text and feedback; voice-service providers may handle audio under their own terms.
Payments: subscription status, plan, Stripe customer and subscription identifiers, invoices and purchase records. Stripe processes payment details; we do not request full card numbers in our app.
Use of the service: member activity, device and referral information, session and network activity, security logs, and other technical data needed to operate and understand the platform. Where analytics are enabled, page views and interactions may also be measured.

3. How we use it

We use this information to create accounts and profiles; show jobs and career tools; process subscriptions; connect members and deliver messages; provide AI and voice features; respond to support and privacy requests; detect misuse and maintain security; understand product usage; and meet legal obligations. Compensation reports may contribute to aggregated comparisons that are not presented as individual reports.

4. Visibility and sharing within the service

Member Discovery is enabled by default for new members. Your profile can appear to other signed-in members after you choose a public display name; your account or billing name is not automatically used as that public name. You can turn off “Appear in Member Discovery” in profile settings to keep your profile out of Discovery. Existing members retain their current discovery setting. Posts are shared with accepted, unblocked connections under the current network rules. Messages are shared with their conversation participants. Reports may be reviewed by authorized administrators. A blocked or disconnected person loses access to content under the platform's current visibility rules, but copies or information previously seen by others cannot necessarily be recalled. When you follow a job link to an employer, that employer's site has its own privacy practices.

5. Service providers

We use providers to run specific parts of the service. They receive information relevant to those functions:

Clerk: account creation and authentication.
Stripe: checkout, subscriptions, payments, and billing records.
Replit: hosting, database and file storage, and connected-service infrastructure.
OpenAI: processing text submitted to AI career and résumé tools.
Deepgram: speech transcription and live AI voice conversations.
Umami: website and product analytics, when enabled.
Resend: delivery of messages submitted through the contact form and related email functions.

We may also disclose information where required by law or necessary to protect rights and safety. Each provider’s own notices describe its processing and retention. Some may process information outside your location.

6. Cookies, analytics and security

Authentication tools help keep you signed in and support the operation of the service. The site also uses a sidebar preference cookie (up to seven days), a requested pricing-country preference cookie (up to 180 days), and browser session storage for temporary interface choices. Approximate pricing location is resolved using a local country-IP dataset; it is not proof of tax residence.

Our website's own optional Umami product events require explicit browser permission. The Privacy choices control on this page and in Account privacy lets you allow, refuse or withdraw that permission without restricting your account. The preference is stored in this browser's local storage for up to 180 days; unknown, expired or unreadable preferences keep these events off. Do Not Track and Global Privacy Control signals also keep them off. This control does not govern hosting-injected page-view analytics, infrastructure logs, essential authentication, billing, requested platform features or native SDKs. Hosting-level analytics requires a separate configuration review; we do not claim that this control blocks every analytics technology.

We also keep aggregate daily totals of successful public-page HTML requests received by our web server to understand usage and improve the website. This counter stores only the UTC day, an allowlisted public-page path and its total. It does not store individual visit records, browser or session identifiers, account information, IP addresses, referrer information, device information, query strings or page content, and it does not send a browser tracking request. Totals are kept for 30 days. They are not unique-visitor counts or counts of every click; reloads can count again, and in-app navigation and requests served entirely from a cache are not counted. Known bots and prefetches are excluded where detectable. Do Not Track and Global Privacy Control request headers disable this counter. You can also exclude future requests from your browser using the request-count control on this page; only your on/off choice is saved in a preference cookie for up to 180 days. This counter is separate from optional product events, hosting analytics and infrastructure logs.

You can also manage cookies in your browser, though disabling sign-in cookies may prevent account features from working. We use access controls for member data, but no online service can guarantee absolute security. Please do not submit patient information or other highly sensitive information to career tools, messages, or contact forms.

7. Retention and your choices

We retain information according to its purpose and record type, rather than applying one period to everything. The periods below describe our current record-specific practices and operational targets for information we control. A target is not a guarantee of instant removal from backups or a provider’s systems. We have not confirmed a fixed deletion or backup-expiration period for every service provider; provider-held information follows the applicable provider terms and settings.

Record type	Retention approach
Account, profile, preferences, and career materials	Kept while the account is active. When self-service account deletion succeeds, the active account record and located account-linked private uploads are removed as part of that operation. Any remaining account-linked copies in other active application systems are reviewed for removal, with an operational target of 30 days where feasible and subject to legal and security exceptions.
Posts, photos, comments, messages, connections, and reports	Kept while needed to provide the community, safety, and moderation features. Following successful self-service account deletion, our operational target is to remove or de-identify associated account-linked records within 30 days where feasible. Copies already received or retained by other participants, and records needed to investigate abuse or meet legal duties, may remain.
Résumé coaching, interview answers, transcripts, and generated feedback	Application-stored content is kept while the account is active. Following successful self-service account deletion, our operational target is removal of any remaining associated content from active application systems within 30 days. Voice audio is processed by voice providers; we do not represent that it is stored by our application or that a provider deletes it on this schedule.
Salary reports and member-linked activity	Member-linked reports and activity are kept while needed to provide reporting and service features. Following successful self-service account deletion, our operational target is removal of remaining identifiable account-linked records within 30 days. A statistical output may remain only when it no longer identifies or can reasonably be linked to you.
Billing, subscription, and payment records	When self-service account deletion succeeds, any recurring subscription is canceled immediately. We keep the limited account-linked billing records needed to reconcile transactions and address disputes; Stripe separately processes payment and billing information. Applicable accounting, tax, fraud, and dispute requirements may require specified records to be retained after account deletion for the period required by law or an active claim. Account deletion does not automatically refund unused paid time.
Authentication identity and sessions	Clerk holds account credentials and sign-in records while your account is active. When self-service account deletion succeeds, the Clerk identity is deleted and sign-in access ends. Clerk may retain restricted security or compliance records under its applicable terms; we do not promise a fixed provider purge time.
Website analytics	Aggregate public-page request totals are kept for 30 UTC days and removed by scheduled hourly cleanup. The retired opt-in browser tracker no longer receives views; any previously collected pseudonymous observations expire under their original 30-day retention and are not mixed into request totals. Old browser traffic identifiers are cleared when the updated app loads. Separate optional Umami events follow the analytics provider configuration; a fixed Umami retention period has not been verified. For provider events that can reasonably be linked to your account, we review deletion where supported following successful self-service account deletion.
Security records and privacy-request case records	We limit these records to operational or compliance needs. As operational targets, routine security records are reviewed for deletion after 12 months, and a minimal privacy-request case record is reviewed for deletion 3 years after closure. A legal hold, unresolved dispute, or other legal requirement can extend retention; these targets do not establish a provider log-retention period.
Temporary upload objects and backups	Uncompleted upload records carry an expiration time and are intended to be cleaned up after expiry. When self-service account deletion succeeds, located account-linked active private objects are deleted as part of that operation. If deletion cannot finish, the profile is hidden while the operation can be retried. Backup copies may persist until the applicable backup cycle completes; we do not state a fixed backup purge interval here.

Operational targets above are internal service targets, not representations of provider retention.

Replit hosts our application, database, and object storage; Clerk provides authentication; Stripe handles billing; OpenAI and Deepgram process AI and voice requests; Umami may receive analytics events; and Resend delivers contact-form email. Their retention, deletion, and backup practices depend on their applicable terms, configurations, and service records. We have not confirmed a universal provider-specific TTL.

We will make a request to a provider where appropriate and available, but cannot promise a provider’s deletion time.

You can update parts of your profile and remove certain posts, photos, and compensation reports through available controls. Signed-in members can delete their account through self-service, even without an active paid membership. When the operation succeeds, the active account record and located account-linked private uploads are erased and sign-in access ends. If the operation cannot finish, the profile is hidden and you can retry; we do not represent an unsuccessful attempt as completed.

Deletion does not necessarily erase information retained for legal, security, accounting, or dispute-resolution reasons, or copies held by service providers and in backups.

For access, correction, export, deletion without account access, or other privacy questions, email legal@scrubs.careers. Send the request from the email address associated with your account when possible and identify the request type and account email; do not email passwords, payment-card details, or identity documents.

If you cannot use that address, tell us and we will offer a reasonable alternative verification method. We may ask for limited additional information needed to verify authority and locate records. These other requests are reviewed manually, subject to applicable exceptions.

We acknowledge and respond within the time required by applicable law. We may need to clarify a request or verify your identity before acting.

We assess each record for applicable exceptions, including legal obligations, accounting, security, fraud prevention, dispute resolution, and legal holds. If an exception applies, we will explain what we can, retain only the information needed for that purpose, and limit access. Deleting information from our systems may not erase copies held by recipients or providers. Privacy rights and applicable response periods vary by location.

8. Children and policy changes

The platform is intended for adults aged 18 or older. If you believe someone under 18 has submitted information, contact us at legal@scrubs.careers. If we change this policy, we will post the revised version and provide any additional notice required by law.

Public-page request totals

Optional product analytics