Privacy Policy

Summary

1. What you publish

When you publish a report, everything you enter becomes public on the site: the company, role, level, location, how you applied, the stages you reached, the outcome, dates, numbers such as rounds and hours, pay figures, the issues you selected, your rating and your written account. Reports are shown as “Anonymous candidate.”

Please don’t include information that identifies you or anyone else. See Anonymity in the Terms of Use.

When you corroborate a report (“Happened to me too”) or flag one, we store that action. Flags, including any details you write, are visible only to the site owner.

2. Technical information we collect

To prevent abuse and to count visits, we collect:

• A random browser ID. Your browser generates a random code the first time you visit. It isn’t linked to your name or any account. It lets you corroborate a report only once and lets us count unique visitors.
• A salted hash of your IP address. Your IP address is converted into a one-way code that can’t practically be reversed. We use it for rate limits, such as how many reports one address can publish per hour, and to stop password guessing on the owner dashboard. We never store the IP address itself.
• Visit records. The section of the site you viewed, the time, the domain of the site that referred you (for example, reddit.com, not the full address), your country as estimated by our hosting provider, and whether you used a phone, tablet or computer.
• Presence. While a page is open, it checks in about every 30 seconds so the site owner can see how many people are on the site right now.

We don’t use fingerprinting, and we don’t record what you type unless you publish it.

3. Information stored on your device

Left on Read doesn’t set cookies. It uses your browser’s local storage for:

• your random browser ID;
• a private token for each report you publish, so you can delete it later from the same browser;
• your Ghost Clock entries, which never leave your device;
• your light or dark theme preference.

Clearing your browser’s site data removes all of this. If you do, you’ll no longer be able to delete reports you published from that browser.

4. How we use information

• to publish reports and calculate the statistics shown on the site;
• to prevent spam, abuse and attacks, including rate limiting;
• to review flagged reports;
• to understand overall traffic, such as visitors per day and referring sites, so we can run and improve the site.

We don’t use information to build profiles of individuals, and we don’t make automated decisions about you.

5. Who we share information with

We don’t sell, rent or trade information. We use these service providers to run the site:

• Vercel hosts the website. Like any web host, it processes your IP address and browser details to deliver pages, and it provides the country estimate described above.
• Vercel Web Analytics counts page views, the pages visited, the referring site, and the country, browser and device type. It uses no cookies and does not store your IP address or follow you across other websites.
• Neon provides the database that stores reports and the technical information above.
• Google Fonts serves the typefaces. When your browser downloads them, Google receives your IP address and browser details under its own privacy policy.

We may also disclose information we hold if the law requires it, or to protect the safety of people or the security of the site. Because we don’t collect names, emails or IP addresses, we hold very little that could identify anyone.

6. How long we keep information

• Reports, corroborations and flags: until the author deletes the report or we remove it.
• Visit records: deleted automatically after 13 months.
• Presence check-ins: deleted automatically after one day.
• Owner-dashboard login attempts: deleted automatically after 30 days.
• Rate-limit checks use the records above and add nothing new.

7. Your choices and rights

Because there are no accounts and we don’t store names, emails or IP addresses, we usually can’t tell which records belong to you. You can still:

• delete any report you published, using “Delete my report” in the same browser;
• remove a corroboration by selecting “Happened to me too” again;
• clear your browser’s site data to remove your browser ID and local settings;
• use a content blocker, since the site works without visit tracking.

Depending on where you live, you may have rights to access, correct or delete personal information, or to object to its use. To make a request about a specific report, use “Flag report” on it. For other requests, see Contact.

8. Security

The site is served only over HTTPS. Database connections are encrypted, the database is accessed only through parameterized queries, and the pages use a strict Content Security Policy. IP addresses are hashed with a secret value, and deletion tokens are stored hashed. No system is perfectly secure, but we work to protect the limited information we hold.

9. Children

Left on Read isn’t intended for anyone under 16, and we don’t knowingly collect information from children. If you believe a child has published a report, please flag it.

10. International visitors

Left on Read is run from the United States, and our service providers may process information in the United States and other countries. By using the site, you understand that your information may be processed outside your own country.

11. Changes to this policy

If we change this policy, we’ll update the date at the top of this page. If a change significantly affects how we use information, we’ll also note it on the homepage.

12. Contact

Dedicated contact details will be added to this page. Until then, please use “Flag report” on the relevant report to raise a privacy concern about it.