Privacy

Northlight helps you rank job postings against criteria you wrote yourself, and keeps your search in one place. To do that it holds some fairly personal things — your resume, and your own words about the work you want. This page says what it holds, who else sees it, and how to make it go away.

Northlight is operated by Brandon Bomberger, an individual in the United States. Reach us at bomberger1705@gmail.com.

What Northlight collects

• Your account. Your email address. If you sign in with Google, we receive your email address, name, and profile picture from Google — nothing else. Northlight does not ask for access to your Gmail, Drive, Calendar, or contacts, and cannot read them.
• What you say during setup. The setup conversation is an interview, and your answers are stored word for word. That is deliberate: the criteria Northlight ranks with are sentences you said, and they are quoted back to you rather than paraphrased.
• Your resume, if you upload one. The file itself, plus the text read out of it.
• What you save as you go. Jobs you keep, people you add, applications, notes, and drafts.
• Ordinary technical records. Server logs kept by our hosting provider, and the cookies that keep you signed in.

What it is used for

Running Northlight for you: ranking postings against your criteria, finding publicly listed people at companies you are pursuing, drafting messages and cover letters, and keeping your search organized. We also use it to keep the service working — fixing bugs, preventing abuse.

Nothing is ever sent on your behalf. Northlight drafts outreach and applications and shows them to you. It does not email anyone, does not submit applications, and has no ability to. A draft stays a draft until you send it yourself, from your own account.

We do not sell your information, we do not share it for advertising, and we do not show your resume, your answers, or your activity to employers, recruiters, schools, or other users. Anything you paste in stays yours alone — it is never served to another Northlight user.

Who else touches it

Northlight is a small operation built on a few well-known services. Each one below receives data because it has a job to do:

• Supabase — the database and the private file storage your resume lives in, hosted on Amazon Web Services in Oregon, USA.
• Vercel — hosting for the site itself, in the United States.
• Anthropic — the Claude models that conduct the setup interview, score postings, and write drafts. Your interview answers, your resume text, and the postings being scored are sent to Anthropic's API to do that. Northlight uses Anthropic's commercial API, under which inputs are not used to train their models.
• Resend — sends the sign-in email. It sees your email address and nothing else.
• Google — only if you choose to sign in with Google.

Beyond those, we disclose information only when the law requires it, or if the product is ever sold or transferred — in which case this policy travels with it and you would be told first.

Cookies

Northlight sets cookies to keep you signed in, and that is all. There is no advertising network, no analytics tracker, and no third-party pixel on this site. If that changes, this page changes with it.

How it is kept

Resumes live in a private storage bucket that is not publicly addressable; the app reads them through short-lived signed links, and checks that the file belongs to you before it does. Every table that holds your data is scoped to your account, both by database policy and in the application's own queries. Traffic is encrypted in transit. No system is perfect, and we will not pretend otherwise.

Keeping it, and deleting it

Your data is kept while your account exists. Email bomberger1705@gmail.com from the address you signed up with and ask, and your account, your answers, your rubric, and your uploaded resume are deleted within 30 days. Copies may sit in encrypted backups for up to 30 days after that before they roll off. You can also ask for a copy of what we hold, or for a correction.

If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, and we never have. Exercising any of the rights above costs you nothing and changes nothing about how you are treated.

Who this is for

Northlight is offered in the United States and is not intended for people under 16. It is not directed at children, and we do not knowingly collect information from them.

Changes

If this policy changes, the date below changes. If a change matters — new kinds of data, a new company receiving it — we will email you before it takes effect. This policy is effective August 30, 2026.