Data Deletion

Job and resume text is encrypted for a private check. A completed check wipes the ciphertext, initialization vector and authentication tag. Most failures trigger the same wipe immediately.

Paused checks can retain encrypted text. Orphaned input becomes eligible for a stale-input sweep after 15 minutes and all active ephemeral input is covered by the default two-hour expiry.

The restricted row can retain its input type, content hash, byte size and deletion record after the encrypted text is wiped. A time-bound legal hold can delay deletion.

When the free-account feature is enabled, a signed-in user can use Delete my account when that account control is available in the tool flow.

Account deletion revokes active account sessions, deletes the account credential and entitlement records, then marks the account as deleted. The stored passphrase hash and handle credential are removed.

The account row remains as a deleted tombstone with a deletion time. Access-controlled audit records can remain. A legal hold can block deletion.

Joobzi has server code that can revoke an anonymous session and delete or wipe its private inputs, analyses, consent records and event payloads. It records an audit event for the deletion.

There is no public button or approved contact route for this action. Clearing the browser cookie removes the local cookie but doesn't prove that the server-side session data was deleted.

An approved request path and identity-check process are still needed before launch.

Deleting an entitlement-only account doesn't automatically delete the separate anonymous session. These are different records and must be described as separate actions.

Rate-limit, tombstone and audit records can follow different deletion rules. A valid legal hold can delay deletion until it is released or expires.