Privacy

HouseEdge is a casino-industry job board. It shares infrastructure with JunketClub, a separate service run by the same operator, but it is a separate product with its own database, its own accounts and its own sign-in.

A HouseEdge account is not a JunketClub account. Nothing you enter here appears there, and no JunketClub user can see a HouseEdge profile, CV or application. JunketClub's privacy policy does not describe this service and does not apply to it — this page does.

When you create an account:

• your email address and your first and last name
• your password, stored only as a bcrypt hash — we never hold the password itself and cannot recover it
• whether your email has been verified, and when you last signed in

If you use HouseEdge as a candidate, your profile may also hold whatever you choose to add: a headline, a summary, country and city, a phone number, years of experience, skills, languages, a desired salary range, a LinkedIn URL, and a CV file with its original filename and upload date. All of these are optional. The account itself needs only an email and a name.

When you apply to a listing we store the application: which listing, when, its status, your cover letter if you wrote one, and the CV that was on your profile at the time. Replacing your CV later does not change what an employer already received — they keep the version you sent. Deleting your CV removes it everywhere, including from applications you already sent. The employer may also attach a private note to your application — a comment written by them, about you. You can ask us for a copy of those notes.

If you use HouseEdge as an employer, we store your company profile and your listings. These are business details, not personal data, apart from your own account. If your company opens a candidate's CV from candidate search, we record that it did and when, and show that record to the candidate — see below.

Our servers keep request logs that include IP addresses. We use them to operate the service, to enforce the sign-in and registration rate limits, and to investigate abuse. We are not going to claim a retention period we do not yet enforce automatically: today they are removed when we rotate them, and putting a fixed limit in place is outstanding work.

What changed on 24 October 2026: new candidate profiles are discoverable by default, and candidates can let employers who find them open their CV. Both are switches, shown when you sign up and in your profile. If you registered before 24 October 2026, nothing changed for your account: your settings are as you left them.

Your CV is treated as the most sensitive thing on this service, and it is handled accordingly.

• It is stored in a private bucket. It has no public URL, and guessing one is not possible — files are addressed by an internal key that is never sent to a browser.
• It is released only as a signed link valid for five minutes, and only after we have checked that the person asking is entitled to it.
• An employer can open it in two cases: for a listing you applied to, or — only if you turned on "Let employers who find me open my CV" and your profile is discoverable — after finding you in candidate search.
• It never appears in a list — of applicants or of search results. Only opening a single application, or a single candidate who allows it, can produce a link to it.

New candidate profiles are discoverable by default: the switch is shown, already on, when you sign up, and you can turn it off there or at any time in your profile. Profiles created before 24 October 2026 keep the setting they had.

While it is on, employers can find you in candidate search and see your first name and the first letter of your last name, and what you put on your profile: your headline, summary, location, years of experience, skills, languages and the salary you are looking for. A profile appears in search only once it has a headline. They do not see your email address, your phone number or your LinkedIn — search results carry none of them. Whether employers can also open your CV is a separate switch. It is on by default for profiles created from 24 October 2026 and off for earlier ones, and it does nothing while you are not discoverable.

Every time an employer opens your CV from search, we record which company and when, and show it to you in your profile — under the name the company had at that moment, together with the name it has now and whether we have verified it. We keep that record for 12 months. Each company can open the CVs of at most 40 different candidates a day, and open CVs from search at most 200 times a day.

Turning either switch off takes effect at once for every new request. A link an employer was given a moment before stays valid for the rest of its five minutes, and a copy an employer has already downloaded is beyond our reach — the same as for a CV you sent with an application.

An employer who finds you can send you one invitation per listing, asking you to apply. It reaches you by email, it names the listing, and it may carry a short note from them. It is not an application and it changes nothing about your account — you read it and decide. Turning discovery off stops you appearing in search, stops invitations with it, and means employers can no longer open your CV from search.

When you apply, the employer sees your name, your profile, your cover letter and your CV. They do not get your email address. Replies happen in a conversation inside HouseEdge, attached to the application it is about, and that conversation is the only channel we give them.

Either side can attach a file to a message — a PDF, a Word document or an image, up to 10 MB. Those files are handled exactly like a CV: stored in the private bucket, addressed by an internal key that never reaches a browser, and opened only through a link that expires after five minutes, issued only to the two people in that conversation. We check what a file really is by reading its first bytes rather than trusting its name. We do not scan attachments for malware, so treat a file from someone you do not know the way you would treat one that arrived by email.

We would rather be exact than reassuring about what that buys you: it stops addresses being collected in bulk, one per application, by anyone who can post a listing. It does not make you uncontactable — most people put a phone number or an address on their CV, and an employer you applied to, or one who found you in search if you allow it, can legitimately open it and read them. They get the file exactly as you uploaded it. If you would rather not be reachable that way, leave contact details out of the CV, or keep the CV switch off.

Applying starts a conversation, which means the employer can write to you first. Anything either of you writes is stored until the application is deleted.

• To run the service you asked for — an account, a profile, applications you send, listings you post. This is performance of a contract with you.
• To show your profile, and your CV if you allow it, to employers searching for candidates — part of the job-search service you signed up for, and our legitimate interest in connecting candidates with employers. You can object at any time by turning either switch off. The record of which companies opened your CV is kept so that you can see who received it.
• To keep the service usable and safe: rate limits, abuse prevention, and the logs that make both possible. This is our legitimate interest.
• Optional profile details and your CV are there because you chose to add them, and you can remove them at any time.

One precision about the second of those: sign-in and registration rate limits are counted per visitor, using the address your request arrives from. That address is the only thing they use — it is not tied to your account and nothing else is derived from it.

We also keep an internal log of the decisions taken on the service — moderating a listing, suspending an account, deciding a refund, granting a plan by hand — with which staff account took them and when. Keeping it is our legitimate interest in being able to answer for a decision later. It may name your account as the one a decision was about. When an account is deleted, its email address and IP address are removed from that log; the decisions stay.

We do not profile you, we do not make automated decisions about you, and we do not sell or share your data with anyone for advertising.

Paid plans are sold through Paddle, which is the merchant of record — the seller in the transaction, not a payment gateway we operate. The purchase is a contract between you and Paddle, and Paddle is responsible as a controller in its own right for the payment data it collects. It publishes its own privacy policy for that part, at paddle.com.

We never receive your card details. The checkout is Paddle's, it runs inside Paddle's own frame, and no card number, expiry date or security code passes through our servers or is stored by us at any point. The same is true of the billing address and tax identifiers Paddle asks for — you give those to Paddle, not to us.

What we store about a purchase is what the service needs to know which plan is in force:

• which plan you are on, monthly or yearly, when the current period started and ends, its status, and whether a cancellation or a change of plan is scheduled
• the identifiers Paddle gives us for your customer record and your subscription, which are how the two systems recognise the same subscription
• if you ask for a refund: what you wrote as the reason, the amounts involved, our decision and the reason for it, who decided and when, and what the provider answered

The reason you write on a refund request is read by the person deciding it, and it is kept with the request as the record of why the decision went the way it did — until your account is deleted, when that text is erased.

The legal basis for all of this is performance of the contract with you, and, for keeping the record of what was charged and refunded, our legal obligation under accounting and tax law. That last one is why billing records outlive an account: when you delete your account the profile and the files go, but the record that a payment happened is detached from the account and kept for 5 years, then deleted.

The database and uploaded files live on our own servers in Germany. File storage is self-hosted on the same infrastructure rather than handed to a storage provider.

Six third parties are involved, each for one job and each getting only what that job needs:

• Cloudflare — nightly backups are copied to R2 object storage: the database and a mirror of uploaded files, CVs included. It is the only third party that holds a copy of the whole dataset. Those copies are encrypted at rest by Cloudflare; we do not add a layer of our own on top, and we would rather say so than let the word carry more weight than it earns.
• Resend — sends the notification email described below. It receives the address the message goes to and the message itself.
• Paddle — sells the plans, as described above. It receives what you type into its own checkout; from us it receives only the plan being bought and the identifiers tying it to your subscription.
• Sentry — receives a report when something breaks: the error, the page or endpoint it happened on, and the kind of browser or server it happened in. What it is deliberately not given is the content you were working with. Request bodies are dropped, the values in a web address are replaced before the report is sent, and an email address appearing in an error message is redacted. There is no session recording: nothing reconstructs what was on your screen. It never receives a CV, an attachment or the text of a message.
• Google and Apple — deliver push notifications to the HouseEdge app, through Firebase Cloud Messaging and, on iPhone, Apple Push Notification service. They receive the push address of your device and the notification itself, which says only that something is waiting. Only if you use the app and allow notifications.
• Google — our support mailbox, support@houseedge.gold, is hosted by Google Workspace. It therefore holds the messages our own staff receive about an account: the notice that a new company has signed up, which names the owner's address and what they entered on their company profile; the notice that a listing is waiting for review; and a refund request, which names the address it came from and the reason written on it. It is the mailbox, so it holds whatever you write to us as well.
• Sentry also receives one thing your browser sends directly, without passing through us: if a page tries to load something our security policy forbids, the browser reports that block, and such a report names the page it happened on and identifies your device by IP address. Three pages are excluded from this entirely — the ones reached from a password-reset, sign-up or account-deletion email — because their address carries a key, and a report could carry it. The key in the account-deletion link is also removed from any error report the page sends.

Beyond those six: no analytics, no advertising or tracking technology, and no marketing tools. Sentry is here to tell us that something failed, not who was using the site.

We do send email now, and only about things that happened to you: a new application on your listing, a final decision on an application you sent, an invitation from an employer who would like you to apply, an unread message waiting for you, a password reset you asked for, a warning that one of your listings is about to leave the board and notice once it has, where a refund you asked for has got to, a warning if we had to sign your account out of the app on a device because its sign-in was used twice, and — if you delete your account — the link that cancels the deletion and a confirmation once the account has been erased. There is no marketing mail. It is sent through Resend, from an address on houseedge.gold. The notification tells you something is waiting; it does not repeat what was written.

Paddle sends its own email about a purchase — the receipt, the invoice, and notice of a renewal. Those come from Paddle because the sale is Paddle's, and they are not something we can switch off for you.

One cookie of ours: `he-refresh-token`, which keeps you signed in. It is set only after you sign in, it is HttpOnly so no script can read it, and it is scoped to this host alone.

There are no analytics or advertising cookies, and therefore no consent banner — there is nothing here to consent to. Your sign-in token itself is held in memory by the page and is gone when you close the tab.

One exception, and it only arises if you open the checkout: doing so loads Paddle's script and opens Paddle's own frame in the page. Anything Paddle stores in your browser at that point is set by Paddle under its own policy, for its own purposes as the seller, and we neither set it nor read it. Nothing on the rest of the site loads it — the script is fetched when you click to buy, not on every page.

The app keeps you signed in without a cookie. On the device it stores an identifier for the installation — a random value it creates the first time it runs, not anything read from the hardware — and a sign-in secret. We store the identifier and a fingerprint of the secret, never the secret itself, with whether it is an Android or an iPhone and when the session started and was last used.

That sign-in lasts until you sign out in the app, or until it runs out. For a candidate it runs out after 90 days without opening the app, or a year after signing in, whichever comes first. For an employer it is 30 days or six months, because an employer's phone holds other people's CVs and messages. "Sign out of all devices" in Account settings, a password reset, a suspension or a deletion request ends it at once. The record of a finished sign-in is kept for 30 days, so the app can tell you why it ended, and is then deleted.

If the same sign-in is used twice — which is what happens when a copy of it has been taken from a device — we end it and email you, at most once an hour. That email says which kind of device it was and nothing more: no IP address, no device identifier, no time of day.

If you allow notifications, the app also registers the device for push. We store the push address Google or Apple gives the device, the installation identifier, the platform, and the app's language and version. A notification says that something is waiting for you — never a name, a job title or what a message says. We keep the registration for no longer than 60 days after you last opened the app, and remove it sooner: when you sign out, when your sessions are ended (a password reset, a suspension or a deletion request), when another account signs in on that device, when the push service tells us the address no longer works, or when your account has more than ten devices.

You can ask us to give you a copy of your data, correct it, delete it, or hand it over in a portable form, and you can object to how we use it.

Some of this you can do yourself: your profile is editable at any time, you can delete your CV from your profile page, which removes the stored file, and you can delete your whole account from Account settings, on this website or in the HouseEdge app. A deleted account stops working at once and is erased 14 days later; until then the link we email you cancels it.

Everything else — a copy of your data, a correction you cannot make yourself, an objection — goes through us. Write to the address below and we will act within 30 days. If you cannot sign in, because you lost access or the account is suspended, deleting it goes through the same address. See the retention page for exactly what happens to each kind of data.

Three limits on deletion worth stating rather than discovering: a record that a payment was taken or refunded is kept for 5 years, detached from the account and without the reason you wrote, because accounting and tax law requires it; our internal log of decisions keeps the decisions but not your address; and for the payment data you gave Paddle directly, Paddle is the controller — we can pass a request on, but the copy held there is answered by them.

HouseEdge is a service for people looking for and offering work, and is not intended for anyone under 16. If you believe a child has created an account, tell us and we will remove it.

If this policy changes in a way that affects what we do with your data, we will change the date at the top and, where the change is material, tell the account holders it affects directly, by email.

Questions, requests and complaints: support@houseedge.gold.