Last updated: 13 October 2026
Shortlist is a free Windows app made by Bishoy Raafat (“I”). This page explains, in plain language, what data the app handles and where it goes.
The short version:
Everything you put into Shortlist is stored only on your computer, in %LocalAppData%\ShortlistData:
You can delete all of it at any time from Settings → Privacy & community → Delete all my data, or by uninstalling the app and deleting that folder.
| Where it goes | What is sent | When |
|---|---|---|
| Job sites (e.g. Adzuna, Arbeitnow, Remotive, company career pages; LinkedIn/Indeed via JSearch if you add that key) | Your search words, locations and filters | When you search |
| Groq (AI provider, only if you add your own Groq key) | The CV, portfolio and job text needed for the AI feature you use (reading your CV or portfolio, fit checks, letters, CV tailoring). Links are sent without tracking parts | When you use an AI feature. Groq’s own privacy policy applies |
| Portfolio sites you add (e.g. Behance, GitHub, your own site) | A normal page request, the same as opening the page in a browser | When Shortlist reads your portfolio |
| Shortlist community server (runs on Cloudflare) | An anonymous install id: a random number, with no name, email or device details | Once, when the app first starts |
| Your country, which Cloudflare works out from your connection. It only goes into daily totals, such as “3 new installs from Egypt” or “40 hours of Shortlist being open in Germany”, and is never stored with your install id or anything else about you | When the app first starts, and with its hourly check while it is open | |
| Scam and ghost-job reports you make: company name, website domains, job title, link (without tracking parts) and the reason you typed | When you report a job | |
| Feedback you send: your message and its type, plus your email and name only if you type them, the app version, your Windows version, and only if you tick them a picture of the Shortlist window and recent app logs (emails, keys and your Windows user name are removed from logs first) | When you press Send | |
| Anonymous feature counts, e.g. “deep search used” or “cover letter written”. Never content | Only if you switch on “Share anonymous usage” | |
| Nothing about you: the app downloads the community list, this week’s community numbers and a small signed settings file (announcements, the minimum supported version) | A few times a day | |
| Only if the app finds that its own code files were modified by someone else: the app version and a short fingerprint of the modified files | Once per version | |
| Sentry (crash reporting) | Technical error details with personal information removed | Only if you switch on “Send crash reports” |
| GitHub | A check for app updates (GitHub version only) | Every few hours |
| Microsoft Store | Updates for the Store version, handled by Windows | Managed by the Store |
The community server also stores a scrambled code for the network you connect from (your internet provider’s address range) and for your internet provider. Both are made with a secret key that only the server has, so they can’t be turned back into a network or an address. Your IP address itself is never stored. They are used only to limit spam and to make sure one person can’t flag an employer alone. The network code is removed from your install record after 30 days.
The server also keeps daily totals of the requests it receives, for example how many update checks or rejected requests arrived. They help me spot problems and abuse, and they contain no install id, network or address.
Feedback is emailed to me through Resend (an email service) and kept on the community server so it isn’t lost. If you left your email, I use it only to reply to you. It’s never added to a mailing list or shared.
Shortlist is meant for job seekers aged 16 and over.
If this policy changes, the date at the top changes, and the release notes for that version mention it.
Use the Feedback page in the app, or open an issue on GitHub.