privacy · v0

What we do with your data

Last updated 30 July 2026

Erfara is run by mrbooz AB, Stockholm, Sweden. We are the data controller for everything on this page. This page describes what our code actually does today. Where something is not built yet, it says so instead of promising it.

Everything here goes through one address: hello@erfara.ai. A person reads it.

The short version

This website loads nothing from anyone else. No analytics, no tracking pixels, no advertising, no cookies.
We hold very little. If you joined the waitlist, we have your email address. If you use the app, we hold what you build and a pseudonymous device id — not your name, unless you publish a Work Story.
One thing is public on purpose. A published Work Story carries your real name, links to your repository, and can be found by search engines. It stays up until you ask us to take it down.
There is no self-serve privacy button yet. Every request is email, and a person does it by hand.

The waitlist

When you type your email on the front page

Collected: Your email address, the user-agent string your browser sends with the request, and the time you signed up. Those three fields, and nothing else. The form sends only your email address; the user-agent comes from your browser automatically.
Why: To write to you once, when a cohort opens.
Lawful basis: Consent. You typed it in and pressed the button. You can withdraw it at any time by writing to us.
Kept: Until you ask us to remove it, or until we stop running a waitlist. We have not set an automatic deletion schedule, so nothing expires on a timer.
Shared with: Nobody outside Google, who hosts the database for us. It is not sold, rented, or passed to recruiters.

The app on your device

Your progress, and an anonymous device id

On your device: The app keeps its state on your phone: your progress through all forty days, your profile, and what you have written. There are no accounts in this build — sign-in exists in the code but is switched off, and creates nothing on our side.
The device id: The app generates a random id the first time it runs, stores it on your device, and sends it with every call to our backend. It does not contain your name or your email. It does link your calls to each other, so under GDPR we treat it as personal data rather than as anonymous.
Why: To keep your repository, your Work Story and your usage limits attached to you when there are no accounts.
Lawful basis: Necessary to provide the service you asked for.
Kept: The device id appears in our records for as long as those records exist. Deleting the app removes the copy on your device but not the records already on our side — for those, write to us.

The AI colleagues and the code review

What leaves our servers and reaches the model

Sent: What you type to a colleague, up to the last 16 messages of that conversation for context, and your profile — which includes the name you gave the app. For a code review, the real diff of your pull request. For a design review, the text of your deployed page with the markup stripped.
Who receives it: Anthropic, in the United States. They are the only model vendor in this product. There is no second one.
Why: The colleagues, the code review and the design review do not work without it.
Lawful basis: Necessary to provide the service you asked for.
Kept by us: The conversation code writes nothing to our database. We do not keep a transcript of what you say to your colleagues. What Anthropic keeps is governed by their own terms, not ours.

Treat a conversation with a colleague like a message to a company you do not work for. Do not paste anything into the app that you would not want a third-party vendor to process.

GitHub

The repository is yours, in your account

What happens: You connect your GitHub account. We create a repository from a template in your own account, and it is created public. We also try to switch on GitHub Pages for it; if that fails, the app says so rather than pretending it worked.
What we store: The repository name and id, your GitHub username, the Pages URL, whether our GitHub App is installed, and when this happened. Your GitHub access token is never written to our database. It is used for the provisioning call and then dropped.
What we then do: Through a GitHub App, we file issues, open pull requests and post review comments in that repository. Because the App acts as itself, GitHub records the App as the author of those comments — your Work Story says so on its face.
Public by default: The repository is public, so its contents, its history and your GitHub username are visible to anyone. That is the point — the record is what you show an employer — but you should know it before you start.
Lawful basis: Necessary to provide the service you asked for.

A published Work Story

Read this one properly. A published Work Story is a public web page. It carries the real name you put on it, in the page heading and in the browser tab. It links to your public GitHub repository, which exposes your GitHub username. It can include highlights in your own words, including text you wrote about yourself.

Where it lives: We render the page and store it, and serve it at a hard-to-guess address of the form /s/ plus ten random characters.
Search engines: A published Work Story carries no instruction to search engines not to index it. A draft preview does, and a draft is never stored — but once you publish, assume the page can be found and indexed. We would rather tell you that than let you discover it.
The numbers on it: Commits, pull requests opened, pull requests merged and issues closed are recomputed by our server from your public repository. A count sent by the app is ignored, so the figures cannot be inflated from the client.
Lawful basis: Consent. Nothing is published unless you publish it.
Taking it down: There is no unpublish button. There is no deletion endpoint in our code at all. Write to hello@erfara.ai and a person removes the stored page by hand. Until we do that, it stays online. We aim to do it within a few working days, and we will confirm when it is gone. Copies already made by search engines or by anyone who saw it are outside our control.

Introduction requests from recruiters

If a recruiter asks to be introduced to you

Collected: Which Work Story it concerns, the recruiter's name, company and email address, their note, the user-agent of their browser, and the time.
What happens next: No email is sent. Nothing in this product can send email — there is no mail software in it. The request is recorded so that a person can route it. It is not delivered to you automatically, and today you do not see it unless we tell you.
Lawful basis: Our legitimate interest in operating the introduction service, and the recruiter's own decision to send it.
Kept: Until the request is dealt with or you or the recruiter asks us to delete it. No automatic schedule.

The employer screen page

Today: The form on our screen page is not wired to a working endpoint. What you type there reaches our host as a web request and lands in ordinary server logs, but no record is created, nothing is filed in anybody's repository, and nobody is contacted. The page tells you the same thing.
When it works: It will store the employer's name, company and work email, the task and its acceptance criteria, and the candidate's repository — and a candidate is shown the whole payload and can decline before any of it moves. We will update this page before that goes live, not after.

Our internal record

We keep an append-only log of events — a repository was provisioned, a Work Story was published, an introduction was requested — so that we can tell the truth later about what happened. It is how we keep our honesty guarantees checkable rather than rhetorical.

That log is not anonymous. Entries can contain your device id, your repository name, your GitHub username, a Work Story address and a recruiter's company. We also keep small counters for usage limits and spend, keyed to your device id or your repository, and a record of GitHub's webhook deliveries.

Who else touches your data

Three companies, and no others:

Google — Firebase Hosting, Cloud Functions and Firestore. They host this website, run our code and store our data. Our code and our database both run in Google's europe-west1 region, in Belgium. Google may still move data between regions for its own operations, so we say where we put it rather than promising where it stays.
Anthropic — the model behind the colleagues, the code review and the design review. In the United States. Their commercial terms, which are the ones that apply to us, say plainly: “Anthropic may not train models on Customer Content from Services.” What you write to your colleagues does not train a model.
GitHub — your repository, and the issues, pull requests and review comments in it. In the United States.

Because Anthropic and GitHub are US companies, your text leaves the EU when the app calls them. We rely on the data-processing terms each of them publishes for business customers. That arrangement has not yet been reviewed by a lawyer, and we would rather say so than imply a guarantee we have not checked.

Our host records ordinary web-server logs for requests to this site, which include IP addresses. We do not use them for analytics, because we do not do analytics.

What we do not do

There is no analytics, no tracking pixel, no advertising and no tracking cookie anywhere on this website or in the app. These pages set no cookies and store nothing in your browser. Every font is one already on your device; no page here loads a script, a stylesheet, an image or a font from any other domain.

That is a description of what we built, not a promise enforced by a header. We have not yet set a Content-Security-Policy on this site, which would turn it from something you have to take our word for into something your browser enforces. It is on the list.

We do not sell your data. We do not share it for advertising. We do not profile you.

Security, told straight

Our database rejects every direct read and write from a browser or an app. Everything goes through our own server code.
Your GitHub token is never stored.
The recruiter console is behind an invite code. That code is an invite gate, not a security boundary, and we are not going to describe it as protection. Do not treat anything in the recruiter preview as confidential.
A published Work Story is public to anyone with the address. The address is random, but it is not a password.

Your rights, and how to actually use them

Under GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for your data in a portable form. You can withdraw consent at any time.

There is no self-serve route for any of this yet. There is no account page, no export button and no delete button, because there are no accounts. The route is email, and a person does the work by hand.

Write to hello@erfara.ai and say what you want. It helps if you include the email address you used for the waitlist, or your Work Story address, or your GitHub username — those are the three things we can look you up by. We do not otherwise know who you are.

We answer within one month, as the law requires, and usually much sooner. If we cannot do what you asked, we will tell you why rather than let it go quiet.

One honest limit: because there are no accounts, we cannot always prove that the person asking is the person whose data it is. For a waitlist entry we will act on a request from that email address. For a Work Story or a repository we may ask you to show control of the GitHub account or the address the story was published from. This is to stop somebody else taking your page down.

If you are not happy with us

Tell us first, at hello@erfara.ai. If that does not resolve it, you have the right to complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), or to the authority in the EU country where you live.

Changes to this page

When what the product does changes, this page changes with it, and the date at the top moves. We will not quietly widen what we collect and leave this text behind.

Not yet reviewed by a lawyer

This page was written against the source code, by the people who built it. It has not yet been reviewed by a Swedish lawyer. We think it is accurate, and we would rather publish something true and plain now than nothing until it has been through counsel. If you find a sentence here that does not match what the product does, write to us and we will fix it.