Privacy Policy

Last updated October 17, 2026

Who we are

Vylix Jobs ('we', 'us') is an unofficial aggregator of internship and entry-level full-time tech job listings. We are not affiliated with any of the companies whose listings appear on our site.

If you have questions about this policy or want to request deletion of your data, contact us at privacy@vylixjobs.com

Job listings

We do not scrape personal data. Internship listings come from companies' public job boards and job-listing services. Full-time listings come only from companies' public job boards, never from job-listing services.

Email digest

When you subscribe to our internship digest (daily or weekly, your choice), we collect your email address, the frequency you chose, its subscription status, when it was confirmed or unsubscribed, and which signup form collected it. We don't collect your name or store your IP address, and our emails contain no tracking pixels.

We use this information only to send you the digest of new internships at the frequency you chose, and confirmation emails. The digest covers internships only; full-time listings are never included. You can switch between daily and weekly from any email. Your email is never sold or shared for marketing purposes.

You give us permission to send these emails by confirming your subscription—a double opt-in process: your subscription only becomes active after you open the link in our confirmation email and press the confirm button.

When an address is entered in the signup form, the form says whether that address is already subscribed, is waiting for confirmation, or can't receive our emails. Anyone who enters your address can see this.

To unsubscribe, click the link in any email we send you, including a one-click unsubscribe that mail providers like Gmail offer. It takes effect immediately.

How long we keep it:

Email sending and storage are provided by Resend (sending), Supabase (storage), and Vercel (hosting). These services follow their own privacy practices.

Email alerts for saved searches

If you turn on email alerts for a saved search, we email you when new listings match it, once a day or once a week, as you choose. You can turn one on with the switch on a saved search, or with the “Get alerts for these filters” button on a listing page, which saves that page's filters as a saved search and turns its alert on in one step. An account can have up to ten alerts. Alerts are off by default, and creating an account doesn't turn them on. There is no confirmation email: turning on the switch, or pressing “Email me new matches,” while signed in to an account with a confirmed email address is your consent.

An alert made from a listing page keeps only some of its filters: the listing type and level, Job Family, Industry, major, state, city and Remote. It leaves out any search text, company, season, pay, distance and date filters, and the window says which of those it left out before you save. The window also shows how many matching listings were added in the last 7 days. To count them, your browser sends the alert's filters to our server. We don't store that request or link it to you, and the answer may be cached and given to anyone who asks about the same filters. If you aren't signed in, the window doesn't save an alert or a saved search for you: it either asks you to sign in, or, where it is open, offers an alert by email without an account (see the next section).

For each alert we store whether it is on and how often it is sent, when you turned it on, which version of the consent flow you saw (which also says whether you turned it on from a saved search or from a listing page), and the email address it was turned on for. We also store when it was turned off (if it has been), when we last checked the search and last emailed you, how many listings that email had, and the result of the last check. Deleting a saved search deletes its alert.

Your account also has email settings: whether you have turned off alert emails or stopped all email, and when you did so, plus the date of the last alert email we sent you. Each account has a random unsubscribe token, used only in the unsubscribe links in alert emails. The token can only turn email off.

Alert emails are sent through Resend, the same provider as the digest, from an address at alerts.vylixjobs.com. Like the digest, they contain no tracking pixels and no click tracking.

To stop an alert, use the one-click unsubscribe that every alert email has, or a link in its footer: stop that alert, stop all alert emails, or stop all email from Vylix Jobs. You can also turn alerts off on the Alerts page or in Settings while signed in. Stopping all email also unsubscribes the email digest for your account's confirmed email address. Sign-in codes still arrive, because you asked for them. Unsubscribing from the digest doesn't stop alerts, and stopping alerts doesn't stop the digest: they are separate choices.

If an email to an address bounces permanently or is marked as spam, we keep a suppression record: the address, the reason, which kind of email it was, and the dates. We don't email that address again. The record applies to the digest and to alerts alike. It is kept even after the account is deleted, so the address stays suppressed. It is the only alert-related data we keep after an account is deleted.

Email alerts without an account

Where it is open, the alert window on a listing page lets you ask for one email alert without an account. You enter your email address, choose daily or weekly, and pass a security check. We then email you a confirmation link, and the alert starts only when you open it. Until then nothing is stored as an alert for you to be mailed: a request you don't confirm expires after 48 hours, and we delete it afterwards. Without an account an email address can have one alert. Asking for one doesn't subscribe you to the email digest, which is a separate choice.

For each such alert we store your email address, the filters it keeps (the listing type and level, Job Family, Industry, major, state, city and Remote, the same as for an account's alert), how often it is sent, and when you confirmed it, with the email address you confirmed and which version of the sign-up form you saw. We also store a random unsubscribe token, used only in the unsubscribe links in that alert's emails and able only to turn it off; the confirmation link's code, which we keep only in scrambled form; the times we sent a confirmation email, which limits how many we send to one address in a day; and when we last checked the search and last emailed you, how many listings that email had, and the result of the check.

The security check is Cloudflare Turnstile. It loads when you click into the email field, may set cookies, and Cloudflare receives your IP address and browser details to decide whether you are a person. We send its answer to Cloudflare to confirm it, and we consider it strictly necessary to protect the sign-up, so it isn't part of the analytics choice. Our own code uses your IP address only in memory, to rate-limit requests, and doesn't store it.

These alert emails are sent through Resend, the same provider as the digest, and carry no tracking pixels and no click tracking. Every email has a one-click unsubscribe link that works straight away. When you unsubscribe, the alert stops at once, and within a day we remove its filters. We keep your email address, how often it was sent, its unsubscribe token, the record of your consent and the date you unsubscribed for 30 days after that, so we can show you asked us to stop and so the unsubscribe link keeps working, then delete the record. If an email to your address bounces permanently or is marked as spam, we keep the suppression record described in the section above, and we don't email that address again. To have an alert and its record deleted sooner, email privacy@vylixjobs.com.

If you later sign in, or create an account, with the same email address, and that address is the account's own confirmed sign-in email, we move your alert into the account. It becomes a saved search with its email alert turned on, and you can change or turn it off on your Email alerts page. We match only the account's own confirmed sign-in email, never another address. We keep the record of your original consent (when you confirmed, how, and the address) with the alert, so we can show what you agreed to. We don't send any email when this happens. If the account can't take the alert, because it already has ten saved searches or alert emails are turned off for it, the alert stays as it was, without an account, and keeps going to the same address. After the move, the unsubscribe link in an older alert email still works, and it turns off the alert in your account. Once moved, we keep the small record of the original alert (the address, its unsubscribe link code and the consent record) for as long as the saved search it became exists. Deleting that saved search, or deleting your account, deletes it. This is different from an unsubscribed alert without an account, described above.

IP addresses

When you subscribe, ask for an alert by email, send a message with our contact form, click an apply link, look up a city in the location filter, or open the alert window (which counts recent matches), our own code uses your IP address only in memory, to rate-limit requests and detect duplicate clicks, and doesn't store it. Other services do receive it: our analytics services when analytics is on (see Analytics and cookies below), Cloudflare when you ask for an alert by email without an account (see Email alerts without an account above), and, if you have an account, Supabase and Cloudflare when you sign in (see Accounts below). Supabase records the IP address of a sign-in against your account's session for as long as the session exists.

Accounts

Accounts are optional and may be limited to invited people while we test them. You can sign in with Google, GitHub or Discord, or with a code or link we email you. To keep an account we store its email address, which sign-in methods it uses (and each provider's identifier for you), when it was created and last used, and its active sessions (including device and IP address details). We don't receive your Google, GitHub or Discord password, and we ask those providers only for your verified email addresses and basic profile.

GitHub email addresses. When you sign in with GitHub, we also read the list of email addresses GitHub has verified for your GitHub account and store those addresses in our database (Supabase) against your account. We use them only to stop a second account being created for one of your addresses. The list is replaced each time you sign in with GitHub, and it is deleted with your account. We use the access GitHub gives us for that one look-up and don't keep it on our servers.

Sign-in is handled by Supabase (storage and authentication). Sign-in codes are emailed through Resend. They are not marketing: they are sent only when you ask for one, carry no unsubscribe link, and are separate from the digest and from alerts. Where an emailed code is requested we use Cloudflare Turnstile, a bot check that runs on the sign-in page. It loads Cloudflare's script and may set cookies, and Cloudflare receives your IP address and browser details to decide whether you are a person. We consider it strictly necessary to protect sign-in, so it isn't part of the analytics choice.

Signing in stores a session in your browser's local storage (keys beginning “vylix-”) so you stay signed in, plus short-lived notes while you sign in, such as where to send you afterward. It also remembers whether you last chose Google, GitHub or Discord (that word only), so the sign-in page can mark that button “Last used”; this stays after you sign out. Signing out clears the session on that device. We don't link your account to analytics: analytics events about accounts (sign-in started, completed or failed, deleting an account, job saved, job unsaved, save failed and saved list viewed, and search preset saved, loaded, renamed, deleted, listed or failed) are anonymous and never contain your email address, an account identifier, a listing identifier, a company or job title, or a search preset's name, search text or filters.

Saved jobs. Signed-in people can tap Save on a listing to keep it in a saved list. Each save is stored in our database (Supabase) against your account: a link to the listing, a copy of its title, company, location, apply link and job type (internship or full-time), and when you saved it. The copy is kept so the saved list still shows the job after the listing closes or is removed from our site. A saved job stays until you unsave it or delete your account. Other people can't see or change your saved jobs. Saving a job doesn't apply to it or send anything to the employer, and we don't share saved jobs with employers.

Applications. Signed-in people can keep a list of the jobs they've applied to; what you enter there (company, role, location, date, status, link, notes and more info) is stored in our database against your account, only you can see it, and a row is removed when you delete it or delete your account.

When you're signed in and click Apply on a listing, we add that job to your Applications list as a row waiting for your answer: which listing it was, a copy of its company, job title and apply link, and when you last clicked Apply on it. On your Applications page you can keep it (“Yes, I applied”) or remove it (“No”). A row you keep stays until you delete it. A row you don't answer is hidden 5 days after your last click on that listing, and deleted the next time you add an application or click Apply, or when you delete your account. Only you can see these rows. Clicking Apply while signed out adds nothing to any list. So that a click still counts when your phone pauses this page as the employer's site opens, we also keep a short note in your browser's local storage (key “vylix-apply-pending”): your account's identifier and, for each listing you clicked Apply on, its identifier and the time of the click. It holds at most 20 listings for up to 24 hours, is only sent while that same account is signed in, and each listing is removed once we've recorded it. If someone else signs in on that browser and clicks Apply, your note is deleted, not sent.

If you tap Save while signed out, we keep that one listing's identifier and the time of the tap in your browser's local storage (key “vylix-save-pending”) for up to 30 minutes, so the save can finish after you sign in. Only one listing is held at a time, and the note is removed when the save completes or expires.

Job profile. Signed-in people can save a job profile, on the Job profile page or from the listing filters, and use it from the listing page with “Use my job profile.” We store it in our database (Supabase) against your account: your target roles (job categories); a city (a town name, never coordinates) and a search radius in miles, or a US state; whether you want remote roles; whether you want internships, full-time roles or either; and, if you choose them, industries to show or hide, majors (fields of study) to match against job descriptions, seasons (including double blocks such as Summer + Fall) and years, a minimum pay with its unit and whether to include listings that state no pay, and an experience level. We also keep when the profile was created and last updated. A profile exists only once you save one. You can change it on the Job profile page at any time, and it is deleted along with your account. Other people can't see or change it. Using it only fills in the listing filters.

Search presets. Signed-in people can save up to ten searches from the listing page with “Save preset” and open them again with “Load presets.” Each preset is stored in our database (Supabase) against your account: the search as it appears in the page address (the filters you chose, any text you typed in the search box, and the sort order), whether it was an internship or full-time search, the name you gave it, and when it was saved and last renamed. A preset stays until you delete it or delete your account. Other people can't see or change your presets, and we don't share them.

You can also save presets without an account. Then up to ten are kept only in your browser's local storage (key “vylix-search-presets”): the search as above, whether it was an internship or full-time search, its name and when it was saved. Nothing about them is sent to us. They stay until you delete them or clear your browser's site data. If you later sign in on that browser, they are moved into your account (up to ten in all) and removed from the browser; any that don't fit stay in the browser. Older versions of the site kept one search you tapped Save preset on while signed out (key “vylix-search-preset-pending”) for up to 30 minutes; it is deleted the next time you open the listings signed in on that browser.

By creating an account you confirm you are at least 16. If you believe someone under 16 has an account, tell us at privacy@vylixjobs.com and we will delete it.

Deleting your account. Signed-in people can delete their account from the Settings page. Deletion is immediate and permanent: your account, sign-in methods and sessions are removed from our database straight away, and so are your saved jobs, applications, job profile, search presets, stored GitHub email addresses, and your email alert settings and unsubscribe token. Copies in backups kept by our database provider expire on that provider's backup schedule. Deleting an account does not remove an email digest subscription, which is tied to an email address and not to an account; unsubscribe from it separately (see Email digest above). A suppression record for a bounced or spam-complaint address is kept (see Email alerts for saved searches).

Your location

The “Use my location” button, in the location filter and on your job profile, asks your browser for your position only when you click it, and only if you allow it. Your browser then sends your approximate coordinates, rounded to about 1 km, to our server once, to find the nearest town. We don't store or log them, and we don't send them to analytics. In the location filter, only the town's name goes into the page address, the same as if you had typed it. On your job profile, the town fills in the city field, and it is saved to your account, as a town name, only if you then save your profile.

Hosting and request logs

Vercel, our hosting provider, keeps standard request logs (which include IP addresses and requested URLs) for a limited period. We don't use these logs to identify individual visitors.

Analytics and cookies

We use Google Analytics 4 and PostHog to understand how visitors use our site. One choice in our consent banner covers both. For visitors in the European Economic Area, United Kingdom, or Switzerland, Google Analytics' analytics and ad storage are turned off by default, and PostHog doesn't run at all until you accept. Everywhere else, both are turned on by default. Accepting our consent banner enables analytics cookies. Ad consent is not requested until ads launch.

Google works out your region from your IP address. For PostHog, your browser decides from its time zone: if the time zone is in one of those regions, or doesn't indicate a location (for example, it's set to UTC), PostHog stays off until you accept.

The events we collect are page views, searches, filter changes, pagination clicks, apply clicks, digest signups (which form was used, never your email address), and account events (sign-in started, completed or failed, with the method used, and account deletion started or completed, with no details), and saved-job events (a job saved or unsaved and where the button was, a save that failed and a fixed reason, and opening the saved list, never which job), and application-list events (a job you clicked Apply on kept or removed and which button you used, a keep or remove that failed and a fixed reason, how many jobs were waiting for an answer when you opened the list, and whether a signed-in Apply click was added to the list, with a fixed result such as “added” or “list full”, never which job), and alert events (the alert button clicked, and whether it was for filters or the digest; the alert window opened, and whether you were signed in; an alert created, with its frequency and whether the saved search was new; an alert refused or failed, with a fixed reason; the window's sign-in link clicked; and, for an alert without an account, that the form was sent (with its frequency) or refused or failed (with a fixed reason), never the filters, the count, your email address or which saved search). PostHog also records which links and buttons you click, where you click and move your mouse on a page, how quickly pages load, and errors the site runs into. Session recording is turned off. We send search terms, but we redact terms that look like email addresses or phone numbers. For the location filter we send the state or town you picked, never coordinates. The private code in our email links (confirm, unsubscribe and email preferences) and the one-time codes in sign-in links are removed before any page address is sent to either service. So are the minimum pay, the sectors you hide and the majors you pick in the listing filters: a major says what you study, so for the Major filter we record only that a major was ticked, unticked or cleared, never which one. The other filters you use, such as state, town, job type and level, stay in the page address we send.

Both services store a random identifier in your browser (Google Analytics in cookies, PostHog in a cookie and local storage) so repeat visits can be counted. Neither receives your name or email address. Both receive your IP address with each request, as any website does, and can use it to estimate your approximate location. PostHog stores its data in the United States. If you reject analytics after accepting, PostHog's cookie and stored data are deleted from your browser, apart from a note of your choice.

You can change your privacy choices at any time using the button below:

Apply-click log

We record every click on an apply link to understand which listings attract interest, regardless of your cookie choices. We store the listing clicked, its position and page number in the list, the domain of the site you arrived from (not the full address), and campaign tags (UTM parameters). We don't store your IP address, cookies, or any visitor identifier.

The referrer and UTM values sit in your browser's sessionStorage for the current tab session only.

Messages you send us

Our Contact page has a form for feedback and problem reports, and each job's “Report a problem” link opens it. When you send it, we receive whether it's feedback or a problem report, your message, your email address if you give one, and, for a report about a job, which listing it's about. If you email us directly, we receive your email address and your message.

We use them only to reply and to fix what you report, and we never add your address to the email digest. Messages from the form aren't stored in our database: each one is sent once, by email, to our support inbox. Vercel hosts the form, Resend sends the email (and keeps a copy for a limited period, as it does for every email it sends), Cloudflare forwards it, and it's kept in our Google (Gmail) inbox, the same place as email you send us directly.

We delete these messages within 12 months, or sooner if you ask at privacy@vylixjobs.com. Please don't include sensitive information, such as passwords or ID numbers. If you leave out your email address, we can't reply.

Advertising

We may display third-party ads on our site in the future, and those ads may use cookies. If that happens, we will update this policy before serving any ads.

Your choices and contact

You can unsubscribe from emails at any time by clicking the unsubscribe link in any message we send. You can change your cookie preferences using the button above. If you have an account, you can delete it from the Settings page. You can also ask us to delete your data by emailing privacy@vylixjobs.com

The address opens your device's mail app. If nothing happens, or the wrong app opens, copy the address into the email service you use.