Privacy Policy

1 Overview

GO USA provides a search and discovery platform for federal job listings sourced from the official USAJOBS.gov API. We take your privacy seriously and are committed to protecting your personal information.

By using our platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the site.

2 Data We Collect

Information You Provide

• Account Registration: Username, email address, password (hashed via bcrypt), and hiring eligibility path.
• Profile Information: Any resume data, preferences, or career interests you voluntarily add.
• Communications: Any messages or feedback you submit through contact forms.

Information We Collect Automatically

• Log Data: IP address, browser type, pages visited, and timestamps for security and rate-limiting purposes.
• Session Data: A secure, HTTP-only session cookie to keep you logged in.
• Search Queries: Anonymized job search terms used to improve recommendations.
• Saved Jobs: Records of job listings you bookmark or save.

3 How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the GO USA platform.
• Create and manage your user account and profile.
• Deliver job alerts and search recommendations based on your preferences.
• Protect the platform through rate limiting, CSRF protection, and fraud detection.
• Analyze aggregated, anonymized usage trends to improve the service.
• Communicate important service updates, security notices, or policy changes.

We do not sell, rent, or trade your personal information for advertising or marketing purposes.

4 Data Sharing & Disclosure

We do not sell your personal data. We may share information only in these limited circumstances:

• Service Providers: Trusted third-party services (e.g., database hosting, email delivery) that help us operate the platform, under strict confidentiality agreements.
• Legal Compliance: If required by law, court order, or government authority.
• Safety: To prevent fraud, abuse, or threats to the safety of users or the public.
• Business Transfers: In the event of a merger or acquisition, your data would transfer under the same privacy terms.

5 Cookies & Tracking

We use a minimal set of cookies required for the platform to function:

• Session Cookie (PHPSESSID): An HTTP-only, secure cookie that manages your login state. Expires after 30 minutes of inactivity.
• CSRF Token: A security token embedded in forms to prevent cross-site request forgery.

We do not use tracking pixels, third-party ad cookies, or behavioral analytics cookies. You can disable cookies in your browser settings, but this will prevent you from logging in.

6 Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and all associated personal data.
• Portability: Request your data in a machine-readable format (JSON/CSV).
• Opt-Out: Unsubscribe from job alert emails at any time via your profile settings.

To exercise any of these rights, contact us at the email address listed in the Contact section below. We will respond within 30 business days.

7 Security Measures

We implement industry-standard security measures to protect your data:

• Passwords hashed with bcrypt — never stored in plaintext.
• HTTP-only, SameSite session cookies to prevent XSS and CSRF attacks.
• Parameterized PDO queries on all database interactions to prevent SQL injection.
• Rate limiting on all API endpoints to prevent brute-force attacks.
• Session regeneration every 15 minutes to prevent session fixation.
• HTTPS enforced in production environments.

8 Third-Party APIs & Services

Our platform integrates with the following third-party services:

• USAJOBS.gov API: Job listing data is sourced from the U.S. Office of Personnel Management's official API. Your searches may be logged by USAJOBS per their own privacy policy.
• Google Fonts (Inter): Font assets are loaded from Google's CDN. Google may log requests per their privacy policy.
• UI Avatars: Profile avatar images are generated by ui-avatars.com using only your username initial — no personal data is transmitted beyond the display name.
• Chart.js: Analytics charts are rendered client-side from a CDN. No data is sent to Chart.js servers.

9 Children's Privacy

GO USA is intended for users 18 years of age or older. Federal employment generally requires candidates to be at least 18. We do not knowingly collect personal information from individuals under 18.

If you believe a minor has submitted personal information to our platform, please contact us immediately and we will delete it promptly.

10 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page.
• Display a notice on the home page for 14 days after the change.
• Send a notification email to registered users for material changes.

Continued use of the platform after changes take effect constitutes your acceptance of the updated policy.