Privacy

Reading the site

There is no form here that takes an email address, and that is deliberate rather than unfinished: a list collected months before anything is ever sent to it is a cold list, and the first send would burn the domain’s sending reputation permanently. So no address is asked for and none would be accepted.

Pages are rendered on one server from a database of job listings and cached at Cloudflare’s edge. Which pages you read is not written to that database — the web process opens it read-only, at the connection level, so it could not be even by mistake.

The only thing this site itself puts in your browser is your theme choice, kept in localStorage under fable12-theme. It is read on the next page load and never sent anywhere. Typefaces are downloaded at build time and served from this domain, and every employer logo is a file on this server, so loading a page here makes no request to Google, to a font host, or to any employer.

Analytics, stated in full

PostHog runs on every page of this site. It is a third-party product analytics service and its servers are in the United States. This is the part of the page where a site normally writes something reassuring and vague, so here is the whole of it instead.

What it puts in your browser. A first-party cookie and a localStorage entry holding a randomly generated id, so that a second visit is recognisable as the same browser. The id is minted in your browser and derived from nothing about you. Nothing on this site ever calls PostHog’s identify, and profiles are configured as identified_only, so no person record is ever created — what exists is a pile of events under a random string.

What it records. A page view per page, carrying the route pattern and the full URL. What a search on /jobs returned: which filters were set, how many listings matched, and the words typed into the search box — that last field is free text, and it is the only thing collected here that could contain something you wrote. Clicks on the site’s named links, including clicks out to an employer. Page load timings. And the IP address the request came from, which PostHog stores and turns into an approximate country and city.

Session replay is on, and it records sessions. PostHog reconstructs the visit — the pages, the scrolling, mouse movement, clicks, how many keys were pressed — into something that can be played back afterwards. Recordings are kept for 30 days and then deleted. It was switched on to watch how the filters get used, it is by a distance the most invasive thing described on this page, and it would be dishonest to list it anywhere but first among the things worth objecting to.

What was switched off. Autocapture, which files an event for every click anywhere in the document: in the fortnight before it was removed it produced 176 events against 253 page views, nearly all of them unreadable DOM chains. It was replaced by a named event on the handful of links worth naming. The full event schema — six event types, every property listed — is kept in the repository at docs/analytics.md, and the code has to agree with it.

Stopping it. Any content or tracker blocker stops all of the above, and nothing on this site depends on it — with the key absent the analytics component does nothing at all. There is no opt-out control on the site yet, and Do Not Track is not honoured: PostHog ignores it by default and that default has not been changed here. Both are worth fixing and neither is fixed.

Signing in, and the one record kept

There is exactly one place on fable12 where a person has an account, and you only reach it on purpose: connecting an AI assistant to the MCP server at /mcp. Nothing done in a browser goes near it. If you have never pointed an assistant at fable12, this section describes nothing about you.

That sign-in is Google’s, and fable12 asks Google a single question: who is this. The scopes requested are openid, email and profile, and nothing else is ever requested. No Google API is called. The access token Google hands back is discarded the moment your identity has been read out of the ID token, because a credential nothing here has a use for is a credential not worth holding.

• Your Google account idThe OIDC sub claim: an opaque string, stable for you, meaningless to anyone else. It is what a rate limit and a revocation attach to.
• Your email addressBecause it is what a human reads when deciding whose access to withdraw. An account id is unreadable; an address is a person.
• Hashes of the tokens issued to your clientSHA-256, never the token itself. A copy of the file taken off disk — a backup, a stray dump, someone reading the volume — hands nobody anything they could present.
• The name and redirect URLs your client registered underMCP clients register themselves, and a token has to be tied to the client it was minted for or it can be replayed from somewhere else.
• TimestampsWhen it was issued, when it expires. Expiry is checked on every read, so a row stops working the moment it lapses rather than when a cleanup job gets to it.

That is the whole list. It lives in its own SQLite file on fable12’s server, deliberately separate from the listing corpus, which that process opens read-only.

Why any of it is kept, plainly. Rate limiting. The MCP endpoint counted requests per IP address, and an address is a poor stand-in for a person in both directions — trivially cheap to change, and routinely shared by people with nothing to do with each other. A quota that attaches to an account can be generous without being exploitable, and a client behaving badly can be revoked by name rather than by guessing which address it moved to. That is the entire reason the record exists. It is not used for marketing, it is not shared with anyone, it is not sold, and there is nothing else it is quietly also for.

How long it lasts. An access token expires after one hour, a refresh token after 30 days. Every read filters on expiry, so a lapsed row is already dead before anything deletes it; a purge then removes it from the file. Revoking fable12 from your Google account permissions ends the whole thing without anyone here having to act: nothing can be refreshed, and every row carrying your account id has expired and been purged within 30 days at the outside.

What the listings themselves contain

The corpus is job listings, read from the hiring systems employers publish their own boards on. It holds no personal data about anyone looking for work: no profile, no CV, no application, nothing a reader has entered. There is nowhere on this site to enter any.

fable12 never sees who applies to anything. Every listing links out to the employer’s own posting, and applying happens there, on their system, under their policy — this site is not in that path and nothing comes back from it. The analytics does record that an outbound click happened, anonymously, as described above; that is the end of what is known.

The employer’s posting text is stored so it can be searched, not so it can be republished. Searches return a matched excerpt rather than the posting, here and through the MCP endpoint alike, because the prose belongs to the employer and the copy worth reading is the one on their own page. How we know covers where the dates come from.

Everyone else a request touches

• CloudflareDNS, TLS and the cache in front of every request, so they see it before this site does: the address it came from, the URL, the browser string. Most pages are served from their edge for half an hour rather than reaching the server at all. Backups of the listing corpus are stored in Cloudflare R2 — the sign-in database is not among them.
• DigitalOceanOne rented Linux machine in their Bangalore region, running all of it: the website, the API, the sweeper that reads the boards, and the MCP endpoint. There is no second server and no managed database.
• PostHogProduct analytics, on their United States cloud. Everything in the section above goes there, session recordings included. It is the only third party that receives anything about how you use this site.
• GoogleIdentity, and only for an MCP client signing in. Google learns that you signed in to fable12; fable12 learns your account id and address. Nothing else passes in either direction, and no Google API is ever called.

There is no advertising network, no marketing pixel, no data broker and no cross-site tracker on this site. Nothing collected here is sold, and nothing is passed to anyone beyond the four above.

Getting a copy, or getting it deleted

For the sign-in record, the fastest route needs nobody at all: revoke fable12 from your Google account permissions, and every row keyed to you expires and is purged within 30 days. Nothing is retained past that and nothing survives it.

For deletion sooner than that, for a copy of what is held, or to have a session recording removed, you need to reach a person — and this is the part that is honestly unfinished. fable12 has no published contact address, because there is no working mailbox on this domain yet. Printing one here that bounces would be worse than admitting that, so this page admits it. A contact route is being set up and this section will name it the day it actually receives mail.