Privacy notice

Last updated: 29 October 2026

This notice explains what personal data gophers.fyi uses, why, and what your rights are. It covers the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). It includes our cookies section.

The short version

• You don't need an account. If you create one for job alerts, we keep your name, email and the kinds of roles you choose, and nothing else. If you have a company account, we keep your name, work email, job title and your place in your company's team.
• We count visits without cookies. We only set an analytics cookie if you click Accept.
• We never take job applications. Apply takes you to the company's own site.
• We never share anything about job seekers with companies.
• No advertising, no selling data, no marketing profiles.
• Questions: matt@gophers.fyi.

Who we are

gophers.fyi is a job board for Go engineers in the UK and Europe, plus remote roles. It is run by Matt Watts, a sole trader trading as gophers.fyi, based in the UK. In this notice, "we" means gophers.fyi. We are the controller of the personal data described here.

We're registered with the Information Commissioner's Office (ICO), the UK data protection regulator, as "Mr Matt Watts", registration number ZC281890.

• Email: matt@gophers.fyi (for everything, including privacy requests)
• Post: 79 Leylands Road, Burgess Hill, RH15 8AF, United Kingdom

What we collect and why

When you visit the site

Cookie-free analytics (every visitor). We use PostHog, on its EU cloud, to understand how the site is used. Every visitor is counted this way, whether or not you use the cookie banner. It works like this:

• PostHog creates a daily anonymous visitor ID from a hash of your IP address, your browser's user agent and a salt that changes every day. This lets us tell visits apart within a day, but not from one day to the next.
• Your raw IP address is removed before anything is stored. We don't work out your country for these visits.
• We record page views, page leaves, web vitals (how fast pages load), clicks on Apply buttons (which job, and which page you clicked from) and when someone finishes signing up (only whether they turned on job alerts, never who they are). Nothing else is recorded until you click Accept.
• Session recording is off. We don't record your screen or what you type.
• Nothing is stored on your device for this, apart from your cookie choice.

Analytics with a cookie (only if you click Accept). PostHog sets a first-party cookie so it can recognise you when you come back. We also record clicks on links and buttons (which one you clicked), and use them for heatmaps, which show where on a page people click. Your IP address is still discarded, but PostHog may work out your country from it. We never send PostHog your name or email, and we never try to identify you. You stay an anonymous ID.

Our analytics traffic goes through our own address. Your browser sends analytics to gophers.fyi/ingest, which passes it on to PostHog EU. It is still PostHog receiving the data. We do this so fewer ad blockers drop it.

Apply clicks. Apply buttons go through a gophers.fyi/apply link. We record the job, the company, whether it was a featured listing, and the time. We don't record your IP address, a cookie or any visitor ID. Then we send you straight to the company's job page and add utm_source=gophers.fyi&utm_medium=job_board to the link, so the company knows the visit came from us. Nothing personal is added. We use these counts to show companies how their listings perform. From then on you're on the company's site, and their terms and privacy policy apply.

Job page views. When a job page opens in your browser, it tells gophers.fyi, and we add one to that job's view count for the day. We store only the job, the company, the day and the running total: no IP address, cookie, visitor ID or anything else about you. Bots aren't counted, and nothing is sent if you've chosen Turn off analytics. We use these counts to show companies how their listings perform.

Server logs. Our host, Vercel, processes your IP address and request details (such as the page and browser) to serve the site and protect it from attacks. These logs are kept briefly.

People named in job listings

We gather listings three times a day from companies' public careers pages, through their applicant tracking systems (Greenhouse, Ashby, Lever, Workable, Personio, SmartRecruiters, Teamtailor, Workday, Pinpoint and JOIN). We add a few by hand. A description sometimes names a recruiter or hiring manager, because the company published it. We show it as written. Company profiles (name, website, LinkedIn and GitHub links, size, industry, locations, tech stack, logo) are mostly not personal data. If you're named in a listing and want it changed or removed, email us.

Companies that book featured placements

When you request a booking with the form on our employers page, we keep your name, work email and company, the role and placement you asked about, and any message, in our database. These request details are never copied into our backups. We use them to reply, arrange and invoice the booking, and to see your past bookings if you book again. We also keep what you booked and paid, in email and in a private admin note. Before the form is sent, Cloudflare Turnstile checks that it comes from a person rather than a bot, as on sign-in. We email you a confirmation through Resend.

Paying by card. When a company Admin pays from the company dashboard, Stripe runs the checkout and takes the payment. We pass Stripe your work email to fill in the checkout. Stripe collects your payment details, and the name, email and billing details you enter. We never see full card numbers. Stripe gives us the payer's email, which we use to confirm the booking. We keep what was booked, the amount, any refund, Stripe's payment references and which company user paid. In Stripe's dashboard we can also see what Stripe shows about a payment, such as the name and billing country entered, and the card type and last 4 digits. We keep payment records until 6 years after the end of the UK tax year the payment falls in, to meet UK tax record rules and in case of a dispute about the booking.

Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal duties. For that, Stripe is a separate controller, and its own privacy notice applies (stripe.com/privacy). If you pay with Apple Pay, Google Pay, Revolut Pay or another method offered at checkout, that provider's own terms and privacy notice apply too.

Emails about your booking. We email the payer a booking confirmation, and a "your featured slot is live" email when a secured placement starts. Stripe emails a receipt. These are service emails about the booking, not marketing.

Register interest. If you ask us to email you when a page is free, we keep your request: who asked, the role and the page. We email you once when the page is free, then close the request. We also close it without emailing if your role closes, you leave the company, or you book that page. We delete closed requests after 90 days.

If you have a company account

When you create or use a company account, we keep:

• your name, work email address and job title;
• your company, whether you're an Admin or a Member, how you joined (claimed, invited, added the company, or let in by us) and when;
• if you ask us to let you in, what you told us (the company, its website, your job title and your message), and our decision;
• if you add a company, the details you gave about it;
• invites: the address invited, the role offered, who sent it and when, and whether it was used or cancelled. The link in an invite contains a long random code. We store only a scrambled version of it (a hash), never the code itself;
• a record of changes made in your company account (such as claiming the company, invites, role changes and people removed), with the name and email of the person who made each one and when.

If a colleague invites you, we use your work email address only to send the invite and to let you join when you use it.

You can sign in with a code we email you, or with Google. If you use Google, Google tells us your name, email address, whether Google has verified that email, and your Google Workspace domain. Each time you sign in, our server checks that the email is verified and that the Workspace domain matches your work email. If not, you can sign in with an emailed code instead. We ask for nothing else from your Google account. Supabase handles sign-in. Company sign-ins last at most 30 days.

Who sees it. People in your company account see your name, job title, email and whether you're an Admin or a Member. Admins also see open invites. We see everything, so we can run the service and check who can act for a company. Nothing about your company account is shown to job seekers or to other companies. If you ask to join a company that already has people in it, we email its Admins your name and email so they can invite you. We tell you this on screen before you ask.

Emails we send. Invites, "would like to join" emails to a company's Admins, and our replies when you ask us to let you in or add a company, all through Resend. We also get a short note when someone claims a company, adds one, or leaves one empty, so we can check it.

Deleting your account. You can delete your account at any time from Your account. That removes your login and your place in the company straight away. Your name and email stay in your company's record of changes for 12 months, then we replace them with "former team member", so the company can tell who did what in the meantime.

Backups. Company account details (people, invites, requests to be let in and the record of changes) are never copied into our backups.

Closing a company account. An Admin can ask us to close the whole company account by emailing matt@gophers.fyi.

If you create a job seeker account

You can create an account to choose the Go roles you'd like to hear about. We keep:

• your name and email address;
• the places, levels, workstyles and kinds of Go work you choose;
• the companies you choose to follow or hide;
• whether you've asked for job alert emails, how often, and when you said yes;
• when the account was created and last changed.

You can sign in with Google or with a code we email you. Before we email a code, Cloudflare Turnstile checks that the request comes from a person rather than a bot. It looks at your browser and connection, doesn't set tracking cookies, and doesn't tell us who you are. If you use Google, Google tells us your name and email address, and we ask for nothing else from your Google account. Supabase handles sign-in and sets login cookies (see below).

We don't send job alerts unless you tick the box asking for them. When you do, we send one welcome email with roles that match your choices, then the alerts. Every alert email has an unsubscribe link that works without signing in, and you can also turn alerts off on your account page. You can change your details or delete your account there too. Deleting it removes your name, email and choices straight away. They're never copied into our backups.

Admin sign-in

Only Matt signs in to the admin area. Supabase sets login cookies for this too.

Our lawful bases

Where we rely on legitimate interests, you can object (see "Your rights").

Cookies and browser storage

We don't use advertising, social media or other third-party tracking scripts. Our fonts are self-hosted, so your browser doesn't contact Google Fonts. Logos are served from our own domain.

The consent flag, the analytics off flag, the sign-in cookies and the gf_ cookies and storage are strictly necessary, so PECR doesn't require consent for them. The gf_ cookies and storage are only set when you sign in, open an invite or hide a company, as part of the account you asked for. The PostHog cookie needs your consent.

Changing your mind. Use Cookie settings at the bottom of any page to change your choice at any time. Clearing cookies and site data for gophers.fyi in your browser also resets it.

Objecting to cookie-free analytics. Choose Turn off analytics in Cookie settings, and we'll send no analytics from your browser at all. You can also object by emailing matt@gophers.fyi.

Who we share data with

We use these providers. They handle data for us under contract and only on our instructions, unless stated.

Wix is our domain registrar and DNS provider. It handles no site data.

Within a company account, the people in your company's team can see the details described above. We don't sell personal data. We may share data if the law requires it, or to protect our rights.

International transfers

Some providers are based in the US or may process data there, notably Vercel, GitHub, Google, Resend, Cloudflare and Stripe. Where data leaves the UK or EEA, we rely on safeguards the law recognises: the EU standard contractual clauses with the UK addendum (or the UK International Data Transfer Agreement), or the UK extension to the EU-US Data Privacy Framework where the provider is certified. You can ask us for details.

How long we keep it

Your rights

You have the right to:

• access your personal data;
• have it corrected;
• have it deleted;
• restrict how we use it;
• object, especially where we rely on legitimate interests;
• data portability, where it applies; and
• withdraw consent at any time.

Email matt@gophers.fyi. We'll reply within one month.

If you have a company account. These rights are yours, not your company's, and you can use them directly with us. Some requests touch your company's records too. For example, if you ask us to remove your name and email from the record of changes before the 12 months are up, we'll weigh your reasons against the company's need to see who did what, and tell you our decision.

A plain word about analytics. We don't identify visitors, so we usually can't find "your" analytics data. Cookie-free IDs change every day, and cookie IDs aren't linked to a name or email. If you want a fresh start, clear cookies and site data for gophers.fyi. That removes the PostHog cookie and your consent choice from your browser.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Children

gophers.fyi is for working professionals. It isn't aimed at children.

Changes

We'll update this notice when things change and update the date at the top.