Elevate Internships

Privacy Policy

Last updated November 2, 2026

The short version. There is no advertising, no tracking cookies, and no third-party analytics — the site only counts its own page views, without cookies or IP addresses. Creating an account stores your email address and a hashed password; searching works without one. Job boards are never sent your ZIP code. Anything you tell us about yourself is optional and used only to tailor the app for you. You can export everything you have saved, and delete your account outright, at any time.

1. Who runs this

Elevate Internships (“we”, “us”) runs this site at elevateinternships.com, from Connecticut in the United States. We control the server and the database it writes to, and we are responsible for the personal information described below. Questions about it go to privacy@elevateinternships.com.

2. What is stored, and where

Data is written to a database on the server (SQLite, or a JSON file in small deployments). The server runs at Render, a hosting company, which keeps it running for us and does not use the data for anything else. What the database holds depends on whether you have an account.

When the server has no permanent disk of its own, the operator can have it keep that database in Cloudflare Workers KV instead, so accounts survive a restart. A copy is saved there within a few minutes of any change, and one dated copy a day is kept for 14 days as a backup. Cloudflare stores these copies for the operator and does not use them for anything else.

Without an account, nothing about you is stored on the server. Your ledger, the internships you track, your “About you” answers and the companies you watch live in your own browser's localStorage (cl-guest-ledger, cl-guest-tracker, cl-profile and cl-watch) and never leave it, except as section 3 describes — which also means they do not follow you to another device, and clearing site data erases them. When you sign in or create an account, they are moved into it.

With an account, the server stores:

  • Your email address, and your name if you chose to give one
  • A hash of your password — scrypt, salted, never the password itself. It cannot be reversed back into your password. If you sign in with Google or LinkedIn instead, there is no password: we store the account identifier that service gave us, and your email address and name from it.
  • Certifications you added to your ledger, and which you marked complete, with the date
  • Which starter tracks you began
  • Your recent searches — ZIP code, major, and interests
  • Session records, so signing in on one device does not sign you out on another
  • How many times you have signed in, and when you last did. A count and a date — not a record of each individual visit.
  • Internships you opened an apply link for, with the job title and company. This is used to show you what you have already applied to, and to count activity across the site. Opening the same posting twice is recorded once.
  • Opportunities you save to the Applications tracker: the job title, company, location and link, the stage you set (saved, applied, interviewing, offer or closed), any note you write, the application deadline and interview time you enter, your time zone (so reminders arrive on the right day), when you first marked it applied, and when you last changed it. Only you can see these, and they are included in your data export.
  • Your “About you” answers on the Prep tab, if you give any: your major, graduation year, the tools you know, where you feel stuck, a project you are proud of and a five-year goal. Every answer is optional. They are used only to tailor the app for you — the readiness checklist, recruiting countdowns, certifications you may already know, and the interview questions they help with — and never to rank internships, and they are never shared.
  • Companies you choose to watch, whether you asked for notifications about them, and the postings found for them, so the app can tell you when a watched company posts something new.
  • Whether you turned on reminder emails. They are off unless you switch them on in the Applications tab. When on, the day before a deadline or interview you get one email listing what is due, sent through the email provider named below; turn them off there at any time.
  • If you turn on notifications: for each browser, the address its push service gave it and the keys used to encrypt messages to it. They are deleted when you turn notifications off there, or when the browser says the address no longer works.
  • If you arrived through a referral link (for example from a campus ambassador), the referral code, recorded once when you create your account. If the link came from your school or college, we may send it totals for that link, such as how many students signed up or saved an internship, and, if the school asks to be on the campus leaderboard, show those totals there — but never your name, your email address or anything about you alone; any count from 1 to 4 is shown only as “fewer than 5”.
  • Whether you turned on the weekly new-internships email, and if so, which listings it has already sent you (so none is sent twice) and when it last ran. It is off unless you switch it on under a search in the Finder, and it is only sent to an address you have confirmed. Each email has a link to stop it, which works without signing in.

Your data is kept separate from every other account. Nobody else who signs in can see your ledger, your searches or your progress.

Your browser also stores, whether or not you have an account: cl-theme, remembering whether you chose light, dark, or system; cl-consent, your answer to the font question in section 4; cl-recent-searches, your last five searches (ZIP code, radius, major and interests) so you can run them again in one click; and, once you use them, cl-recent-views (the last ten listings you opened: title, company, location and link), cl-practice (how you rated yourself on interview questions), cl-prefs (your menu choices, whether you have seen the tour, and which notifications you have read), cl-hidden-postings (the links of postings you hid from your results) and cl-practice-progress (which practice questions you solved or attempted). None of them leaves your browser. If you open a referral link, el-ref holds its code for 30 days so it can be sent with the sign-up form; it is not sent anywhere else.

Cookies. One cookie is set, and only after you sign in: cl_session, which holds a random session token. It is HttpOnly (JavaScript cannot read it), SameSite=Lax, and expires after 30 days. It is strictly necessary to keep you signed in — it is not used for tracking or analytics. If you choose to sign in with Google or LinkedIn, two short-lived cookies, cl_oauth_google or cl_oauth_linkedin and, if you arrived by a referral link, cl_oauth_ref, hold a random check value and that code for up to ten minutes while you approve the sign-in, and are deleted when you return. Nothing else is set while you are signed out.

To erase everything, delete your account from the account page (which also signs you out), and clear this site's storage in your browser.

3. What is sent to other services

When you run a search, the server queries job boards on your behalf. Each receives your search terms:

  • The Muse, Remotive, Jobicy — always queried; they need no key. They receive your location and keywords.
  • Greenhouse, Lever, Ashby and SmartRecruiters — the public job boards of individual employers. These receive nothing about your search: each board is fetched whole and filtered on this server.
  • Simplify and Himalayas — public lists of internships and new-graduate roles, and a remote-jobs feed. These receive nothing about your search either: each is fetched about once an hour and filtered on this server.
  • Adzuna — only if the operator has set an API key. Receives your location, radius, and keywords.
  • USAJOBS — only if the operator has set an API key. Receives your location and keywords. Note: the USAJOBS API requires the email address you registered with to be sent as the request's User-Agent header. If USAJOBS is enabled, the operator's email is transmitted with every query — never yours.
  • Anthropic — only if the operator has set ANTHROPIC_API_KEY. When you press “Suggest more,” your major, interests, and class year are sent to the Claude API. When you ask Ask Elevate a question, your question, the major from your “About you” answers if you gave one, and passages from this site's own pages are sent to it so it can write the answer. Nothing else about you is sent, and questions are not stored on this site. Without a key, Ask Elevate answers with links to this site's pages and nothing is sent anywhere.

These requests are made by the server, not by your browser, so the job boards see the server's IP address rather than yours. They do receive the words you searched for. Their handling of that is governed by their privacy policies, not this one. API keys stay on the server and are never sent to the browser.

Job boards are never sent your ZIP code. The app ships a complete table of US postal codes and cities, so turning your ZIP into coordinates and measuring the distance to a listing happens on the server; the boards that take a location receive the city and state. Only if a ZIP code is missing from that table (a newly created one, for example) does the server ask Zippopotam.us, a free postal-code lookup, where that ZIP code is. Nothing else is sent with it.

Watched companies. If you watch companies without an account, your browser sends their names to this site to check what they have open; the names are not stored. With an account, they are checked on the server every few hours. Either way, only the listings this site already holds are searched, so no employer is told who is watching it.

Resume feedback. If you upload a resume on the resume page, the file is sent to this site's server, which reads it to check it against the guide and sends the feedback straight back. The file and its text are held in memory only while that happens: they are not saved, not written to any log, and not sent to any other company or AI service.

Recruiting contacts. When you open recruiting contacts for an internship you applied to, or the interview prep card on an application, your browser sends the company's name to this site to look up what that company publishes. The name is not stored with anything about you. The contacts shown are team addresses and contact pages that the company publishes on its own site, each with a link to that page and the date it was checked. We do not guess addresses, buy contact lists, or list anyone's personal address. A company that wants its listing changed or removed can write to privacy@elevateinternships.com. If we have no careers page for a company, the panel offers a Google search for one; that sends the company's name to Google only if you click it.

Practice questions. SQL queries and Excel formulas you try on the practice page run in your browser and are not sent to this site or anyone else. Your progress stays in your browser too.

Signing in with Google or LinkedIn. If you choose to, you are sent to that service to approve it. It then tells this site your account identifier there, your email address, whether that address is verified, and your name. We do not receive your password, contacts or posts, and we do not post anything for you. Their own privacy policies cover what they do.

The server keeps ordinary web-server logs, which typically include your IP address, the page requested and the time. These are operational records for security and debugging, not analytics, and they are not combined with your account to build a profile.

Page-view counts. The server keeps a daily tally of how many pages were loaded, which pages they were, and the site that linked here (only its name, such as linkedin.com, or the utm_source tag in the link). It does not store your IP address, your browser's details, or anything else that identifies you or tells one visitor from another; no cookie is set for it and no outside analytics service is involved. Automated visitors are left out. The tallies are kept for 120 days and only the operator can see them.

Error reports. If a page hits a programming error, your browser sends the error message, the page's path (such as /account) and where in the site's code it happened, so it can be fixed. Nothing you typed and nothing that identifies you is included. The server keeps the 60 most recent errors, and only the operator can see them.

Notifications. If you turn them on, reminders and alerts are delivered by your browser maker's push service — Google for Chrome and Edge on Android, Microsoft for Edge on Windows, Mozilla for Firefox, Apple for Safari. The message is encrypted so the push service cannot read it; it sees only that a notification was sent to your browser. Turn them off on the account page or in your browser at any time.

Payments. Sponsored listings are paid through Stripe, on Stripe's own page. Stripe receives your card details and email address and handles them under its own privacy policy; this site receives only whether the payment went through, the amount and a payment reference.

Password-reset and address-confirmation emails, a notice when your password is changed, and reminder emails if you turn them on, are sent through an email delivery service (Resend, or another provider the operator chooses). It receives your email address and the message, and only when you ask for one of those emails or change your password. A reminder names the internships due the next day. The weekly new-internships email, if you turn it on, lists new listings that match your most recent search; it goes only to a confirmed address, and every one has a link to stop it.

4. Google Fonts

The interface is designed around Inter, served by Google Fonts. Loading it means your browser requests files from fonts.googleapis.com and fonts.gstatic.com, which discloses your IP address and user-agent to Google.

That request is only made if you allow it. The first time you visit, a banner asks. Choose system fonts and Google is never contacted — the page uses fonts already on your device instead, and nothing else changes. You can change your answer later from the Font settings link in the footer of the main app.

5. Links to other sites

Apply buttons and the “Search these directly” panel open LinkedIn, Handshake, Indeed, SimplyHired, USAJOBS, the Virtual Student Federal Service, WayUp, RippleMatch, Chegg Internships, and Forage. Nothing is sent to those sites until you click. When you do, the link carries your search keywords and location in the URL, and your browser may send a referrer. Once you are on their site, their terms and privacy policies apply.

Affiliate links. Some links to paid certifications may be affiliate links. If you pay for a course after clicking one, this site may earn a commission from the provider, at no extra cost to you. The link carries a code that tells the provider (or its affiliate network) the visit came from here; the provider may set its own cookies on its site, and its privacy policy applies. Nothing about your account is shared. Commissions never affect which certifications are listed or how they are ranked, and each page with such a link says so.

If you are signed in, pressing Apply on a listing records that you opened it — the job title, the company and the date. That record stays here; nothing about your account is sent to the employer, and this app cannot see whether you went on to apply.

6. What is never collected

No phone number, resume, date of birth or address is ever requested, and card details never reach this site. There are no third-party analytics and no tracking pixels, no advertising, and no tracking cookies — the only measurement of our own is the page-view tally described above. Nothing is sold, rented, or shared with data brokers or with other companies for their own marketing. No profile is built about you from your activity; the only profile is the optional “About you” answers you choose to give, which you can change or clear at any time.

Do Not Track. Browsers can send a “Do Not Track” or Global Privacy Control signal. This site does not track you across other sites in the first place, so it works the same whether or not one is sent.

An account requires only an email address and a password, or a Google or LinkedIn sign-in. A name is optional and is used solely to greet you.

7. Your rights over your data

  • Export it. The account page gives you everything stored about you as JSON or CSV, on demand, including your “About you” answers and watched companies.
  • Delete it. Deleting your account removes your record, your ledger, your completions, your saved searches, your “About you” answers and your watched companies from the database. It is immediate and cannot be undone. Copies in the daily backups described above expire on their own within 14 days.
  • Correct it. Your “About you” answers and watched companies can be changed or cleared on the Prep tab, and your password from the account page. To change your name or email address, write to privacy@elevateinternships.com.

Depending on where you live, laws such as the GDPR or the CCPA may give you further rights. To exercise them, or to ask anything about your data, write to privacy@elevateinternships.com.

8. How long it is kept

Account data is kept until you delete your account. Sessions expire after 30 days. Saved searches are kept so the app can show your recent ones, and are removed with your account. Backup copies, where they exist, are kept for 14 days. A record of each payment (date, amount, refund) is kept after an account is deleted, without anything linking it to you, because a business has to keep its sales records.

9. Children

The app is aimed at students and is not directed at children under 13; the Terms require everyone who uses it to be at least 13. If you believe a child under 13 has created an account, write to privacy@elevateinternships.com and it will be removed.

10. Changes

If this policy changes in a way that affects what is collected or who receives it, the date above changes with it, and the change is noted on the What's new page. The date reflects this version.