Privacy Policy

Who we are

Climate Jobs is operated by Sidestep Technology Limited, a company registered in England and Wales (company number 15350889) with its registered office at 86-90 Paul Street, London, United Kingdom, EC2A 4NE. Sidestep Technology Limited is the data controller for this website.

You can reach us at hi@climate.jobs for any privacy-related questions or to exercise the rights set out below.

What we collect and why

Account data (premium subscribers)

When you sign in, we store your email address and premium subscription status. Premium access is tied to your paid subscription to the Remote Climate Jobs newsletter (remoteclimatejobs.co), run on Beehiiv: "one subscription, two platforms". Signing in triggers a check against Beehiiv to confirm your subscription is active, and magic-link emails are sent via Resend.

Saved jobs

Premium subscribers can save jobs to a personal list. We store only your user ID and the job IDs you save.

Anonymous usage counts

We keep aggregate counts of page views and "apply" clicks to understand which categories and countries attract interest. These records contain only the page type, job ID, category, country, and a timestamp: no IP address, no user-agent, no user ID, no cookie, and nothing that could identify you.

Account activity (signed-in users)

When you are signed in, we record which pages you view so we can understand how active our subscribers are and which parts of the site are useful. Each record holds your account ID, the page type, the page path (without any search terms), and a timestamp. This is first-party data, stored in our own database (Supabase). It is not shared with third parties and sets no cookies. Visitors who are not signed in are not tracked this way.

Analytics (PostHog)

We use PostHog (EU Cloud, hosted in Frankfurt) for product and web analytics. PostHog is our only analytics provider. We do not use advertising, marketing, or third-party tracking cookies, and we never sell your data.

When you first visit, PostHog captures nothing until you make a choice on our cookie banner:

If you accept, PostHog sets a single first-party cookie (ph_*) storing a pseudonymous visitor and session identifier, so we can measure pages, referrers, approximate location (country) and basic product usage (e.g. "saved a job"). No cross-site tracking, no advertising.
If you reject (or your browser sends a Global Privacy Control or Do Not Track signal), no cookie is set and nothing is stored on your device. We still count the visit in an anonymous, privacy-preserving way that cannot identify you or follow you across days.

You can change your choice at any time via Cookie settings in the footer. We honour Global Privacy Control and Do Not Track automatically.

Security and fraud prevention

We use strictly necessary cookies (below), rate-limiting, and CSRF tokens to protect the site from abuse. These do not track you across sessions or sites.

Cookies

The first three cookies below are strictly necessary and are exempt from consent under Article 5(3) of the ePrivacy Directive. The last (ph_*) is an analytics cookie set only if you accept it on our cookie banner. We do not use any advertising, marketing, or third-party tracking cookies.

Cookie	Purpose
`csrf_token`	Protects forms from cross-site request forgery. Session-scoped.
`sb-*`	Set by Supabase. Keeps you signed in. Expires when your session does.
`ph_*`	PostHog analytics. Set only if you accept analytics cookies on our banner. Stores a pseudonymous visitor and session id. Expires after 365 days. Withdraw any time via Reject or Cookie settings.

The analytics cookie (ph_*) is set only after you accept it on our banner, and you can withdraw your consent at any time via Cookie settings in the footer (see PostHog, above, for what we measure and how visitors who decline are counted).

Your browser's cookie settings let you refuse or delete cookies at any time. Blocking csrf_token or sb-* will prevent login.

Who we share your data with (processors)

We use the following service providers ("processors") who handle personal data on our behalf. Each is bound by a data processing agreement.

Supabase: Database and authentication. Stores your account row (email, premium flag, saved jobs).
Beehiiv: Newsletter platform. Receives your email address so we can verify your premium subscription at sign-in, and sends real-time webhook updates when your subscription status changes.
Resend: Transactional email provider. Receives your email address to deliver sign-in magic links.
Logo.dev: Company logo CDN. Serves company logos on job cards. Your browser's IP address is exposed to Logo.dev each time a logo loads; Logo.dev does not profile users.
PostHog (EU): Product and web analytics, hosted in Frankfurt (EU). With your consent, sets one first-party cookie storing a pseudonymous visitor and session id, and uses your IP address to estimate your country via MaxMind (a sub-processor). If you decline, no cookie is set and you are counted only in an anonymous, privacy-preserving way. Honours Global Privacy Control. No advertising, no session recording, no cross-site tracking.
unpkg (Cloudflare): Open-source JavaScript CDN. Delivers a small animation-player script used for UI flourishes. Your browser's IP address is exposed to Cloudflare when the script loads; no tracking is performed.
Cloudways / DigitalOcean: Web hosting. Standard server access logs retained briefly for security and troubleshooting.

We do not sell your data and we do not share it with advertisers.

International transfers

Some of our processors are based in the United States (Beehiiv, Resend, Logo.dev, MaxMind via PostHog) or store data in multiple regions (Supabase, Cloudways). Where personal data is transferred outside the EU/UK, we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) to provide an appropriate level of protection.

How long we keep your data

Account data: kept while your account is active. Deleted within 30 days of a deletion request.
Saved jobs: deleted with your account.
Account activity records: kept while your account is active; deleted with your account.
Anonymous usage counts: retained indefinitely; they contain no personal data.
PostHog analytics data: retained while the project is active; not linked to any identifiable individual.
Server access logs: short-term, typically under 30 days, at our hosting provider's discretion.

Your rights

Under UK and EU data protection law, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Erase your data ("right to be forgotten")
Restrict or object to certain processing
Receive your data in a portable format
Withdraw any consent you've given, at any time
Lodge a complaint with your national supervisory authority (e.g. the UK ICO, or the data protection authority in your EU country of residence)

To exercise any of these rights, email hi@climate.jobs. We'll respond within 30 days.

Children

Climate Jobs is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we'll delete it.

Security

We use HTTPS everywhere, HMAC-signed session cookies, CSRF protection on state-changing actions, and rate-limiting against abuse. No method of transmission over the internet is 100% secure, but we follow industry practice to protect your data.

Changes to this policy

We may update this page from time to time. Material changes will be reflected in the "Last updated" date at the top. For significant changes, we'll also notify signed-in users by email.