Privacy Policy

SkillBridge Connect is operated by Civic Hacking. Contact us any time at help@civichacking.org.

Account information. If you create an account: your email address, a password (stored only as a salted scrypt hash — we never store or can read your actual password), your role (candidate, employer, or counselor), and a display name. If you sign in with Google, we receive your email address, your name, and your Google account identifier instead of a password.

Things you type in. Your transition profile (branch, pay grade, occupation code, separation date, target locations, clearance level, education and certifications), applications and expressions of interest you send, your application tracker entries, saved searches, messages you exchange with employers, reviews you submit, and any feedback you send us.

Usage signals. We record which programs get viewed and applied to so we can compute public metrics like employer response rates. We store a random device identifier in your browser (sbc:uid) to keep your work associated with you.

What we deliberately do NOT collect: we do not accept resume or document uploads of any kind, we never handle payment card details, and we do not ask for your Social Security number, DoD ID, or any other government identifier. Do not send those to us.

Program listings, organization names, and points of contact are sourced from the public skillbridge.mil directory, not from you. We do not control that data and cannot guarantee it is current or correct. If you are an employer and want your profile corrected, claim it or email us.

To operate the marketplace: match you to programs, deliver your applications, run your tracker, compute the SkillBridge Health Score and response-rate metrics, and send you the transactional email described below. We use it to make the product work and to keep the public trust metrics honest — nothing else.

We do not sell your personal information, share it with data brokers, or use it for third-party advertising. We run no advertising or cross-site tracking pixels.

Employers see the application or expression of interest you send them, including your name, email, and what you wrote. If you publish yourself to the talent pool, employers can also find your talent profile — that is opt-in and you control it from My Transition.

Reviews are anonymous to employers. We show the rating and text, never your identity.

Counselors can see cohort information only for their installation, and only for candidates who opted in to sharing.

Messaging is opt-in and one-directional to start: an employer can only open a conversation with you after you applied, expressed interest, or accepted an invite. You can mute any thread.

We use a small number of strictly functional cookies and browser storage entries. We do not use advertising or analytics cookies, which is why you have never seen a cookie consent banner here.

• ▸ Session cookie — keeps you signed in. HTTP-only, so scripts can't read it.
• ▸ OAuth state cookie — a short-lived anti-forgery nonce during Google sign-in, deleted immediately after.
• ▸ Local browser storage — your device id, and local UI preferences such as timeline and packet drafts.

We keep the third-party surface deliberately small:

• ▸ Vercel — hosting and delivery.
• ▸ Managed PostgreSQL — the database where your account and activity live.
• ▸ Google — only if you choose Google sign-in. Company logos are fetched through Google's public favicon service, so your browser requests images from Google when viewing listings.
• ▸ Resend — sends our transactional email.
• ▸ CARTO / OpenStreetMap — map tiles on the map pages.
• ▸ Anthropic — when the AI features are enabled, the text of a listing or an application may be sent to translate military occupations or summarize an applicant. This is not used to train models.

We send transactional email only — a welcome message, notification that an employer messaged you or that a candidate applied, claim outcomes, and password resets. We do not send marketing blasts. Every message comes with a real reply-to address.

We never email the point-of-contact addresses listed in the public skillbridge.mil directory. Employers only hear from us if they created an account or claimed their profile.

Passwords are hashed with scrypt and a per-user salt. Session tokens are stored as SHA-256 hashes, never in the clear, so a database leak can't be replayed to seize accounts. Password reset links are single-use and expire in one hour, and completing a reset signs out every other session. All traffic is served over HTTPS.

No system is perfectly secure, and we make no guarantee that a breach can never happen. If one does, we will tell affected users.

You can edit or clear your profile at any time from My Transition. To get your account and associated personal data deleted, or to request a copy of what we hold, email help@civichacking.org from your account address and we will action it.

Two things survive account deletion, both de-identified: anonymous reviews (removing them would let employers erase criticism) and aggregate counts already folded into public metrics. Neither identifies you.

The site is intended for transitioning service members, military spouses, employers, and counselors. It is not directed to children under 13 and we do not knowingly collect their information.

If we change how we handle data we will update this page and its “last updated” date. Material changes will be announced on the site.