You put a resume into a job app for a single listing. The cell number goes with it. Screening-chat answers often do too, and sometimes a device ID tags along. The upload takes a few minutes. The copy can sit on someone's servers for years.
Nobody offers a tour of those databases. You won't get one. What still belongs to you is the choice about what goes on the form. Would you type your full home address into an app you might never open again?
Why a job-app leak hurts more than a shopping-account leak
Reset a shopping password. If fake charges show up, swap the card. A retailer breach is usually that kind of nuisance, and then your week returns to normal.
Job apps leak resumes, phones, and sometimes a former manager's name. There's no card swap for any of that.
What job search apps actually collect
Every major board holds the same core pile. Account records sit there. Your resume file sits there. The profile you keep polishing lives on the same stack, along with search history, saved jobs, and in-app messages.
That's only the shared layer. Platforms then add their own.
An Indeed or ZipRecruiter account typically holds a resume, a desired title, and a phone number you typed once and forgot.
LinkedIn stores recommendations, activity, and a photo, because recruiters are supposed to be able to find you.
Freelance marketplaces add tax identity and payout details. Guard that pile hardest.
Some of it runs deeper than forms. Chatbots can keep your screening answers, and video interview tools may keep recordings. Phone apps often ask for location. None of that is automatically illegal. It's still a much bigger stack than a paper application ever created, and it outlasts the role you were chasing.
Then the copies multiply. You apply on a board, the employer routes you through a vendor chatbot you never chose, and an ATS stores the PDF, which means three companies now hold your phone number, three separate copies, and you still never get one screen that shows the whole trail. Deleting the app later never actually finishes the job.
The McHire incident and why applicants should care
Paradox.ai's chatbot, Olivia, screens people inside McDonald's McHire flow. Researchers Ian Carroll and Sam Curry spent 2025 going through that pipeline.
They found an administrator login that used 123456 as the username and 123456 as the password. Extra login checks were switched off. Nobody had turned on multi-factor authentication.
Turns out the credentials traced to a test-style account from around 2019. Nobody had retired it.
An IDOR bug sat next to that weak login. Change an ID inside a request and the system can hand back another person's records. Combined, reporting put the reachable pool at up to 64 million applicant records. WIRED's reporting described how those credentials could open chats Olivia had held with McDonald's applicants. Details people typed sat inside those threads.
McDonald's disputed the blast radius. The company said only a fraction of the records the researchers reached contained personal information, and that nobody besides those researchers used the weak account. Default passwords still have no business sitting next to applicant chats.
You didn't pick Paradox.ai when you applied. A corporate or franchise hiring team did. Treat every screening bot like a public form. Keep a Social Security number, a full date of birth, and a passport image out of the chat unless you have a specific written reason to include them. Leave optional fields blank.
How the big boards talk about your data
Each platform writes its own notice, then revises the wording, sometimes quietly. Trust the live page, not a summary. That includes this one.
California users get pointed to access and deletion paths in Indeed's privacy FAQ, which also notes the CPRA amendments that took effect January 1, 2023. The company's recruitment privacy policy says Indeed does not have actual knowledge of selling or sharing consumers' personal information under CCPA, including data on people under 16. "Not selling" is a narrow legal category. Employers still see the applications you send.
LinkedIn, ZipRecruiter, Upwork, and Monster each publish their own notices. Some describe sharing with employers, service providers, or advertisers. No clean public scorecard ranks them all. If the deletion language is vague, share less.
| Platform | What official materials emphasize | What you should assume |
|---|---|---|
| Indeed | Access and deletion tools; a CCPA statement on not selling or sharing consumer PI | Employers still receive the applications you submit |
| A profile built to be found by recruiters | Contact details and open-to-work signals travel farther than a private resume would | |
| Upwork | Identity checks and contract messaging for freelancers | ID images are high-value; stay inside the official verification flow |
| ZipRecruiter and similar boards | Getting your resume in front of employers | Copies can sit in more than one employer system after you apply |
Treat that table as a map, not an audit.
Visibility settings that actually change who sees you
Recruiters browse LinkedIn the way it ships: public by default. Hide your phone number and personal email from the public profile. Strangers shouldn't collect both off one page.
Look at the photo frame twice. If your current manager uses the site, the open-to-work frame is loud. Recruiter accounts can search you either way. That's the product working as designed.
Indeed behaves more like an application inbox. You can hide or show the resume. Check whether employers who never received an application from you can still search that file anyway.
- Switch searchable resume off if you want the cold pings to drop.
- Leave it on only if inbound interest matters more, and strip the file first.
A professional summary belongs on Upwork because those profiles exist to be found. Your home address doesn't.
Privacy rights you can actually use
If you live in California, you get usable rights. The California Consumer Privacy Act, CPRA updates included, covers the right to know, the right to delete, and the right to opt out of sale or sharing of personal information. Businesses should answer within 45 days.
File through a web form, an email, or the toll-free number listed in the privacy policy. California's request tips cover the mechanics. Then you wait.
Brokers are a separate headache. They trade information you never handed over directly. The state's Delete Request and Opt-out Platform (DROP) lets residents point one deletion request at registered brokers after residency verification. Those brokers must process deletion requests at least once every 45 days starting August 1, 2026. DROP's reach ends there. Every job app or employer you actually used still needs its own request.
Thing is, CCPA doesn't chase a PDF an employer already downloaded. It also doesn't reach a board based in another country. Several other U.S. states run their own privacy laws. GDPR protects people in the EEA. Unless the company's notice says those rights apply, a U.S. job seeker shouldn't count on EU-style coverage.
Limit what you upload before you hit apply
Work through these in order. Skipping the early ones makes the later ones weaker.
- Create a job-search-only email. Add a separate number too if you can swing it. Keep your main inbox and personal cell off public profiles.
- Turn on 2FA or passkeys on LinkedIn, Indeed, and any freelance marketplace you use. Reused passwords bring old breaches back.
- Open the resume file and cut the extras. Full street address, gone. Headshots the role doesn't need, gone. License or ID numbers, gone. City and state usually suffice.
- Inside each app, shut off location access and extra ad personalization. Skip text-message recruiter contact if you don't want it.
- If you're in California, use a Do Not Sell or Share control where the site offers one, and consider a Global Privacy Control setting in your browser. Then use DROP for the brokers you never signed up with.
- Confirm the job is real before you apply. A listing that pushes you to WhatsApp and asks for a selfie with your ID is a harvest, not a hiring process.
- Twice a year, delete accounts you no longer need. Download your data first if you might want the history.
A VPN does not hide you from the job board
A VPN earns its keep on cafe Wi-Fi, and that's the honest case for one. It does not hide you from the board you just logged into, because that site sees the account either way.
Details people overshare without noticing
Salary history, health notes, and family plans have no business in a screening chat unless a lawful form asks a specific question. When it asks, answer exactly that. Nothing more.
Watch the casual stuff too. A badge photo here, a desk shot with readable mail in frame there. Even a driver's license sent to some stranger for verification hands over identity data in a single tap, and to be honest, most of those asks aren't the platform's real KYC flow anyway, they're just someone collecting a face and an ID because you were in a hurry. Skip them unless the official flow requires it.
Even a LinkedIn post announcing your last day feeds scrapers when your personal cell is in it. You can stay visible to recruiters and still keep your home address and your kids' names off the same page.
If you hire people, flip this around. Retire vendor test accounts and require MFA on admin logins. Applicant chats should not sit behind default passwords. Applicants can't patch your stack.
FAQ
Did someone steal 64 million McDonald's job applications? No. Weak admin credentials plus an IDOR issue could reach a pool of up to 64 million applicant records, according to the research. McDonald's also said nobody else used that weak account, and only a fraction of the records the researchers reached held personal information. Read 64 million as a ceiling on what the flaw could touch, not as confirmed theft of 64 million complete files.
Does Indeed sell my resume? The recruitment privacy policy says Indeed does not have actual knowledge of selling or sharing consumers' personal information under CCPA. Passing your application to employers you picked is the product doing its job, not a sale. Check the live policy. Use the deletion tools if you want the account gone.
Can I force a job board to delete my data? Often, yes. Start on the account or privacy page. California residents can also use the statutory request process. The stubborn copy is the PDF an employer already saved. Under the company's retention rules, that file may stay put, and you can't always pull it back.
Should I do a selfie ID check for a job app? Only inside the official flow of a platform you recognize, and only for a job you've verified. Biometric data is hard to rotate after a leak. A password gets changed in a minute. A face template sticks around.
If you're applying this week, set up the separate email and turn on 2FA before you send anything. Then send one deletion request to a board you no longer use.