Privacy Policy
FirstInternships is an independent college internship directory. You can browse the directory and use the personal planner without an account. This policy explains the optional account, personalized-email service, private Talent Network profile and resume upload, browser-local planner, and the service providers that help operate the site.
Optional accounts and sign-in
If you create an account, we collect your email address. You can sign in with Google or with a passwordless link sent to your email. We use Supabase to provide authentication and store the account, so FirstInternships does not ask you to create or store a password. Supabase may process the email address, authentication events, session information, IP address, and device or browser information needed to authenticate you, secure the account, and prevent abuse.
If you choose Google, Google authenticates you and provides Supabase with the basic account information needed to sign you in, such as your email address and basic profile information. FirstInternships does not request permission to read your Gmail messages, Google Drive files, or Google contacts. Google and Supabase process sign-in information under their own privacy practices.
Signing in with Google, requesting a magic link, or creating an account does not by itself subscribe you to newsletter or marketing email. Newsletter consent is a separate, optional choice. You must control the account or email address you use. Do not forward an account link or send it to us.
Personalized internship newsletter
The newsletter is optional. If you choose it, we store the preferences you submit, which may include college year, expected graduation year, fields of interest, preferred locations and work arrangements, whether you want only opportunities sourced as paid, and a weekly or biweekly cadence. We use those choices to select relevant guides from the FirstInternships catalog. If you choose the newsletter before opening the sign-in link, the browser temporarily stores those preferences, without your email address in that temporary record, so it can finish the request after sign-in.
The opt-in is unchecked by default. We activate the newsletter only after an affirmative opt-in from an authenticated account whose address Supabase has verified; if the address has not already been verified, we send a separate confirmation link first. We keep subscription status, consent and unsubscribe events, hashed confirmation-token records, signed unsubscribe credentials, selected program identifiers, send times, and limited delivery results so we can honor your choice, prevent duplicate sends, operate the service, and respond to bounces or spam complaints. Tokens are designed to be limited-use credentials; do not share confirmation, unsubscribe, or account links.
Matches are based on the preferences you provide and the directory information we maintain. A match is not an employer decision or a guarantee that a program is currently open, that you qualify, or that you will receive an interview or offer. Always check the linked official source.
You can change your matching preferences in the account page. You can unsubscribe from any newsletter without signing in by using its unsubscribe link, or opt out from the account page while signed in. Unsubscribing stops future marketing newsletters but does not automatically delete your account or information we must keep to remember and honor the opt-out.
Private Talent Network profiles and resumes
FirstInternships also publishes read-only directory search tools for compatible AI assistants. Those tools can search public internship guides and return the secure Talent Network handoff page, but they do not receive or upload resumes, accept the Talent Network notice, read private profiles, apply to employers, or guarantee placement. The private process begins only in the authenticated FirstInternships interface when you select the PDF and choose Yes.
The Talent Network is an optional candidate pool for authenticated college students who confirm that they are at least 18. It is separate from account creation and the newsletter. Joining the newsletter does not create a candidate profile, and joining the Talent Network does not subscribe you to email alerts.
At or before collection, the Talent Network form explains that we collect the resume to build a private candidate profile, identify possible internship matches, and contact you. The fast intake accepts one PDF, up to 5 MB, followed by one affirmative Yes-or-No decision. If you choose Yes, you confirm that you are at least 18 and authorize the private AI profile-building and matching described here. The resulting structured profile may include your name, college or university, degree or major, college and graduation year, career fields, broad preferred locations, work arrangements, desired roles, skills, and experience keywords. You can review and correct the result after processing. Do not include a Social Security number, birth date, home address, banking information, government identification number, medical information, photograph, or any information you do not want processed for candidate matching.
Supabase stores the structured profile and private resume file. The resume bucket is not public, and an authenticated account is limited to its own fixed file path. We keep consent version and time, age-confirmation time, profile status, upload time, update time, AI-matching and indexing status, and limited consent-history events needed to operate the service and document your instructions. Consent-history records do not contain resume content, email, school, desired role, or protected-trait data.
If you choose Yes in the fast intake, the resume is sent through our server to Google's Gemini service so it can extract job-related profile fields, skills, role keywords, experience keywords, and a short job-related summary. Google processes the PDF and request data as our AI service provider under the applicable Google Cloud/Generative AI terms and data practices. FirstInternships stores the resulting structured profile and derived private index in Supabase; it does not store raw extracted resume text in the matching index. The index excludes your name, contact details, school, links, filename, file path, and protected-trait fields. AI output only helps FirstInternships identify possibilities for human review. It does not make hiring decisions, determine whether you qualify, reject you, or authorize employer access.
Phase 1 is private candidate collection and internal matching only. Employers cannot browse or search the pool, and FirstInternships is not currently submitting candidates or making placements. Your profile lets FirstInternships use the information internally to identify possible opportunities and contact you. It does not authorize us to give an employer your resume or contact details. A future employer introduction requires your separate approval for that named opportunity. We do not sell resume lists or give employers bulk database access.
If a paid placement service launches, the employer—not the student—may pay FirstInternships for a successful placement. Joining does not guarantee a match, introduction, interview, offer, compensation, or job. Matching is not an employer decision, and an employer remains responsible for its hiring process.
You can update or replace the profile and resume, pause matching, turn off AI-assisted matching, export the structured profile, download your own resume through a short-lived private link, or delete the profile and stored resume while signed in. Turning off AI matching removes the derived resume index and pending indexing job while keeping the private profile and PDF available to you. Talent Network deletion removes the profile, stored PDF, derived index and pending suggestions; it does not delete the authentication account, newsletter state, browser-local planner, or an employer application. We may retain a minimal consent/deletion record where needed to document the instruction, secure the service, resolve disputes, or comply with law.
Email delivery providers
We use Resend to deliver newsletter confirmation messages and newsletters. Resend processes the recipient address, sender information, message content, delivery identifiers, and technical delivery events such as accepted, delivered, bounced, or complained status. Supabase or the email service configured for Supabase Auth processes account magic-link messages. These providers handle information under their own terms and privacy practices as service providers to us.
Local planner data
Saved programs, preparation checklists, planning stages, next-action dates, and notes are stored in your browser's local storage. They are not uploaded to your account, sent to our servers by the planner, or used to personalize newsletters. Signing in does not synchronize the planner between devices. Other people using the same browser profile may be able to see it. Avoid putting sensitive personal information in notes.
Your planner is specific to that browser and device. Clear it using the planner's clear button or your browser's site-data settings. Clearing site data or using private browsing can remove it. CSV and JSON backup exports stay wherever you save them and are not deleted when you clear the planner or an account.
JSON backups include saved programs, notes, stages, dates, and checked preparation prompts. They are not encrypted. Keep them somewhere private. Restore files are read locally in the page, not uploaded to our servers. A preview appears before restoring. Add-missing mode keeps already-saved records unchanged; replacing the entire planner overwrites records and removes programs absent from the backup after an explicit acknowledgement and confirmation. CSV is for spreadsheets and is not a restorable backup.
Comparison, calendar, and timeline tools
Comparison choices are stored in the tab's session storage, separately from the account and planner. Close the session or use Clear selection to remove them. Comparison links contain only public program identifiers, not private notes; anyone receiving a link can see the selected programs. Requests for shared URLs may be processed by the hosting provider.
Calendar downloads are local snapshot files. Published-cutoff files contain sourced employer cutoffs. Personal-action files contain today's and future all-day dates you entered for saved programs that are not marked Closed; they intentionally exclude private notes and past action dates. Personal action dates are not employer deadlines. If you import a file into a calendar provider, that provider handles the imported information under its own policies. We do not access your calendar or receive your imported events.
The timeline builder processes the selected program, target date, optional recommendation checkpoint, and temporary checkmarks in the page. Those personal values are not stored by the account service. Personal-plan calendar and text files are generated in your browser and remain wherever you save them.
Contact messages
Our contact form opens an email draft in your email app; it does not submit a message to us by itself. If you send an email, we receive your address and the information you choose to include. We use it to respond, evaluate corrections, administer privacy or account requests, and maintain the directory. Do not email resumes, transcripts, government identifiers, passwords, magic links, or other sensitive documents. Use the signed-in Talent Network page for its optional private PDF upload.
Hosting, fonts, and audience measurement
The hosting and security providers may process request information such as IP address, device or browser details, requested URL, and time to deliver and secure the site. Fonts are loaded from Google Fonts, which receives requests for those resources.
We use Vercel Web Analytics, served from this site's domain, and Cloudflare Web Analytics, which loads a script from Cloudflare, to understand site traffic and performance. These services are configured as cookieless audience measurement and are not intended to identify a visitor or build a cross-site profile. They may receive the page address, referrer, and basic browser and page-performance information. If you submit the directory search form, the search term becomes part of the page address.
We also use broad, fixed-name events to measure aggregate actions such as an engaged page view, use of a directory or guide filter, public calendar or timeline-tool use, official-program clicks, signup-flow progress, completed newsletter opt-ins, Talent Network page views and profile-flow milestones, and partnership inquiry starts. These events do not include the search text, selected filter, program selection, target date, email address, newsletter preferences, candidate profile fields, resume name or content, planner records, notes, or other visitor-supplied values.
Advertising and sponsorship
Google AdSense is planned. Ad requests are disabled by default until an approved publisher configuration and applicable consent setup are enabled. Advertising configuration is separate from accounts, newsletters, and the local planner.
When enabled, third-party vendors, including Google, use cookies or similar technologies to serve and measure ads based on a visitor's prior visits to this website or other websites. Google's use of advertising cookies enables Google and its partners to serve ads based on visits to this site and other sites on the Internet. Where permitted and selected, this may include personalized advertising.
Review how Google uses information from partner sites. You can manage or opt out of Google personalized advertising in My Ad Center, and you can opt out of some other participating vendors through YourAdChoices. If other third-party ad vendors or networks are enabled, the active consent message will identify them and link to their information and choices.
Before advertising launches, we must publish applicable consent and opt-out messages, including a Google-certified consent-management platform where Google requires one. The published message must provide the relevant choices and a way to reopen privacy and cookie settings. This policy notice is not itself a consent-management platform and does not replace those controls.
We may also run clearly labeled newsletter sponsorships or employer campaigns. Sponsors do not receive subscriber addresses, account records, local planner data, candidate profiles, resumes, or individual preferences. We may provide aggregate campaign reporting, such as total sends or clicks, when it does not identify individual students. A future candidate placement is a separate service and still requires the candidate's opportunity-specific approval; a sponsorship does not buy resume access.
Employer links
Applications take place on official employer or program websites. They have their own privacy policies and may collect application information. We do not collect or submit your application, access your employer portal, provide your account or newsletter preferences to a listed employer, or know the employer's decision. The Talent Network profile is not an application to any listed program.
How we use and share information
We use account and newsletter information to authenticate you, operate settings, match directory content, send email you confirmed, honor unsubscribe and suppression choices, prevent duplicate sends, secure and troubleshoot the service, and understand aggregate service performance. We use Talent Network information to operate the private profile, identify possible job-related matches, contact the candidate about those matches, and—only after separate specific approval—support an introduction to a named employer opportunity. We do not sell account, newsletter, candidate-profile, resume, or local planner information. We do not provide subscriber or resume lists to listed employers or advertisers.
Service providers may process information on our behalf to host, secure, authenticate, email, and measure the service. We may also disclose information when required by law, to protect rights and safety, or as part of a business transaction subject to appropriate safeguards and notice where required.
Retention, access, export, correction, and deletion
We retain account, active-subscription, and active or paused Talent Network information while it is needed to provide the service. We retain delivery diagnostics, consent records, security logs, and minimal candidate-instruction records only as needed to operate and secure the service, document consent or deletion, meet legal obligations, resolve disputes, and enforce agreements. After an unsubscribe or deletion request, we may retain the minimum suppression and consent evidence needed to honor the instruction, prevent accidental reuse, address abuse, or comply with law.
The signed-in Talent Network provides profile export, correction, pausing, resume replacement and deletion controls. To request access to, a machine-readable export of, correction of, or deletion of broader account, newsletter, or Talent Network information, email contactfirstinternships@gmail.com from the account address and describe the request. We may need to verify that you control the account before acting. Rights and exceptions vary by location. We cannot retrieve or delete planner data stored only in your browser, exported files on your device, employer application data, or data held independently by another service.
Security
We use access controls and other technical and organizational safeguards appropriate to the service, but no online system or email transmission is perfectly secure. Use a device and email account you trust, sign out on shared devices, and contact us if you believe an account link or session was misused.
College audience and children
The directory is intended for current college students and is not directed to children under 13. The Talent Network is limited to people who confirm they are at least 18. Do not create an account or submit personal information if you are not permitted to do so in your location.
Updates
We may update this policy as the site's data practices change. The date above identifies the latest version. Material changes will be presented as required by applicable law.