Privacy Policy
Foray is an engineering search firm. Engineers tell us what they want next and we bring them roles; companies tell us what they are hiring for and we bring them engineers. This policy explains what we collect while doing that, why, who else sees it, and what you can ask us to do about it.
It covers this website, the forms on it, our phone line, our text conversations, and the candidate portal.
Who we are
Foray is operated by GoForay, Co., a Delaware corporation, with a registered office at 131 Continental Drive, Suite 305, Newark, Delaware 19713. Reach us at contact@goforay.io.
What we collect
If you are an engineer
When you join the pool, the form asks for your name, email, LinkedIn, GitHub, and a short note on what you want next. Optionally: a piece of work you are proud of, years of experience, timeline, location and remote preference, and your work authorization. If we go on to work with you, we also hold your résumé, the roles we put you forward for, and the messages we exchange.
If you are hiring
Your name, company, email, the role you are filling, the job posting link, and the job description.
Calls
Our intake assistant is an AI. It says so at the start of every call, and it asks your permission to record before it asks anything else. If you say no, we do not record and we do not continue — a person follows up instead. Permission is asked per call, not once and assumed forever. Where we record, we keep the recording and a written transcript.
Texts
The messages you exchange with us, any files you send in a thread, and the record of how and when you agreed to be texted.
Connected apps, only if you choose to connect one
You can connect Gmail, Outlook, or GitHub so we can find your résumé instead of making you dig it out. If you do:
- We request read-only access and nothing wider — Gmail
gmail.readonly, MicrosoftMail.Read, GitHubread:user. We never request permission to send mail as you. - We run a fixed set of searches looking for résumé attachments. We do not read your email for content and we do not index your mailbox.
- What we keep is the résumé file and basic profile facts. Subject lines, bodies, and snippets are not stored — there is no field in our system that holds them.
- Tokens are encrypted at rest. We read once when you connect, and again only if you ask us to re-check. There is no background sync.
- Disconnect any time. We delete our copy of the token and revoke it upstream where the provider allows it — Google and GitHub do; Microsoft does not, so we delete our copy and you can revoke it from your Microsoft account.
Automatically
When you submit a form we store your browser's user agent, the page that referred you, and a salted hash of your IP address. The hash is used to rate-limit submissions and nothing else — we do not keep the IP itself. This site does not use advertising or cross-site tracking cookies. We use privacy-preserving analytics to count page views in aggregate.
What we do not ask for
Salary history. We ask what you are targeting going forward. We never ask what you make now or made before, and if you mention it we do not record it or use it to steer anything.
Protected characteristics. We never ask about your age, race, religion, health, disability, family or marital status, or pregnancy. If you volunteer something in one of these categories, our assistant acknowledges it and moves on — there is no field for it to land in.
How we use it
- To match engineers to open roles, and roles to engineers.
- To prepare and submit applications where you have asked us to.
- To tell you where things stand and to answer your questions.
- To introduce you to a company, once you have told us that is okay.
- To keep a record of the permissions you gave us and when.
- To operate, secure, and improve the service, and to meet our legal obligations.
We do not use your information to train third-party AI models, and we do not use it for advertising.
Text messaging
We text you only if you asked us to. There are two ways that happens: you tell us yes on a recorded call when we ask, verbatim, “Can I text you updates at this number?” — or you text our number first. Only a clear yes counts; we do not re-ask or rephrase to get a better answer. The forms on this site do not collect a phone number and are not a way to opt in to texts.
Our first message identifies us and asks you to reply so we know we have the right number. Nothing else goes out until you do. After that, our messages are about your own search: application status, roles that match what you told us, requests for a missing detail, and replies to what you send us. They are not marketing.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of data sharing described in this policy exclude text messaging originator opt-in data and consent; that information is not shared with any third party.
Reply STOP at any time and we stop texting you. Reply HELP for help. Message frequency varies with your own search. Message and data rates may apply.
Our voice and text line is coming soon. We will publish the number here once it is live.
Who we share it with
Companies hiring
The point of the service is getting your profile in front of a company that is hiring, and we ask you before we do it. When we submit an application on your behalf, the company receives what any applicant would send: your résumé, your cover letter, and your answers to their questions. Anything you tell us you would rather we did not repeat to a company, we do not.
Service providers
They process your data on our instructions and for no purpose of their own.
| Provider | What they handle |
|---|---|
| Vercel | Website hosting and form submissions |
| Twilio | Our phone number, calls, and text messages |
| Retell AI | The voice assistant — call audio and transcripts |
| Linq | Message delivery on our text channel |
| Anthropic | The AI models behind the assistant |
Legal
We disclose information where the law requires it, to respond to lawful requests, to enforce our terms, or to protect the rights and safety of people using the service. If we are ever part of a merger, acquisition, or sale of assets, your information may transfer with it, and this policy travels with it.
What we do not do
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We do not buy, rent, or trade phone numbers, and every number we text belongs to someone who asked us to.
How long we keep it
We keep your profile, your submissions, and our message history for as long as you are working with us and for a reasonable period afterwards, so a returning engineer does not start from nothing. Records of the permissions you gave us — including a text opt-in and the exact wording you heard — are kept for as long as we may need to show consent was given. Ask us to delete your information and we will, subject to records we are required to keep.
Your choices and rights
- Stop the texts — reply STOP, any time.
- Disconnect an app — from the connect page, any time.
- Stop us sharing with companies — tell us, and we stop.
- See what we hold, correct it, or delete it — email contact@goforay.io.
If you are a California resident, the CCPA and CPRA give you the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing (we do neither), and not to be treated differently for exercising any of these. We verify identity before acting on a request and respond within the time the law allows. You may use an authorized agent.
Under California law, candidates are entitled to the pay scale for a role on request. Ask us and we will get it for you.
Automated decisions
Our assistants collect information and prepare applications. They do not decide whether you get hired — companies do. Where we rank roles, we rank them against the preferences you gave us. If you would rather a person looked at your file instead of the assistant, ask and we will arrange it.
Security
Access to your data is limited to the people who need it. Connected-app tokens are encrypted at rest, traffic to our servers is encrypted in transit, and IP addresses are hashed rather than stored. No system is perfectly secure and we will not pretend otherwise — but if a breach affects you, we will tell you as the law requires.
Minors
Foray is for adults. We do not knowingly collect information from anyone under 18. If our assistant realizes it is talking to a minor, it stops and hands off to a person. If you believe a minor has given us information, email us and we will delete it.
Changes
We will update this policy as the service changes. The effective date at the top tells you which version you are reading, and we keep a record of the wording that was in place when you gave us each permission — so a change here never rewrites what you originally agreed to.
Contact
Questions, requests, or complaints: contact@goforay.io, or write to GoForay, Co., 131 Continental Drive, Suite 305, Newark, Delaware 19713.