Local-first job search aggregator - 400KB of vanilla JS, no framework

I just launched JobPilot AI on Product Hunt - a job search tool that runs entirely in the browser. No signup, no cloud, no tracking. Your CV never leaves your device.

Why I built it

Every "free" job board I tried was quietly selling my data to recruiters I never asked for. Got tired of it. So I made one that doesn't.

The stack

Vanilla JS, no framework, no build step
~400KB total payload
All user data lives in localStorage - profile, CV text, saved jobs, settings
Resume parsing in-browser: PDF.js for PDFs, Mammoth.js for DOCX
Match scoring: local TF-IDF-style algorithm + skill keyword overlap. No LLM API call.
Reply text: template-based with style variants, also local
PWA with a service worker, installable, works offline after first load
5 languages (EN/RU/UK/DE/PL), no cookies
Hosted on Cloudflare Pages (free), Python backend on Render free tier
Total monthly cost: $0

Live search

Aggregates 12+ public job board APIs in one call:
Remotive, Himalayas, Arbeitnow, Jobicy, Work.ua, Djinni, Freelancer, RemoteOK, We Work Remotely, No Fluff Jobs.

Only keyword + location go out. No PII, no resume content transmitted.

What surprised me building it

Public job board APIs aren't standardized at all. Each one has a different shape, different rate limits, different "remote" flag conventions.
Relevance filtering had to be client-side - backends return loosely-matched jobs, so I do a second pass against the user's resume locally.
Cookieless analytics (Cloudflare Web Analytics) is genuinely a thing now. Privacy-first doesn't have to mean "no data ever".

Stuff I'm thinking about

The local match scoring vs cloud LLM trade-off - speed and privacy on one side, smarter ranking on the other. For now I'm sticking local.
Whether "no signup" is too radical for the average user (most expect cloud sync).
How to eventually reconcile privacy-first with "but I want recruiters to find me".