Where not to use AI: designing a private, cost-aware job-search app

Job Tracker searches German job sites, tracks applications, writes motivation letters and prepares you for interviews. The most useful design decisions weren't about which model to use. They were about which parts of the problem the model shouldn't touch.

Split the work: certainty versus judgement

Some parts of the problem need certainty, others need judgement. Search and ranking need certainty. The app asks each job site for matches, then scores every job with fixed rules: a keyword in the title, the distance from your town, how recently it was posted. Every result shows its reasons. This is plain code: free, instant, and explainable.

Letters and interview preparation need judgement: connecting someone's experience to what a company asks for, in natural German or English. That's what language models are good at, so that's where the AI goes. Anthropic's own guidance on workflows and agents makes the same point: start with the simplest design that works.

Privacy before the prompt

A CV is about as personal as documents get. So the app masks it on your computer before any request is sent: name, address, phone, email and profile links become placeholders. The model never sees them. When a letter is exported as a PDF, the details are added back, locally. Don't send something and hope the model ignores it. Decide what leaves the machine before it leaves.

Ground it, and show the gaps

A letter may only use facts from the CV. When a job asks for something the CV doesn't show, such as fluent German or video editing, it goes into a list for you rather than into the letter. The job ad itself is treated as data, never as instructions.

Make cost visible, then measure before tuning

Every button that calls the model shows its approximate cost. Three controls keep the bill down:

• Identical requests aren't sent twice. If nothing has changed, the saved answer is shown for free.
• Prompt caching reuses the parts that repeat, at about 5% of the normal price.
• The reasoning level was measured, not guessed. A lower setting saved only about 20% on two real letters, and the higher one tied the CV to the ad slightly better. A letter costs 6–9 cents either way, so quality won.

Testers never get the API key

Handing a tester your API key means they can use it for anything. Building the key into the app doesn't help either: anything the app can read, a determined user can read. So the key lives in a small serverless backend on AWS. Testers sign in with Amazon Cognito; the backend accepts only the app's three request types, builds those requests itself, and enforces a monthly limit per person. Because a careful letter can take longer than API Gateway's 30 seconds, it runs behind a Lambda function URL and checks the sign-in itself.

Respect the data sources

The app reads job sites only through interfaces they offer for this, such as the Bundesagentur für Arbeit and the public job boards of company career pages. Never by scraping pages whose terms forbid it. For LinkedIn, StepStone and others, it gives a one-click link that opens their search, pre-filled, in your own browser.

Why there's no MCP (yet)

The Model Context Protocol (MCP), which Anthropic introduced as an open standard, lets a model decide which tools to call. It's powerful when questions are open, like "Which applications should I follow up on, and what should I say?". But every AI task in this app is fixed, and the code knows exactly what each one needs. Adding tools would mean more requests, more cost, and a weaker promise than "the model receives exactly this".

What's next

• Daily alerts by email.
• A chat over your own applications, where MCP would earn its place.
• The desktop stays the workspace, so data stays local. Later, a light phone companion for new jobs and statuses, without the CV.

Two lessons I didn't expect

Test on real data. A list of German and English word variants passed its tests, but one live search showed it matched "intern" in German ads, where it means "internal".

Write the decisions down. Every trade-off went into a short decision record: what was chosen, what else was possible, and what it costs. It turned the project into something to learn from, not just something that works.