Privacy Policy

This policy describes how the Company handles personal information in the products named in the panel above (together, the "Service"). The panel says who the Company is and which law governs this document. The same policy applies whichever of those products you use, and whether or not you have an account.

A resume is unusually revealing: name, contact details, employment history, education, sometimes nationality or a photograph. Please read Section 4 before uploading anything you would not want processed by an external AI provider, and Section 7 to see how long we keep what you give us.

1. WHAT WE COLLECT

1.1 Because You Give It to Us

(a) Account: your email address, and a one-way hash of your password. We never store the password itself. If you sign up or sign in with Google, we receive your email address, your name and your profile picture address from Google instead of a password, and we keep them with your account;

(b) Profile: display name, headline and, if you upload one, an avatar;

(c) Resume content: the files you upload (PDF resumes, LinkedIn exports), a LinkedIn profile address you ask us to import and the public profile data fetched from it (Section 4), text you paste, the structured resume data extracted from any of those, everything you type into the builder and the editor, the photo on your resume if you add one, earlier versions of your resume, and the resumes, cover letters and application answers generated from them;

(d) Resume checks: the score, findings and written feedback produced when you ask us to check a resume;

(e) Job applications you track: the postings you save, the notes you write and the status you give them;

(f) Contacts you provide: if a feature asks you to provide information about other people (for example, references, or the email address of someone you invite to a group), we process it only to provide you that feature;

(g) Application correspondence: if you use an email feature (Section 4.3), mail received at a Service-provided tracking address you chose to hand out, or, if you connect an email account of yours, the messages the feature is scoped to read. Correspondence naturally includes the sender's information; we process it as part of your application tracking and for nothing else;

(h) Support correspondence: whatever you write to us.

1.2 If You Use the Service Without an Account

Some tools work before you sign up: you can start a resume, import one, or check one. That work is stored on our servers, not only in your browser. We link it to a random identifier kept in a cookie in your browser, so that you can carry on where you left off and so that the work becomes yours when you create an account. It includes whatever you typed, the file you uploaded, the LinkedIn data you asked us to import, and the results.

If you never create an account, we keep that work until you ask us to delete it (Section 8). We do not delete it automatically.

1.3 Because Using the Service Produces It

(a) Sign-in and device history: timestamps, IP address, browser and device description, and an approximate location derived from the IP address, for successful and failed sign-in attempts, including the email address typed in a failed attempt. It is kept so you and we can spot access you do not recognise;

(b) Sign-up record: the IP address and approximate location you signed up from, the method you used (password or Google), and the page that brought you to us;

(c) Usage records: which tools you ran, when, and how many credits they spent, including a record of each AI request (its purpose, size, cost and outcome). If an AI request fails, we may store the provider's response to find out why, and that response can quote the content you sent;

(d) Agreement records: when you accept the Terms at signup, we keep a receipt of exactly which document versions were offered and accepted, when, and from where (IP address, browser description and approximate location derived from the IP address), so both of us can later prove what was agreed;

(e) Download records: each time a PDF is produced we keep a fingerprint of the file (a checksum, not the file), so that we can later tell whether a document came from the Service;

(f) Technical logs: ordinary web-server and application logs, and self-hosted, cookie-less page analytics (Section 6).

1.4 Because You Pay Us

Billing records: a customer identifier from our payment processor, subscription and purchase state, and receipts. Card numbers go directly to the processor; they never reach our servers.

We do not buy personal information about you from data brokers, we do not sell it, and we do not share it for advertising.

2. WHY WE USE IT

(a) To run the features you ask for, and to show your own content back to you;

(b) To keep your account secure and to investigate abuse, fraud and attacks;

(c) To meter credits and take payment;

(d) To send service email: confirmation, password reset, receipts, security notices, notices about these documents, and account changes;

(e) To keep the Service working: debugging, capacity, and fixing what breaks;

(f) To tell you, occasionally, about a significant change to a product you signed up for. Every such email says how to stop receiving them.

We do not use your content to train AI models of our own.

3. BOT PROTECTION

Sign-up, sign-in, file upload and LinkedIn import are protected by Cloudflare Turnstile, which receives your IP address and challenge data to decide whether a submission is automated.

4. AI AND IMPORT PROCESSING

4.1 AI Processing

The checker, the import step, the builder's rewrites and the application tools work by sending the relevant content to an external AI provider (Anthropic) over its API, which returns the output you asked for. In practice this means your resume leaves our servers and is processed by that provider for as long as it takes to answer. That includes:

(a) the file you upload, sent whole;

(b) the text of your resume, including the name, email address, phone number and location written on it;

(c) the public LinkedIn data you asked us to import;

(d) the job posting you paste in or link to.

We do not send your account's sign-in email as such, your password, your payment details or your sign-in history. We do not control the AI provider's own processing; if that matters to you, read its terms before uploading.

Scores, findings and generated text are produced automatically. They have no legal effect and are not a decision about you. They are suggestions on a document you control.

4.2 LinkedIn Profile Import

If you give us a LinkedIn profile address to import, we send that address to a data provider (Enrich Layer), which returns the profile's public data: the information LinkedIn shows to the world, including the profile photo. We do not ask for your LinkedIn password, we never sign in to your account, and we only receive what is public. Import a profile only if it is yours or its owner asked you to (see the Acceptable Use Policy).

4.3 Email Features

If we offer email features and you use them:

(a) A Service-provided tracking address receives whatever is sent to it. We store those messages, show them to you, and may process their content automatically, including through the AI provider in Section 4.1, to detect application status (interview, rejection, offer) and link messages to the applications you track;

(b) A connected inbox is accessed only with your explicit authorization, only within the scope the feature describes when you connect it, and only to provide the feature. You can disconnect at any time from your settings or at your email provider, which ends our access. We do not use your mailbox for advertising, and we do not read correspondence beyond the feature's scope;

(c) If you connect a Google account, our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements;

(d) Status classifications are automated, best-effort suggestions with no legal effect. The message itself is always available to you, unchanged.

4.4 Browser Extension

If we offer a browser extension and you install it:

(a) It reads and processes page content only on pages where you invoke it (for example, a job posting or application form you ask it to work on) and only to provide the feature: recognizing the form, filling it from your content, and linking the posting to your tracked applications. It does not collect your browsing history, does not read pages you did not invoke it on, and does not sell or share what it sees;

(b) Its use and transfer of information adheres to the applicable browser store's user-data policies (for Chrome, the Chrome Web Store User Data Policy), including their Limited Use requirements;

(c) You can uninstall it at any time, which ends its access entirely.

5. WHO ELSE SEES IT

5.1 Service Providers

We use these providers to run the Service. Each gets only what its job requires:

Provider	What it handles
Anthropic	resume content and job-posting text sent for AI processing (Section 4.1)
Enrich Layer	the LinkedIn profile address you submit for import, returning its public data (Section 4.2)
Stripe	payments, subscriptions, receipts; it receives the email address and name on the paying account
Google	sign-in with Google, if you choose it
Amazon Web Services (SES)	outbound email: the recipient's address and the message
Cloudflare (R2, Turnstile, network)	storage of uploaded and generated files, bot protection, and the network our traffic passes through, which tells us the approximate location of an IP address
Hetzner	the servers the Service runs on, in the United States
Backblaze B2	off-site database backups
Telegram	the private channel where we receive our own operational alerts; a billing alert includes the customer's email address and the amount, and an error alert includes the error message
jsDelivr	delivers one script (the phone-number field); your browser's request shows it your IP address

Page analytics run on our own infrastructure (Section 6), so no analytics company is on this list.

5.2 Public Profiles

If you have a public profile, it is a page anyone can open. It shows your name, headline, summary, work history, education, skills, links and, if your resume has one, your photo. It does not show the email address, phone number or location written on your resume, and visitors are not offered a PDF of it.

A public profile can be indexed by search engines. Making it private in your settings stops us serving it, but copies that search engines or other people already made are outside our control.

Profiles that were public on the earlier version of the Service stayed public when we moved them to this one. Their owners can make them private at any time in their settings, or by writing to the privacy address below.

5.3 Groups and Organizations

If you join a group or organization in the Service, its administrators can see that you are a member and the email address you joined with. If you invite someone, we send the invitation to the address you give us and keep it with the invitation.

5.4 Recipients You Choose

If you enable a feature that sends materials somewhere at your direction (for example, submitting an application you approved to an employer or its applicant-tracking system), the materials you approved go to the recipient you chose, and from that moment are handled under the recipient's own practices, which we do not control.

5.5 Aggregated and De-identified Data

We may create, use and publish statistics derived from use of the Service in a form that does not identify you or any person, for example aggregate scoring benchmarks. De-identified data is kept de-identified.

5.6 Everything Else

Beyond that we disclose personal information only when the law requires it, when it is needed to protect the Service or someone's safety, or as part of a sale or reorganisation of the business, in which case this policy continues to apply until it is replaced and you are told.

6. COOKIES, BROWSER STORAGE AND ANALYTICS

We do not run third-party advertising or cross-site tracking cookies. What we set is this:

What	Purpose	How long
Session cookie	keeps you signed in, and holds the random identifier for work done without an account (Section 1.2)	until you close the browser
"Remember me" cookie	keeps you signed in between visits, if you ask for it	one year, or until you sign out
App sign-out cookie	lets our mobile app finish signing you out	two minutes
Turnstile	whatever Cloudflare needs to run its challenge (Section 3)	set by Cloudflare
Browser storage	your light or dark theme, and small interface details such as which tab you had open	the theme until you clear it; the rest until you close the tab

For page analytics we run Umami on our own infrastructure: it counts page views and referrers, sets no cookies, does not fingerprint you across sites, and no third-party analytics company receives anything.

7. HOW LONG WE KEEP IT

What	How long
Your account and its content: resumes and their earlier versions, uploaded files, imported LinkedIn data, checks, tracked applications, cover letters	until you delete it, or close your account
Work done without an account (Section 1.2)	until you ask us to delete it, or until you create an account and it becomes part of it
Sign-in and device history	twelve months
Agreement records (Section 1.3)	for as long as we may need to show what was agreed, which continues after an account is closed
Records of AI requests	kept as accounting records; when you close your account they are detached from you and any stored provider response is erased
Billing records	for as long as tax and accounting rules require, by us and by our payment processor
Database backups	ten days
Server logs	limited in size; the oldest entries are overwritten as new ones arrive

Closing your account from your account settings deletes your account and the content attached to it: resumes, uploaded files, imported data, checks, tracked applications, download records, your sign-in history and your link to Google. A Service-provided tracking address stops receiving, and any connected-inbox authorization ends.

An account cannot be closed while it holds an active subscription or while it owns a group other people belong to; cancel or hand over first.

What outlives a closed account is what the table says: agreement records, billing records, detached AI accounting records, and backups until they expire.

8. YOUR CHOICES

(a) See and change your account details, and close your account, in your account settings;

(b) Make a public profile private in your settings;

(c) Review and sign out your active devices from your session history;

(d) Export any resume as a PDF at any time;

(e) Ask us for a copy of your data, a correction, or deletion by writing to the privacy address below. We will ask you to confirm you control the account before acting;

(f) If you used the Service without an account and want that work deleted, write to the privacy address below and tell us the name and the email address written on the resume, and roughly when you used the Service, so that we can find it. We may ask a question or two to make sure the resume is yours.

Service email (confirmations, receipts, security notices, notices about these documents) is part of having an account and cannot be unsubscribed from while the account is open.

We answer requests from anyone, wherever they live. We do not charge for them.

9. SECURITY

Traffic is encrypted in transit. Passwords are stored only as bcrypt hashes. The details in agreement records are encrypted in our database. Access to production data is limited to the people who operate the Service. The database is backed up off-site every night over an encrypted connection. What you type into the builder and the editor is filtered out of our request logs. No system is perfectly secure; if a breach affects you, we will tell you.

10. CHILDREN AND TEENAGERS

The Service is not for children under 13. Do not use it if you are under 13, and do not upload a child's information. We do not knowingly collect personal information from a child under 13; if we learn that we hold any, we will delete it, and you can tell us at the privacy address below.

If you are 13 or older but not yet an adult where you live, use the Service only with the permission of a parent or guardian, who agrees to the Terms of Service on your behalf. Public profiles are for adults.

11. WHERE PROCESSING HAPPENS

The Company, its servers and most of the providers listed in Section 5 are in the United States, and some providers operate in other countries. Using the Service means your information is processed in those countries, which may have different data-protection rules from yours.

12. CHANGES

We may update this policy. The date at the top of this page is when it last changed. If a change materially affects how we handle your information, we will tell you by email or in the app before it takes effect.

Questions, or a request about your data, go to the privacy address below.