1. Data we store
- Account — name, email, and a password stored as a bcrypt hash. If you sign in with Google or GitHub, we receive your name, email, and profile photo from that provider.
- Onboarding — answers to the short survey after sign-up (purpose, career stage, industry, how you found us). Used only as aggregate statistics in the admin panel.
- CV content — everything you write in the editor, plus your template, layout, font, and colour choices.
- Files — CV photos and PDFs you upload for import, up to 3 MB each. Imported PDFs are deleted right after processing, whether it succeeds or not.
- AI keys — your own Groq or OpenRouter key, encrypted with AES-256-GCM before it is stored. The app only ever shows its last four characters.
- Technical data — your IP address is used for rate limiting. The counters are short-lived and not linked to your CV content.
2. How we use data
Data is used to run the service: storing and showing your CVs, generating PDFs, securing your account, and preventing abuse. We do not sell, rent, or share personal data or CV content for advertising.
3. AI features
AI features use your own API key. When you press Paraphrase, Generate, or import a PDF, the relevant text is sent directly to Groq or OpenRouter with that key. Processing there is governed by each provider's terms. We do not use CV data to train models.
4. Where data is stored
- Database — PostgreSQL (Supabase).
- Files — Cloudflare R2 in a private bucket. Files can only be opened through the app by their owner, never through a public link.
- Rate limiting — Upstash Redis.
- Hosting — Vercel.
6. Deleting your data
- CVs — delete any time from the dashboard; the CV content and photo are permanently removed.
- Account — open the profile menu → Edit profile → Delete account. All CVs, files on R2, and AI keys are permanently deleted and cannot be recovered.
- API keys — can be removed yourself at any time on the AI credentials page.
7. Security
All connections use HTTPS. Passwords are hashed with bcrypt, API keys are encrypted with AES-256-GCM, accounts are temporarily locked after repeated failed sign-ins, and changing your password ends sessions on every device within a few minutes. No system is entirely risk-free; please report any security issue you find.
8. Changes to this policy
If this policy changes, the date above is updated. Significant changes will be announced in the app.
9. Contact
Questions or requests about your personal data can be sent to the app's operator through the contact details on the home page.