Privacy Policy

1. What We Collect

We collect the following categories of data:

• Account information — name, email address, and password (stored as a salted hash, never in plain text).
• Content you add — employment history, clients, projects, notes, code snippets, interview prep material, resumes, and profile details.
• Billing information — if you subscribe to a paid plan, payment details are collected and processed directly by Stripe; we never see or store your card number.
• Technical & session data — IP address (redacted before being written to logs), browser/device type, and session metadata used for security (e.g. showing your active sessions in Settings so you can revoke them).

2. How We Use Your Data

We use your data to:

• Operate the Service — authenticate you, store and display Your Content, generate resumes.
• Secure your account — detect suspicious activity, manage active sessions, enforce rate limits.
• Process payments and manage your subscription, via Stripe.
• Communicate with you about your account (e.g. account activation, password reset, billing receipts).

We do not sell your personal data or Your Content to third parties.

3. Cookies

We use a small number of strictly necessary cookies to operate the Service: httpOnly session cookies for authentication, and a non-httpOnly cookie used to prevent cross-site request forgery (CSRF) on requests that change your data. We do not use third-party advertising cookies.

4. Data Retention

We retain Your Content for as long as your account is active. Server logs containing technical metadata (with IP addresses redacted) are retained for a limited, configurable window for security and debugging purposes, then automatically deleted. Demo accounts (created via “Explore demo”) and all associated sample data expire automatically after a short period and are permanently removed on a recurring cleanup schedule.

5. Your Rights

From Settings → Privacy & Data you can, at any time:

• Export your data — download a full copy of everything you've stored, in JSON format.
• Delete your account — this permanently and irreversibly removes your account and all associated data.
• Manage sessions — view and revoke any active sign-in session on any device.

Depending on your location, you may also have additional rights under applicable data protection law (such as the right to correct inaccurate data or object to certain processing). Contact us to exercise these rights.

6. Third-Party Services

We rely on a small number of trusted third parties to operate the Service, including our payment processor (Stripe) and infrastructure/error-monitoring providers. These providers only receive the data necessary to perform their function and are bound by their own data protection obligations.

7. Children's Privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from them.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email before they take effect.

9. Contact

Questions about this Privacy Policy or your data? Email us at [email protected].