Privacy Policy.
We believe your career history and personal contact details belong solely to you. We do not sell your data, train public AI models on your resumes, or retain ephemeral upload inspections.
Core Privacy Commitment
Your resume documents are private to your authenticated account. PDF and Word documents compile client-side in your browser via WebAssembly whenever possible, and files uploaded for ATS X-Ray inspection are processed ephemerally in RAM and never written to disk.
1. Information We Collect
Account Information: When you register an account, we collect your email address, display name, and securely hashed authentication credentials managed by our backend provider (InsForge). If you sign in via Google or GitHub OAuth, we receive only your verified email address, unique provider identifier, and name.
Permitted Email Domains: To prevent automated spam, bot registrations, and temporary disposable accounts, registration is strictly restricted to verified consumer and enterprise email providers (Gmail, Apple iCloud, GitHub, Microsoft Outlook, and Yahoo).
Resume Content: Content you actively draft or edit (name, contact links, employment history, education, skills, and projects) is saved in an isolated Postgres database with strict Row-Level Security (RLS) policies. Only your authenticated user ID can read, modify, or delete your documents.
2. ATS X-Ray Ephemeral In-Memory Inspection
When you upload an existing PDF or DOCX file to the ATS X-Ray tab for parser inspection:
- Zero Disk Writes: Uploaded files are received as an in-memory buffer (`Buffer.from`) in a sandboxed serverless micro-VM. Files are never written to the filesystem, `/tmp`, or object storage.
- Automated Security Sniffing: Uploads undergo automated binary magic-byte inspection to verify legitimate document headers and screen for malicious executables (`MZ`, `ELF`) or PDF exploit hooks (`/Launch`, `/JavaScript`, `/EmbeddedFiles`).
- Immediate Discard: Once text extraction and diagnostic analysis finish, the memory buffer is immediately garbage-collected. The file is not saved to any database or backup archive.
3. Client-Side WASM Compilation & Local Privacy
Our vector PDF generation engine runs on Typst compiled to WebAssembly (WASM) directly inside your web browser. When you click “Download PDF”, your resume data is formatted and compiled into vector PDF bytes locally on your device without sending your document to external third-party conversion servers.
4. AI Features & Model Privacy
Optional AI capabilities (such as the STAR/XYZ Accomplishment Interviewer or automated resume text structuring) transmit only the specific text excerpt you submit to an OpenAI-compatible API endpoint over encrypted TLS.
No Model Training: Your resume data is processed strictly for real-time inference and is never used to train public machine learning or foundational AI models. Every AI-assisted tool in the application features a 100% deterministic offline fallback if you choose not to use AI.
5. Cookies, Telemetry & Security Headers
We only set cookies strictly necessary for core functionality: HTTP-only session tokens, CSRF defense tokens, and OAuth state markers. We do not use third-party behavioral advertising or cross-site tracking cookies.
Our application enforces strict Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and `X-Content-Type-Options: nosniff` headers to guard against cross-site scripting (XSS) and clickjacking.
6. Data Portability & Right to Erasure (GDPR / CCPA)
You maintain complete ownership of your career data:
- Portability: You can export your resume at any time in industry-standard formats: Typst Vector PDF, Native Word DOCX, or machine-readable JSON.
- Erasure: Deleting a resume permanently deletes that document and all associated version history snapshots from the database.
- Account Deletion: To request complete deletion of your account and all associated data, you may initiate an account purge through your account settings or by contacting our team.