Your privacy matters to us.

Account information: Name, email address, and profile photo (via Google or email signup).

Resume data: Resumes, cover letters, career history, skills, education, and knowledge bank entries you create or upload.

Job data: Job listings you track, apply to, or save for reference.

Usage data: Pages visited, features used, and interaction patterns — collected anonymously to improve the product.

Payment data: Processed by Stripe. We do not store credit card numbers on our servers.

To provide and improve the resume builder, AI suggestions, and job tracking features.

To personalize your experience and save your work across sessions.

To process payments and manage your subscription.

To communicate with you about account changes, security alerts, or support requests.

To detect and prevent fraud, abuse, or security incidents.

We use essential cookies for authentication (Firebase session) and UI preferences (sidebar state, theme).

We do not use analytics, advertising, or third-party tracking cookies.

You can manage cookie preferences through the consent banner displayed on your first visit.

We do not sell your personal information to third parties.

We share data with trusted service providers who help us operate the service:

• Firebase (Google) — Authentication, database, and hosting
• Stripe — Payment processing
• Upstash — Rate limiting
• Sentry — Error tracking
• AI providers — Resume analysis and suggestions (data is processed ephemerally)

These providers are contractually obligated to protect your data and use it only for the services we contract them for.

If you are in the European Economic Area (EEA), you have the following rights:

• Right of access — Request a copy of all data we hold about you.
• Right to rectification — Request correction of inaccurate data.
• Right to erasure — Request permanent deletion of your account and all data.
• Right to data portability — Export your data in a machine-readable format (JSON).
• Right to restrict processing — Request that we limit how we use your data.

You can exercise these rights from your Settings page or by contacting us.

We retain your data for as long as your account is active. When you delete your account, all personal data is permanently removed within 30 days.

Backup copies may persist for up to 90 days for disaster recovery purposes.

We implement industry-standard security measures including encryption in transit (TLS), access controls, and regular security audits.

All API endpoints require authentication. Rate limiting is enforced per user.