Privacy Policy

1. Overview

ResuMe (“ResuMe”, “we”) is a tool that turns your career history into a personal “memory” and generates a resume tailored to each job description. This policy explains what data we collect, how we use it, who we share it with, how long we keep it, and the rights you have.

2. Data we collect

• Account: Your email and password (stored only as a hash by our auth provider — we never see the plaintext), or, if you use Google sign-in, the account identifier and email Google returns.
• Career memory: The resume facts you upload or enter — name, phone, email, location, visa/work-authorization status, and your work history, education, projects and skills.
• Uploaded files: The original resume files (PDF/DOCX) you upload, kept in an access-controlled private storage bucket.
• Generated content: The tailored resumes we generate for you against a job description.
• Technical: A session cookie to keep you logged in, and the routine access logs our hosting platform generates while serving the site.

3. How we use it

Only to provide the service: to parse your uploaded resume and, after you confirm, store it in your memory; to generate a tailored resume for a job you choose; and to keep you signed in. We do not use your data for advertising and we do not sell your data.

4. Third parties & data flows

To run the service, your data passes through the processors below. We do not disclose your personal data to any other third party.

• Anthropic (Claude AI): When we generate or parse a resume, the relevant resume text (which may include your name, phone, email, location, visa status and resume body) and the target job description are sent to Anthropic’s commercial API for AI inference. Under Anthropic’s commercial terms your content is not used to train any model; API inputs and outputs are typically retained on their backend for up to 30 days and then deleted, and content flagged by their safety systems may be kept up to ~2 years. We have not enrolled in zero-data-retention (ZDR), so we do not claim zero copies during those windows.
• Supabase: Our host — database, authentication and file storage all run on Supabase, and sign-up verification emails are sent by Supabase’s built-in email service.
• Google: Only if you choose “Sign in with Google” do we exchange the account identifier and email needed to log you in.
• Cloudflare (Workers and R2): The site runs on Cloudflare’s Workers platform, so all traffic between you and the site passes through Cloudflare; the daily encrypted database backups (see Section 6) are also stored in Cloudflare R2 object storage.
• GitHub (Actions): A daily database-backup job runs on GitHub Actions; during that run an encrypted backup of the database (including your account and memory data) transits GitHub’s build environment before being uploaded to the Cloudflare R2 backup storage above.

5. On “never used to train”

Our promise — your experience belongs to you and is never used to train anyone else’s model — in concrete terms means: we never train any model on your data, and when we send content to Anthropic their commercial terms are “no training” by default, so your content does not enter any model’s training set. To be candid, this is “no training”, not “zero retention” — as Section 4 notes, there is a retention window of up to 30 days (up to ~2 years for flagged content) on the provider’s backend.

6. Data retention

We keep your account and memory data until you delete it. When you delete your account, the data is removed as described in Section 7. Provider-side retention windows are described in Section 4.

To guard against data loss, we take one encrypted backup of the database each day, stored in Cloudflare R2 and automatically expired after about 14 days. Backups cover the database only (your account and memory data) and do not include the original resume files you uploaded. As a result, after you delete your account your data may still exist in an encrypted backup for up to about 14 days, until that backup automatically expires.

7. Your rights

You can delete your account yourself, at any time, from within the app. Deletion is irreversible and removes your auth account, all of your data across our tables, and the original resume files you uploaded to storage. After deletion the account can no longer sign in. As described in Section 6, after deletion your data may still remain in a daily encrypted database backup for up to about 14 days, until that backup automatically expires.

8. Security

Each user can access only their own data — the database enforces per-user isolation with row-level security (RLS), reinforced by an application-layer check; all traffic is encrypted in transit (HTTPS); uploaded files are kept in a private bucket that is not publicly readable.

9. Cookies

We use only one essential cookie: a session cookie to keep you logged in. We do not use third-party advertising or tracking cookies.

10. Changes

If this policy changes materially, we will update the effective date at the top of this page; continued use means you accept the updated policy.

11. Contact

For privacy questions, contact privacy@〈domain-to-be-bound〉 (active once the production contact address is set up).