隐私政策 / Privacy Policy

1. 概述 / Overview

ResuMe(“简忆”,以下称“我们”)是一个帮助你把职业经历沉淀成“记忆库”、并按具体职位(JD)生成对口简历的工具。本政策说明我们收集哪些数据、如何使用、与谁共享、保存多久,以及你可以行使哪些权利。

ResuMe (“ResuMe”, “we”) is a tool that turns your career history into a personal “memory” and generates a resume tailored to each job description. This policy explains what data we collect, how we use it, who we share it with, how long we keep it, and the rights you have.

2. 我们收集的数据 / Data we collect

• 账号信息 / Account: 你的邮箱地址与密码(密码由认证服务以哈希形式存储,我们无法看到明文);若你用 Google 登录,则是 Google 返回的账号标识与邮箱。 · Your email and password (stored only as a hash by our auth provider — we never see the plaintext), or, if you use Google sign-in, the account identifier and email Google returns.
• 职业记忆 / Career memory: 你上传或填写的简历事实——姓名、电话、邮箱、所在地、签证/工作身份状态,以及工作经历、教育、项目、技能等。 · The resume facts you upload or enter — name, phone, email, location, visa/work-authorization status, and your work history, education, projects and skills.
• 上传的原始文件 / Uploaded files: 你上传的简历原件(PDF/DOCX),存放在受访问控制的私有存储桶中。 · The original resume files (PDF/DOCX) you upload, kept in an access-controlled private storage bucket.
• 生成内容 / Generated content: 我们按 JD 为你生成的定制简历。 · The tailored resumes we generate for you against a job description.
• 技术性数据 / Technical: 维持登录状态的会话 Cookie、记录界面语言偏好的 Cookie(resume-lang),以及托管平台在提供服务过程中产生的常规访问日志。 · A session cookie to keep you logged in, a cookie for your language preference (resume-lang), and the routine access logs our hosting platform generates while serving the site.

3. 我们如何使用这些数据 / How we use it

仅用于向你提供服务:解析你上传的简历并在你确认后存入你的记忆库;按你选定的 JD 生成对口简历;维持你的登录会话。我们不把你的数据用于广告,也不出售你的数据。

Only to provide the service: to parse your uploaded resume and, after you confirm, store it in your memory; to generate a tailored resume for a job you choose; and to keep you signed in. We do not use your data for advertising and we do not sell your data.

4. 第三方与数据流向 / Third parties & data flows

为提供服务,你的数据会经过以下服务商(数据处理者)。除此之外我们不向任何第三方披露你的个人数据。

To run the service, your data passes through the processors below. We do not disclose your personal data to any other third party.

• Anthropic(Claude AI)： 生成与解析简历时,相关简历文本(可能包含你的姓名、电话、邮箱、所在地、签证状态及简历正文)与目标 JD 会发送至 Anthropic 的商业 API 进行 AI 推理。根据 Anthropic 商业条款,你的内容不会被用于训练任何模型;API 的输入与输出通常在其后端保留最长 30 天后自动删除,被其安全系统标记的内容可能保留最长约 2 年。我们未申请“零数据保留(ZDR)”,因此不承诺 Anthropic 在上述期间保留零副本。 · When we generate or parse a resume, the relevant resume text (which may include your name, phone, email, location, visa status and resume body) and the target job description are sent to Anthropic’s commercial API for AI inference. Under Anthropic’s commercial terms your content is not used to train any model; API inputs and outputs are typically retained on their backend for up to 30 days and then deleted, and content flagged by their safety systems may be kept up to ~2 years. We have not enrolled in zero-data-retention (ZDR), so we do not claim zero copies during those windows.
• Supabase: 我们的托管方——数据库、账号认证与文件存储都在 Supabase;注册验证邮件也由 Supabase 内建邮件服务发送。 · Our host — database, authentication and file storage all run on Supabase, and sign-up verification emails are sent by Supabase’s built-in email service.
• Google: 仅当你选择“用 Google 登录”时,才会与 Google 交换登录所需的账号标识与邮箱。 · Only if you choose “Sign in with Google” do we exchange the account identifier and email needed to log you in.
• Cloudflare(Workers 与 R2): 站点运行在 Cloudflare 的 Workers 平台上,你与站点之间的全部流量都经过 Cloudflare;每日数据库加密备份(见第 6 节)也存放在 Cloudflare R2 对象存储中。 · The site runs on Cloudflare’s Workers platform, so all traffic between you and the site passes through Cloudflare; the daily encrypted database backups (see Section 6) are also stored in Cloudflare R2 object storage.
• GitHub(Actions): 我们每天在 GitHub Actions 上运行一次数据库备份任务;运行期间数据库的加密备份(含你的账号与记忆库数据)会流经 GitHub 的构建环境,随后上传至上述 Cloudflare R2 备份存储。 · A daily database-backup job runs on GitHub Actions; during that run an encrypted backup of the database (including your account and memory data) transits GitHub’s build environment before being uploaded to the Cloudflare R2 backup storage above.

5. 关于“不用于训练” / On “never used to train”

我们承诺:你的经历只属于你,绝不用于训练他人模型。落到技术层面——我们自己不用你的数据训练任何模型;向 Anthropic 发送内容时,依据其商业条款默认即“不训练”,你的内容不会进入任何模型的训练。需要坦白的是:这是“不训练”,不是“零留存”——如第 4 节所述,内容在服务商后端会有最长 30 天(被标记内容最长约 2 年)的保留窗口。

Our promise — your experience belongs to you and is never used to train anyone else’s model — in concrete terms means: we never train any model on your data, and when we send content to Anthropic their commercial terms are “no training” by default, so your content does not enter any model’s training set. To be candid, this is “no training”, not “zero retention” — as Section 4 notes, there is a retention window of up to 30 days (up to ~2 years for flagged content) on the provider’s backend.

6. 数据保留 / Data retention

你的账号与记忆库数据会一直保留到你删除它们为止。你删除账号后,相关数据会按第 7 节所述被清除。服务商侧的保留窗口见第 4 节。

We keep your account and memory data until you delete it. When you delete your account, the data is removed as described in Section 7. Provider-side retention windows are described in Section 4.

为防数据丢失,我们每日对数据库做一次加密备份,存放于 Cloudflare R2,约保留 14 天后自动过期。备份仅覆盖数据库(你的账号与记忆库数据),不含你上传的原始简历文件。因此在你删除账号后,你的数据仍可能存在于加密备份中,最长约 14 天,直到相应备份自动过期。

To guard against data loss, we take one encrypted backup of the database each day, stored in Cloudflare R2 and automatically expired after about 14 days. Backups cover the database only (your account and memory data) and do not include the original resume files you uploaded. As a result, after you delete your account your data may still exist in an encrypted backup for up to about 14 days, until that backup automatically expires.

7. 你的权利 / Your rights

你可以随时在应用内自助删除账号。删除是不可逆的,会一并清除:你的认证账号、所有业务表中属于你的数据,以及你上传到存储桶的原始简历文件。删除后该账号将无法再登录。如第 6 节所述,删除后你的数据仍可能在每日加密数据库备份中最长残留约 14 天,直到该备份自动过期。

You can delete your account yourself, at any time, from within the app. Deletion is irreversible and removes your auth account, all of your data across our tables, and the original resume files you uploaded to storage. After deletion the account can no longer sign in. As described in Section 6, after deletion your data may still remain in a daily encrypted database backup for up to about 14 days, until that backup automatically expires.

8. 安全 / Security

每个用户只能访问自己的数据——数据库以行级安全(RLS)按用户隔离,应用层再叠加校验;传输全程加密(HTTPS);上传的文件存于私有存储桶,不可公开读取。

Each user can access only their own data — the database enforces per-user isolation with row-level security (RLS), reinforced by an application-layer check; all traffic is encrypted in transit (HTTPS); uploaded files are kept in a private bucket that is not publicly readable.

9. Cookie

我们只用必要的 Cookie:维持登录状态的会话 Cookie,以及记录界面语言偏好的 Cookie。我们不使用第三方广告或跟踪 Cookie。

We use only essential cookies: a session cookie to keep you logged in and a cookie for your language preference. We do not use third-party advertising or tracking cookies.

10. 政策变更 / Changes

若本政策发生实质变更,我们会更新本页顶部的生效日期;继续使用即表示接受更新后的政策。

If this policy changes materially, we will update the effective date at the top of this page; continued use means you accept the updated policy.

11. 联系我们 / Contact

如对隐私有疑问,请联系:privacy@〈上线域名待绑定〉(正式域名绑定后启用)。 · For privacy questions, contact privacy@〈domain-to-be-bound〉 (active once the production domain is bound).