How we protect your data

What we keep

• Your CV file and the bullet lines built from it, your preferences, the jobs we scored for you, the resumes we wrote and the applications you track.
• Your password is never stored, only a one-way argon2 hash of it.

Who can see it

• Only you. The database itself refuses to show one person's rows to another (row-level security), and every page and download checks ownership too. Guessing another file's address gives "not found".
• The admin sees account names, usage and AI costs, never your CV or resumes in the app.

Who processes it

• An AI provider reads the parts of your CV needed to score a job or draft a resume. Your CV and job text are passed to it as data, with instructions never to follow anything written inside them.
• Google Cloud hosts the server; Cloudflare carries the encrypted (HTTPS) connection.

What we never do

• We never apply to a job or send anything to an employer for you. You apply yourself, on the company's site.
• We never add a fact to your resume that isn't already in your CV. Every AI-written line is checked mechanically against your own approved lines before you see it.
• No ads, no tracking scripts, nothing sold.

Your controls

• Download everything: Settings → Privacy and security → Download all my data.
• Delete your account: Settings → Privacy and security. Your CV, resumes and history are removed from the database and the files folder at once. Encrypted backups are deleted automatically after 60 days.
• Two-step sign-in with an authenticator app, a list of your signed-in devices with "sign out", and your recent sign-ins: Settings → Privacy and security.

How the site is protected

• Sessions expire after 7 days; repeated wrong passwords are slowed down; every form is protected against cross-site requests; the pages run no third-party scripts.
• Nightly database backups are encrypted (AES-256) before they leave the server.