Privacy Policy
Last updated 22 August 2026
This policy describes what CareerFit Resume collects, why, who else sees it, and how to get rid of it. It is written to be read, not to be survived.
Who we are
CareerFit Resume is operated by CareerFit Resume. For any question about your data, or to exercise any right below, email hello@careerfitresume.com.
What we collect
| Data | Why |
|---|---|
| Email address, and name if you give one | To identify your account and send you account email |
| A password hash, or an account identifier if you sign in with an external account | To let you sign in. We never store your password itself |
| Resumes you upload (.docx) | They are what the service tailors |
| Job descriptions you paste | To tailor a resume against them, and to show you your own history |
| Documents and draft emails we generate for you | So you can download them again later |
| Recruiter email addresses contained in job postings you paste | To warn you when you have already applied to the same company |
| Sign-in records: session identifiers, browser user-agent, timestamps | To keep you signed in and to let you sign other devices out |
| Usage records: which model ran, token counts, cost | To enforce limits and keep the service from overspending |
| Feedback you send us | To answer it |
We do not use advertising cookies, analytics trackers, or third-party profiling. The only cookie we set is the one that keeps you signed in.
A resume is personal data, including other people's
Resumes contain your name, contact details and employment history, and job postings sometimes contain a named recruiter's email address. Upload only your own resume, and only paste postings you legitimately received.
Who else processes your data
Running this service needs a few specialist providers. Each one gets only what it needs, and nothing more:
- An AI provider receives the job description and the resume being tailored. That exchange is the tailoring itself. It is not used to train their models.
- A hosting provider runs the application and the database. Servers are in the United States.
- A storage and network provider holds your uploaded and generated documents.
- An email provider receives your address and the contents of the account emails we send you — verification and password resets.
- A payment provider handles checkout if you buy a pack. Card details go directly to them and never reach us.
- Optional features you switch on yourself — signing in with an external account, or connecting a mailbox so drafts can be staged — pass only what that feature needs, and only after you choose it.
We will name any of these providers if you ask — write to hello@careerfitresume.com and we will tell you who they are.
We do not sell your data, and we do not share it with anyone else.
The browser extension
The Chrome extension CareerFit Resume — attach to Gmail is optional. Without it the app still gives you the tailored .docx and a pre-filled compose link; the extension exists only to put the file into the Gmail window for you, which no link can do.
What it can reach, and nothing else:
- Your application page on this site. It reads the recipient, subject, body and the resume you generated, from the page you are looking at.
- The Gmail compose window it opened. It fills those fields in and attaches the file.
What it holds: one pending email, in the browser's own session storage, for a maximum of ten minutes, deleted the moment it is used. Nothing is written to disk and nothing survives closing the browser.
What it never does: it does not read, search, modify or delete your mail; it does not send anything. You press Send yourself, and it does not touch any site other than the two above; and it transmits nothing to us or to any third party. There is no analytics, no tracking and no remote code in it. Data handled by the extension is used only to provide the attach feature the user asked for, and is never sold, transferred or used for advertising, credit assessment or any unrelated purpose.
Uninstalling it removes everything it held. Your account and files are unaffected.
Where it is kept, and for how long
CareerFit Resume operates from India, but your data is stored and processed on servers in the United States. Our hosting, file storage and the model that does the tailoring are all located there. Using this service means your data crosses borders to reach them.
We keep it until you delete it. We do not expire accounts on a timer, because a job search can be long and finding your earlier applications gone would be worse than keeping them.
Deleting your account
Settings → Delete account. You confirm by typing your own email address. This removes, permanently and immediately:
- your account and sign-in records
- every resume you uploaded, and every document generated for you, from file storage as well as from the database
- every application record, including the job descriptions you pasted
- your Gmail connection, revoked with the provider, if you had one
There is no undo and no recovery. If a file cannot be removed at that moment, the screen tells you so rather than claiming success.
Your rights
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Deletion you can do yourself, immediately, at any time. You can also withdraw consent by deleting your account, and complain to the relevant authority where you live.
Depending on where you are, you may have further rights under laws such as India's Digital Personal Data Protection Act, the GDPR, or the CCPA. We apply the rights above to everyone regardless of location, because operating one honest process is simpler than operating three. Email hello@careerfitresume.com and we will respond within 30 days.
How we protect it
- Passwords are hashed with Argon2. We cannot read them.
- Session cookies are stored only as a SHA-256 hash, so a database leak cannot be replayed as a login.
- Uploaded files are private, never publicly listed or linked.
- Every query is scoped to the account that owns the data, and that is verified by automated tests.
- All traffic is served over HTTPS.
No service can promise perfect security, and we will not pretend otherwise. If a breach affects your data, we will tell you.
Children
This service is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes materially, we will email registered users rather than quietly changing the date at the top.