Privacy Policy
Last updated 22 August 2026
This policy describes what CareerFit Resume collects, why, who else sees it, and how to get rid of it. It is written to be read, not to be survived.
Who we are
CareerFit Resume is operated by CareerFit Resume. For any question about your data, or to exercise any right below, email hello@careerfitresume.com.
What we collect
| Data | Why |
|---|---|
| Email address, and name if you give one | To identify your account and send you account email |
| A password hash, or an account identifier if you sign in with an external account | To let you sign in. We never store your password itself |
| Resumes you upload (.docx) | They are what the service tailors |
| Job descriptions you paste | To tailor a resume against them, and to show you your own history |
| Documents and draft emails we generate for you | So you can download them again later |
| Recruiter email addresses contained in job postings you paste | To warn you when you have already applied to the same company |
| Sign-in records: session identifiers, browser user-agent, timestamps | To keep you signed in and to let you sign other devices out |
| Usage records: which model ran, token counts, cost | To enforce limits and keep the service from overspending |
| Feedback you send us | To answer it |
We do not use advertising cookies, analytics trackers, or third-party profiling. The only cookie we set is the one that keeps you signed in.
A resume is personal data, including other people's
Resumes contain your name, contact details and employment history, and job postings sometimes contain a named recruiter's email address. Upload only your own resume, and only paste postings you legitimately received.
Who else processes your data
Running this service needs a few specialist providers. Each one gets only what it needs, and nothing more:
- An AI provider receives the job description and the resume being tailored. That exchange is the tailoring itself. It is not used to train their models.
- A hosting provider runs the application and the database. Servers are in the United States.
- A storage and network provider holds your uploaded and generated documents.
- An email provider receives your address and the contents of the account emails we send you — verification and password resets.
- A payment provider handles checkout if you buy a pack. Card details go directly to them and never reach us.
- A speech to text provider receives the audio of a screening call, only while that call is happening, and only if you start one. Nothing is sent before you start and nothing after you end it. Neither we nor they keep the recording or the transcript.
- A telephone provider carries the audio of a screening call to us, only if you use the phone line and add it to your call yourself. It keeps a record that the call happened, which is the phone numbers involved and how long it lasted. It does not record what was said.
- Optional features you switch on yourself — signing in with an external account, or connecting a mailbox so drafts can be staged — pass only what that feature needs, and only after you choose it.
We will name any of these providers if you ask — write to hello@careerfitresume.com and we will tell you who they are.
We do not sell your data, and we do not share it with anyone else.
The Screening Copilot, and why it keeps nothing
If a recruiter rings about a job you tailored for, the Screening Copilot can listen through your microphone and answer their questions from that resume. On a phone, where the call itself is on the same device, you can instead add our phone line to the call, and the audio reaches us over that line. Either way it is off unless you start it, and you have to agree to a plain description of this before it will listen.
Nothing about the call is stored. Not the audio, not the words, not the answers. This is not a retention period of zero days. There is no row, no file and no log line anywhere in this service that holds any of it.
| Where | What happens to it |
|---|---|
| Your browser | The transcript exists on the page you are looking at and nowhere else. Ending the call clears it, and so does closing the tab. |
| The telephone provider | Only if you use the phone line. Carries the call's audio to our server while the line is part of your call. Keeps the numbers and the length of the call, not its contents. |
| Our server | Audio is passed straight through to the transcription provider and the words are passed straight back to you. Neither is written down. On the phone line, the last few minutes of words are held in memory so a page that briefly lost its connection can catch up, and they are gone when the call ends. |
| The transcription provider | Receives the audio in order to turn it into words, for as long as the call lasts. |
| The AI provider | Receives the last minute of the conversation, each time you ask for an answer, along with the resume and the job description. |
A resume you upload for a quick call is read into memory for that call only. It is not saved, and it is gone when the call ends, unless you choose to keep it as a screening setup.
What we do keep is the number of minutes your account used, and what those minutes cost us. That is a duration and a figure. It contains nothing that was said.
A call has another person on it, and they did not agree to anything. Recording and notification law varies by state and by country, and following it is your responsibility rather than ours. If where you are requires you to tell the other person that a call is being transcribed, tell them. We deliberately keep nothing, which limits the harm, but it does not make the obligation ours.
The practice coach, and why your camera stays with you
The practice coach watches your eyes, head and hands while you rehearse, so it can tell you how your delivery looks. Your video never leaves your device. The tracking runs inside your browser. No frame, image or recording is sent to us or to anyone else, and the page is set so it can only talk to this site.
When you end a session we keep the scores and nothing else: where your eyes were for each second (at the lens, left, right, up, down, or out of frame) and a few counts, such as how many times you touched your face. That is enough to show your report and your progress. It is not a picture of you.
You can delete any report from its page. Deleting your account deletes all of them.
Practice recordings, and the links you share
A practice recording is different from a screening call, because you asked us to keep it. When you press Record on the practice coach, your microphone audio goes to our speech to text provider to be turned into text. We never store the audio. We keep the text of what was said and, when you stop, the notes written from it: a summary, key points and action items. Those notes are written by our AI model provider from the transcript.
Anyone who has the share link can read the transcript, live while you record and afterwards with the notes. They do not need an account. Only you can turn the link off or make a new one, and a link stops working on its own 30 days after the recording ends.
The other people in a recording did not sign up for anything. Telling them they are being recorded, and following the law where you are, is your responsibility. The page asks you to confirm that before it starts.
Someone reading a shared recording can press Follow my voice to read it aloud like a teleprompter. Their microphone is then heard by their own browser's speech service, run by the company that makes their browser, so the window knows when they have finished a sentence. That voice never reaches us. The words are matched on their device and thrown away, and nothing listens until the button is pressed.
You can delete a recording from its page, which deletes the transcript and the notes. Deleting your account deletes all of them.
The browser extension
The Chrome extension CareerFit Resume — attach to Gmail is optional. Without it the app still gives you the tailored .docx and a pre-filled compose link; the extension exists only to put the file into the Gmail window for you, which no link can do.
What it can reach, and nothing else:
- Your application page on this site. It reads the recipient, subject, body and the resume you generated, from the page you are looking at.
- The Gmail compose window it opened. It fills those fields in and attaches the file.
What it holds: one pending email, in the browser's own session storage, for a maximum of ten minutes, deleted the moment it is used. Nothing is written to disk and nothing survives closing the browser.
What it never does: it does not read, search, modify or delete your mail; it does not send anything. You press Send yourself, and it does not touch any site other than the two above; and it transmits nothing to us or to any third party. There is no analytics, no tracking and no remote code in it. Data handled by the extension is used only to provide the attach feature the user asked for, and is never sold, transferred or used for advertising, credit assessment or any unrelated purpose.
Uninstalling it removes everything it held. Your account and files are unaffected.
Where it is kept, and for how long
CareerFit Resume operates from India, but your data is stored and processed on servers in the United States. Our hosting, file storage and the model that does the tailoring are all located there. Using this service means your data crosses borders to reach them.
We keep it until you delete it. We do not expire accounts on a timer, because a job search can be long and finding your earlier applications gone would be worse than keeping them.
Deleting your account
Settings → Delete account. You confirm by typing your own email address. This removes, permanently and immediately:
- your account and sign-in records
- every resume you uploaded, and every document generated for you, from file storage as well as from the database
- every application record, including the job descriptions you pasted
- your Gmail connection, revoked with the provider, if you had one
There is no undo and no recovery. If a file cannot be removed at that moment, the screen tells you so rather than claiming success.
Your rights
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Deletion you can do yourself, immediately, at any time. You can also withdraw consent by deleting your account, and complain to the relevant authority where you live.
Depending on where you are, you may have further rights under laws such as India's Digital Personal Data Protection Act, the GDPR, or the CCPA. We apply the rights above to everyone regardless of location, because operating one honest process is simpler than operating three. Email hello@careerfitresume.com and we will respond within 30 days.
How we protect it
- Passwords are hashed with Argon2. We cannot read them.
- Session cookies are stored only as a SHA-256 hash, so a database leak cannot be replayed as a login.
- Uploaded files are private, never publicly listed or linked.
- Every query is scoped to the account that owns the data, and that is verified by automated tests.
- All traffic is served over HTTPS.
No service can promise perfect security, and we will not pretend otherwise. If a breach affects your data, we will tell you.
Children
This service is not intended for anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes materially, we will email registered users rather than quietly changing the date at the top.