Privacy Policy

Four kinds of thing, and nothing else:

• Your account. Your name, your email address, and a one-way hash of your password. We never store the password itself and cannot read it.
• What you give the tools. Your resume (uploaded or typed) plus anything you write into the editor, job postings you paste or save, cover letters, interview notes, and the numbers you enter for an offer conversation.
• The free ATS check. No account is needed to run it, so we keep a short note of each check: the name, email address, location and job title on the resume you checked, and what the check found. We do not keep the file or the rest of the resume.
• How the product is used. Which AI actions ran, when, and whether they succeeded. This is what lets support see that a rebuild failed for you before you have to write in about it.

Payment details are handled entirely by Stripe. We never see or store a card number; what we hold is a customer reference and the state of your subscription.

A resume usually contains a great deal about you: where you have lived, where you studied, sometimes more. We treat all of it as yours, and none of it is used to train anyone's model.

This is worth its own section because it is unusual. When you record a practice answer, the video is captured and held in your own browser. It is not uploaded, not stored on our servers, and not sent anywhere else. It disappears when you leave the page.

Only the transcript (the words you said, produced by your own browser's speech recognition) is sent to us so the AI can give feedback on the answer. There is no recording of you on our side, on any server, ever.

• Run the tools you asked us to run.
• Keep your work so it is there when you come back.
• Take payment, and manage your subscription.
• Email you about your account.
• If you ran the free ATS check, email you job-search tips and offers at the address on your resume. Every one of those emails has a link to unsubscribe, and one click takes you off the list for good.
• Answer you when you contact support.
• Watch for abuse. Rate limiting on the public tools counts requests against a hashed IP address; we never store the address itself.

We do not sell your information and we do not build a profile of you for anyone else's benefit. If you reached us by clicking one of our ads, we do tell Google Ads that the click led to a free account or a payment, and what the payment was. That is how we know which ads are worth running. It carries the click identifier and the amount, never your name, your email or anything from your resume.

Rewriting a resume means sending its text to a large language model. We use Anthropic's Claude for that. When you ask for a rebuild, a tailored version, a cover letter, a fit assessment or interview prep, the relevant text goes to Anthropic's API, Anthropic processes it and returns the result, and we store the result against your account.

Anthropic's commercial terms state that inputs and outputs sent through their API are not used to train their models. We do not train any model on your data either.

Interview preparation additionally runs a live web search about the company you named, so that company's name is part of that request. Nothing about you is included in the search itself.

The complete list of companies involved in running this service, and what each one holds:

• Anthropic: processes resume and job text to generate the AI output described above.
• Supabase: the database. Everything we store lives here.
• Vercel: hosting. Serves the site and runs the application code.
• Stripe: payments and subscriptions. Holds your card details; we do not.
• Resend: sends our email (verification, support replies, account and billing emails).
• A job board data provider: receives your search terms when you use Job Sourcing. Your resume is not sent to it.
• Google Analytics: anonymous usage measurement. Optional. In the US it runs unless you switch it off on the cookie policy page; in the UK, the EU and Switzerland it does not run at all unless you accept it first. A browser sending Do Not Track or Global Privacy Control switches it off everywhere.
• Google Ads: if you arrived from one of our ads, it is told that the click led to a free account or a payment, with the amount. The click identifier and the amount, nothing else. This happens whether or not you accept cookies, because it is a record of our own sale rather than a cookie on your browser, and the alternative is paying for ads with no idea which ones work.

All of these are United States companies, and your data is processed in the United States.

Your account and your documents stay until you delete them or delete your account. We do not expire a resume you have not opened for a while: losing someone's work to a retention timer would be a worse failure than keeping it.

Usage records (what ran and whether it worked) are kept for troubleshooting and to spot abuse. Abuse-prevention counters, which hold only hashed IPs, expire within hours.

When you delete your account we delete your resumes, jobs, applications, letters, guides and notes with it. Stripe keeps its own record of payments because tax law requires it to; that is out of our hands.

Whoever and wherever you are, you can ask us to:

• Send you a copy of everything we hold about you.
• Correct anything that is wrong.
• Delete your account and everything in it.
• Stop sending you anything that is not about your account.

Email support@resumefox.ai and we will action it within 30 days, usually far sooner. We will not ask you why.

If you are in California, the CCPA and CPRA give you these rights specifically, plus the right not to be discriminated against for exercising them. We do not sell or share personal information as those laws define it, so there is nothing for you to opt out of. If you are in the UK or EU, the equivalent GDPR rights apply and the same address reaches us.

We set a cookie to keep you signed in. That one is essential and cannot be turned off without breaking the login. Analytics cookies are optional: in the US they are set unless you switch measurement off, and in the UK, the EU and Switzerland only if you accept them first. Either way there is a switch on the cookie policy page, and we honor Do Not Track and Global Privacy Control without being asked.

The detail is on the cookie policy.

This service is for adults looking for work and is not directed at children under 13. We do not knowingly collect anything from them. If you believe a child has created an account, tell us and we will remove it.

If we change something material (a new sub-processor, a new category of data, a different retention period), we will update the date at the top and email account holders. We will not quietly widen what we do with your data and rely on you re-reading this page.