Your data is yours. Full stop.

When you create an account we collect your email address and, optionally, a display name. We collect the CV you upload — this is central to the product; it powers fit analysis and tailoring. We store the job descriptions you run analysis against, the fit reports we generate, and any tailored artifacts (CVs, cover letters, motivation statements) you create. If you use the application tracker, we store the records you enter. If you connect your inbox (Phase 2), we store message metadata and, for 90 days, message bodies.

We collect standard server logs (IP addresses, browser type, request paths, timestamps) for security and reliability. We do not use third-party analytics pixels or ad-tracking scripts.

Your CV is used to run fit analysis and to generate tailored artifacts when you request them. Fit reports are stored so you can return to them; they are never shared. Salary calculations use only public ICSC sources — your personal data is not involved.

We use your email address to send account-related notices (password resets, billing receipts) and, with your consent, application nudges (at most a few per week, at the timing you configure). We do not send marketing email without explicit opt-in.

Tailored artifact files are retained for 90 days for inactive accounts and then deleted. Inbox message bodies (Phase 2) are purged after 90 days. Revoked inbox connections are purged after 30 days. You can delete your account — and all associated data — at any time from your account settings.

Passwords are hashed with Argon2id. Data is encrypted in transit (TLS) and at rest. Access tokens are short-lived; refresh tokens are rotated on use. We do not log passwords, tokens, or CV content in application logs.