$ cat privacy_policy.txt _

🔒 PRIVACY POLICY Last Updated: 2025-09-07

🛡️ OUR PRIVACY PROMISE

WE ONLY KEEP DATA FOR THE SHORTEST WINDOW REQUIRED.

Resume and job description content live in Redis for at most 30 minutes so we can finish processing. Rate-limit counters reset daily, and cost logs retain only hashed IP addresses for 30 days to detect abuse. We maintain no long-term user databases or profiles, and every retention window is documented below.

📊 DATA HANDLING

1
You Upload

Resume and job description sent to our server

2
We Process

AI customizes your resume in memory only

3
You Download

Customized resume sent back to you

4
We Expire

Redis keys auto-expire within 30 minutes and supporting metrics age out per policy

🚫 WHAT WE DON'T COLLECT

  • Long-term user accounts or marketing profiles
  • Payment or billing information
  • Resume or job description content beyond the documented retention windows
  • Unhashed IP addresses after rate-limit counters reset
  • Third-party tracking pixels beyond Plausible (cookieless) analytics and Google AdSense ads
  • Sale of personal data to advertisers or brokers

✅ MINIMAL DATA WE PROCESS

Resume & job description Stored in Redis processing:* keys for up to 30 minutes to finish customization, then automatically deleted.
Section metrics Character, token, and diff metrics cached for 24 hours to troubleshoot formatting issues.
Rate limiting Plain IP + request count stored until shortly after midnight UTC to enforce the daily limit, then dropped.
Cost tracking Hashed IP + per-request cost stored for 30 days to enforce budgets and detect abuse.
Evaluation metrics Aggregated, anonymized quality scores retained for 7 days to improve prompts.
Operational logs Request IDs, hashed IPs, and error traces captured in Logfire/Sentry (if configured) following their default 30-day retention.

🍪 COOKIES AND TRACKING

We use cookies and similar technologies to provide and improve our service. Here's what you need to know:

Essential Cookies

Required for the service to function. These cannot be disabled.

  • Session management and request processing
  • Security and fraud prevention
  • Cookie consent preferences

Analytics Cookies

Help us understand how visitors use our service (Plausible - cookieless).

  • Page views and navigation patterns
  • Download events and user flows
  • IP addresses truncated, no long-term storage

Advertising Cookies

Third-party vendors, including Google, use cookies to serve ads.

  • Ad personalization based on browsing history
  • Ad measurement and effectiveness tracking
  • Cross-site tracking for ad targeting

Third-Party Advertising Cookies (Google AdSense)

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to your website or other websites.

Google's use of advertising cookies enables it and its partners to serve ads to your users based on their visit to your sites and/or other sites on the Internet.

Users may opt out of personalized advertising by visiting:

🤝 THIRD-PARTY SERVICES

OpenAI GPT-5-nano

We call OpenAI's GPT-5-nano API to generate tailored resume content. OpenAI's policy states:

  • Requests are sent securely over HTTPS.
  • API data is retained for up to 30 days for abuse monitoring, then deleted.
  • Enterprise customers can request shorter retention; we opt out of model training.
View OpenAI Privacy Policy →

Google AdSense

We display ads to keep the service free. Advertising cookies are only set with your consent. We default to non-personalized ads unless you explicitly accept personalized advertising.

How Google uses cookies: Google and its partners use cookies to serve ads based on your prior visits to our website and other sites on the Internet. This enables personalized advertising across the web.

View Google Privacy Policy →

Plausible Analytics

We use Plausible's cookieless analytics to track page views and download events. IP addresses are truncated and never stored long term; only aggregated metrics are retained.

View Plausible Data Policy →

🔐 SECURITY MEASURES

  • All connections encrypted with HTTPS/TLS
  • Strict TTLs: 30-minute Redis keys, daily rate-limit counters, 30-day hashed cost logs
  • Rate limiting prevents abuse
  • Input sanitization prevents injections
  • Regular security audits

⚖️ YOUR RIGHTS

Our retention windows are short, but you still control how your data is used. You can:

  • Use the service without logging in or creating an account
  • Request manual deletion of in-progress data by sharing your request ID or hashed IP
  • Block analytics or ads via browser settings if you prefer
  • Contact us with privacy concerns or questions about these policies

📧 CONTACT US

Privacy questions or concerns?

Email: privacy@resumetoresume.com

Response Time: Within 48 hours

📝 POLICY UPDATES

We may update this policy to reflect changes in our practices or legal requirements. Check the "Last Updated" date above for the latest version.

This privacy policy is effective as of 2025-09-07 and applies to all users of Resume to Resume.