Privacy Policy

1. Scope

This Privacy Policy explains what WriterCV ("WriterCV", "we", "us") does with information when you visit writercv.com, create an account, or use the service.

WriterCV is the data controller for the information described in this Policy. Our registered address is WriterCV, https://writercv.com.

By using the Service you accept this Policy and our Terms of Service. The Terms of Service are incorporated here by reference.

2. What never reaches us

WriterCV is built browser-first. You build your resume in your own browser, and a substantial part of the product never leaves your device. That work is never transmitted to our servers, so we never receive it, cannot read it, and cannot recover it if you lose it.

Everything in this section works with no account and no network request to us:

• The guest builder at /builder/guest. You write and edit your resume in your browser's local storage. It is never uploaded unless you decide to create an account and save it.
• The deterministic ATS check. It scores your resume in your browser, including reading the PDF you select. Your file is opened locally and is not sent to us.
• Writing, editing, and previewing your documents, and generating your own copy. It all happens in your browser.
• Photos you add. Your image is resized and processed in your browser before anything is uploaded.

Clear your browser storage and this data is gone. We hold no copy and have no way to restore it.

3. If you do not create an account

You can use the guest builder, the ATS checker, and the public resume pages without telling us who you are, and without your information being tied to an account or to your documents.

To serve each request and to keep the service available, we use the request's IP address as a rate-limiting key. It is used transiently for that purpose, is held in memory only rather than saved with anything about you, and is not linked to your account, not used for advertising, and not sold.

4. If you create an account

If you choose to create an account, we store what you give us so the service can work: the email address, name, and username you choose, the content of your documents, the files you upload, and the technical records needed to keep your account secure. Whatever you write in your documents is personal information, and we treat it that way.

We also keep the operational records that keep your account usable and safe, such as sign-in times, the security features you enable, and any correspondence you send us.

Some features are powered by artificial intelligence. When you start one yourself, the content that feature needs is sent to a third-party model provider under that provider's own terms, and if the feature needs a file from your device it is uploaded as part of that request. We do not send your data to an AI provider unless you trigger an AI feature yourself, and we do not use your content to train models.

If you subscribe to a paid plan, our payment provider handles your payment details so they can take the charge. We do not see or store your full card number. We receive only what we need to confirm the subscription, such as the last four digits, the card type, and the billing dates.

5. How we use information

To operate the Service and provide it to you: to authenticate you, to store and render your documents, to generate exports, and to respond to your requests. This is necessary to perform the contract between us under Article 6(1)(b) of the GDPR.

To protect the Service and our users: to detect and investigate fraud, abuse, and security incidents, and to enforce our Terms. This is our legitimate interest under Article 6(1)(f).

To understand aggregate usage so we can improve the product. We rely on aggregate counts rather than on building profiles of individual visitors. This is our legitimate interest under Article 6(1)(f).

To send you transactional email, such as verification, password reset, and security notices. We do not send marketing email. This is necessary to perform the contract with you.

To meet legal obligations. Where the law requires us to retain or disclose information, we do so.

6. Public resumes

Publishing a resume is an explicit choice you make, and it stays under your control. A published resume is reachable by anyone who has the link, so treat what you publish as public. If you would rather not have it open to everyone, you can add a password so only people who know it can open it.

You can revise or withdraw a published resume at any time from your dashboard, and withdrawing it removes it from the pages that serve it. We cannot recall what people have already seen or saved, so please check a resume before you share it.

7. How long we keep information

Your account information and your documents are kept while your account is open, and until you delete them or close your account. Closing your account removes your profile, your resumes, cover letters, applications, version history, uploaded files, and sessions.

Where the law requires us to retain something, for example to establish or defend a legal claim, we keep only that information and only for as long as the retention period requires.

8. Who we share information with

We do not sell your personal information. We do not share it for advertising. We do not disclose it to employers, recruiters, job boards, or any third party for their own purposes.

Information about you is visible to the service providers that run the service, and to nobody else:

• Database hosting, which stores your account and your documents.
• Object storage, which stores files you upload. Where cloud storage is not configured, files are stored on the server's own disk.
• An AI model provider, only when you use an AI feature.
• An email provider, only to deliver the transactional messages described above.
• A sign-in provider such as Google, GitHub, or LinkedIn, only when you choose to sign in with one.
• A payment provider, only if you subscribe to a paid plan.

Service providers act on our instructions and are bound by contract to protect the information and use it only to provide the service to us.

We disclose information where we reasonably believe the law requires it, for example in response to a valid legal process or to protect the rights and safety of the Service, our users, or the public.

If WriterCV is transferred to another entity, the new operator will be bound by this Policy for your information.

9. No advertising networks

WriterCV runs no advertising network, no behavioural advertising, and no session-replay scripts. The site is served under a Content Security Policy that restricts scripts, images, fonts, and connections to our own origin, so our pages cannot silently hand your activity to another company as you browse.

We do not build advertising profiles and we do not disclose your activity to social networks. If you connect a third-party sign-in provider or link a social account yourself, that provider's own policy applies to the sign-in.

10. Cookies and local storage

WriterCV does not use advertising cookies, cross-site tracking cookies, or fingerprinting. It uses a small number of strictly necessary items:

• A session cookie that keeps you signed in and protects against cross-site request forgery. It contains no tracking identifier.
• Browser local storage, which holds your guest resume and your interface preferences on your own device.
• Optional cookies or keys, only if you enable a feature that requires them, such as remembering a sign-in provider choice.

Blocking cookies in your browser will sign you out, and clearing local storage will delete any guest resume you have not saved to an account.

11. How we protect information

Traffic between your browser and WriterCV is encrypted in transit over HTTPS. We enforce HSTS, so a browser that has visited us will refuse to fall back to an unencrypted connection.

Passwords are hashed with a slow one-way function and are never stored in readable form. Sessions are stored server-side and referenced by an opaque identifier. API keys expire and can be revoked.

Uploads are restricted to images and PDF documents, and are validated both by declared type and by content. Anything that is not a recognised image or PDF is rejected, and stored files are served as downloads rather than as active content, so an uploaded file cannot execute on our domain.

Access to production infrastructure requires operator credentials, and the database is not reachable from the public internet.

No system is perfectly secure. If a breach affects your information we will notify you and the relevant authority as the law requires.

12. International transfers

WriterCV may be operated from a country other than your own, and a service provider may process information in a different country from the one where you are. Where information is transferred outside the European Economic Area or the United Kingdom, we rely on an adequacy decision or on standard contractual clauses, and we limit the transfer to what the service requires.

13. Your rights in the European Economic Area, the United Kingdom, and Switzerland

Where the GDPR or an equivalent regime applies to you, you have the following rights.

• Access: to obtain a copy of the personal information we hold about you. You can export everything from your account settings at any time, without asking us.
• Rectification: to correct inaccurate information and to complete incomplete information. You can edit your profile and your documents directly.
• Erasure: to ask us to delete your information. Deleting your account does this from your side; you can also request it in writing.
• Restriction: to ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
• Portability: to receive the information you gave us in a structured, machine-readable format.
• Objection: to object to processing based on legitimate interest, and to object to direct marketing at any time.
• Withdrawal of consent: to withdraw consent where processing relies on it, without affecting processing carried out beforehand.
• Automated decision-making: you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. WriterCV does not make such decisions about you.

To exercise any of these rights, use the export and delete controls in your account, or write to privacy@writercv.com. We may ask for enough information to verify your identity before we act on a request.

You also have the right to lodge a complaint with your local data protection supervisory authority.

14. California residents

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act applies to you.

• Categories collected. Identifiers such as your email address, username, and display name; commercial information in the form of the content in your documents and, if you subscribe, your payment details as held by our payment provider; internet activity such as pages viewed and the features you used; and professional information you typed into your resume.
• Sources. Collected from you directly, and generated by the service as you use it, such as sign-in timestamps.
• Purposes. Operating the service, providing your documents to you, processing a subscription you ask for, security, and legal compliance. We do not use it for advertising.
• Disclosed to service providers. Hosting, storage, email, payment processing, and, only when you use it, the AI provider. We do not disclose for their own purposes.
• Sold or shared. Not sold, and not shared for cross-context behavioural advertising as those terms are defined by the CCPA. We do not have a revenue stream from sharing your data, because we do not have advertising.
• Retention. For as long as your account is open, then deleted when you close it, with the exceptions described in section 7.

You may request deletion, a copy of your information, or correction of inaccurate information, up to twice in any twelve-month period. Use the controls in your account, or write to us.

We honour the Global Privacy Control signal. If your browser sends it, we treat it as a request to opt out of sharing your information with third parties for cross-context behavioural advertising, and we do not present a cookie banner to ask you again.

15. Your choices and controls

Everything below is available to you directly, without contacting us:

• Edit or delete any resume, cover letter, or application from your dashboard.
• Unpublish a public resume, or change it back to private.
• Add or remove the password that protects a published resume.
• Export or permanently delete your entire account and all associated data.
• Revoke an API key, and disable two-factor or passkeys.
• Delete your guest resume from the browser at any time by clearing site data.

16. Children

WriterCV is intended for people aged 16 and over. We do not knowingly collect information from anyone younger. If you believe a child has given us information, contact us and we will delete it.

17. Changes to this Policy

We review this Policy at least every twelve months and update it when our practices change. The version published on this page is the version that applies. We will post a notice on the site for a material change, and we will update the date at the top of this page.

18. Contact

Questions about this Policy, and requests about your information, go to privacy@writercv.com.

Anything else about the service, including support, goes to hello@writercv.com.

Our help centre is at https://writercv.com/contact.

WriterCV, WriterCV, https://writercv.com.