Privacy policy

The short version

CVPilot stores the career information you give it so it can build your documents. Your uploaded CV file is read in your browser and is not stored unless you ask us to keep it. Text you send to AI features is processed by Google. You can download or delete everything at any time from Settings.

What we store

• Your account: email address, name, and sign-in details (passwords are hashed).
• Your master profile: experience, education, skills, and other details you enter.
• Job applications you add, including job descriptions and your notes.
• Documents you create: CVs and cover letters, with their design settings.
• Interview plans, question banks, progress, and mock interview transcripts.
• Daily counters of how many AI requests you made, used to apply free limits.

This data is stored in a Postgres database run by Neon, which also handles sign-in. Row-level security means each account can only read its own rows.

Uploaded CV files

When you import a CV, the PDF, Word file, or photo is read in your browser. Only the extracted text is sent to our server to be structured into your profile. The file itself is not uploaded unless you tick “Keep a copy of my original file”. In that case it is stored in private Vercel Blob storage that only your account can add to, and you can delete it in Settings with “Delete stored original CV files”.

For scanned files, text recognition runs in your browser. It downloads its program and language data from the jsDelivr content delivery network; none of your data is sent to jsDelivr.

AI processing

AI features (reading your CV, writing suggestions, tailored CVs, cover letters, interview plans, questions, and mock interviews) send the relevant text from your profile, the job description, and your answers to the Google Gemini API. Google's handling of that text is covered by the Gemini API terms of service.

Important: CVPilot uses the free tier of the Gemini API. On the free tier, Google may use the content you submit to improve its products, and human reviewers may read it. Do not include sensitive information you would not want reviewed, such as ID numbers, health details, or financial information.

Hosting, cookies, and analytics

The app is hosted on Cloudflare. We use only the cookies needed to keep you signed in. We may use Cloudflare Web Analytics to count page views; it does not use cookies or track you across sites. We do not sell your data or use it for advertising.

How long we keep it

We keep your data until you delete it or delete your account. Deleting your account in Settings removes your database rows, any stored original files, and your sign-in account. Copies may remain in our providers' encrypted backups until those backups expire on the providers' normal schedule.

Your choices

• Download everything we hold about you as JSON with “Download my data” in Settings.
• Correct your information at any time in your profile.
• Delete stored original files, or your whole account, from Settings.

Contact

Questions about privacy: [contact email to be added before launch]. [Operator name and address, if required in your jurisdiction.]