Privacy, explained clearly.

1. Scope and service operator

This policy applies to ResumeReveal, the professional website and resume-building application available at resumereveal.com and its Studio. References to “ResumeReveal,” “we,” “us,” and “our” mean the operator of the ResumeReveal application. It does not govern independent websites or services you choose to link from your profile.

2. Google Account data

If you choose “Continue with Google,” Google and our authentication provider, WorkOS, provide only the basic identity information needed to sign you in:

• your Google Account’s unique identifier;
• your name;
• your email address and email-verification status; and
• the standard OpenID Connect authentication result needed to establish a secure ResumeReveal session.

We do not sell Google user data, use it for targeted or personalized advertising, determine creditworthiness, provide it to data brokers, or use it to train generalized artificial-intelligence or machine-learning models. ResumeReveal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3. Information we collect

Cookies and local preferences

We use necessary cookies to maintain authenticated sessions, protect sign-in and consent flows, and remember supported preferences such as light or dark appearance. We do not use third-party advertising cookies.

4. How we use information

We use information to authenticate users; create and secure accounts; save, edit, preview, publish, unpublish, and delete professional websites; process requested uploads; generate private résumé PDF downloads when you ask for them; provide plan features; send essential service communications; honor optional marketing preferences; monitor reliability and abuse; respond to support and privacy requests; and comply with legal obligations.

Your draft remains private unless you publish it. When you publish, the content and files you selected for public display become available on the public internet and may be indexed or cached by search engines and other third parties. A PDF generated in Studio is downloaded privately; it does not replace an uploaded résumé or appear on your website automatically.

5. When information is shared

We disclose information only as needed to operate the service, follow your instructions, protect users, or comply with law. Our principal service providers are:

• WorkOS, which processes sign-in and authentication information;
• Cloudflare, which provides application hosting, security, databases, key-value storage, file storage, email delivery, rate limiting, private PDF generation through Browser Run, and—when you deliberately use an AI feature—Workers AI and AI Gateway processing;
• professional advisers or authorities when reasonably necessary to meet legal obligations, establish or defend legal claims, or protect the service and its users; and
• a successor in a merger, financing, acquisition, reorganization, or sale, subject to this policy and applicable law.

We do not sell or rent personal information. We do not disclose Google user data to third parties for advertising, data brokerage, credit, lending, or generalized AI-model training.

6. Optional AI features

AI tools run only when an eligible signed-in user deliberately invokes them. Resume import temporarily processes the uploaded PDF or DOCX and extracted text to propose profile fields. AI coaching processes the relevant saved resume text, selected content, and short conversation needed to answer the request. Suggestions are review-only and do not modify a draft until you apply them.

These requests are sent through Cloudflare AI Gateway to Cloudflare Workers AI. ResumeReveal does not persist AI-import source files or AI chat history as separate application records. Gateway logs contain operational metadata such as the authenticated account identifier, name, email, feature, request identifier, model, token usage, status, cost, and duration; prompts, uploaded content, and generated responses are excluded from those Gateway logs, and response caching is disabled. ResumeReveal does not use Google user data or resume content to train generalized AI or ML models.

Private résumé reviews

The current reviewer uses bounded deterministic checks on saved profile content, not model assessment or comprehensive résumé analysis. Older reviews may contain model-assisted advice. The latest review report is retained privately in our database, including scores, exact profile excerpts, field references and validated review advice. New Review Results reports also retain the reviewed visible profile content and its rendering settings so you can inspect the exact version reviewed. They do not retain the original uploaded résumé, account email, or uploaded assets. Question answers stay in your current browser page until you explicitly apply them to your draft; they are not stored in a separate evidence bank. Reports expire from the application after 90 days. Expiration is not immediate physical deletion: records remain until replaced or removed by site or account deletion; older-format reports may remain separately for compatibility. Pasted review job descriptions are not retained. A separate usage ledger records request identifiers, quota accounting, model and prompt versions, processing status, duration, token usage and estimated cost without profile text, job descriptions or recommendations. These ledger records currently remain until site or account deletion. Provider processing and backup retention policies also apply; excluding payloads from Gateway logs is not a promise of zero provider retention.

Optional wording and detail assistance

When you explicitly request an AI-assisted language review, wording polish, an optional question, or a revision incorporating confirmed facts, we send the relevant visible text and request context to OpenAI's GPT-6 Luna through Cloudflare-managed AI Gateway routing. Language review checks bounded visible headlines, About, populated Looking for and entry descriptions. Its language advice is separate from deterministic scores and is not factual verification. Polish uses the selected text and protected terms already present in it, not an unrelated inventory of your profile. Detail assistance uses the selected description, issued questions and relevant facts you confirm. It does not send your uploaded résumé, account email, or unrelated profile fields.

For these requests we set store:false, suppress Gateway logging and payload collection, and bypass Gateway response caching. We retain only content-free operational usage records in our application. These request controls do not establish OpenAI's retention or training settings. Provider processing and retention may still apply; we do not promise zero retention, a fixed provider deletion deadline, a particular processing location, or that Cloudflare's data-processing agreement covers OpenAI's processing. A notice is shown before you invoke these optional tools. You can instead use verified corrections or manual editing. Suggestions do not save or publish automatically; you must review and explicitly apply them.

Staging résumé import experiment

When the staging Luna import experiment is enabled, Cloudflare converts your PDF or DOCX to text, then OpenAI's GPT-6 Luna extracts structured profile details through Cloudflare Workers AI and AI Gateway. The text includes personal details present in your uploaded résumé, but not your account tokens or unrelated saved draft. Requests use store:false, bypass response caching and exclude payloads from Gateway logs. Metadata-only operational logging remains enabled. These controls are not a guarantee of zero provider retention; Cloudflare and OpenAI processing and retention policies apply. ResumeReveal does not persist the source upload, extracted text or raw response. Review the proposal before Apply; nothing is published automatically. The experiment does not change production import's model.

7. How information is protected

ResumeReveal uses HTTPS encryption in transit, provider-managed encryption for stored data, signed and secure session controls, access checks tied to the authenticated user, restricted production credentials, file-type and size validation, rate limiting, security headers, and private storage bindings. Public profile data is separated from private draft and account data. No online service can guarantee absolute security, but we maintain safeguards designed for the sensitivity and use of the information we process.

Applied review change history

When you apply an improvement or save a field through AI Review, we privately retain its before and after text, exact field reference, review identity, revisions, timestamps, supporting-content fingerprints and Undo status. Reviewer draft edits are labeled separately from AI improvements. History is limited to the latest 30 changes per site and expires after 90 days; expired or excess records are removed during history reads and writes. Answers, coaching context, unapplied suggestions and proposal tokens are not saved in this history. Site or account deletion also removes these records.

8. Retention and deletion

Account, draft, consent, and profile data are retained while your account is active and for only as long afterward as reasonably necessary for security, legal, dispute-resolution, and operational obligations. Published snapshots remain available until you unpublish the site or delete the account. Saved headshots and resume files remain until you replace or delete them or delete the account.

You can permanently delete your account from ResumeReveal’s Account page. The deletion process removes your ResumeReveal database record and associated sites, public route mappings and published snapshots, stored headshots and resume files, and the corresponding WorkOS authentication user. Pending checkouts must be closed or reconciled, and active subscriptions canceled, before deletion completes.

Limited trial-use record: to prevent repeat free trials through account deletion, we retain a keyed hash of your verified email address, the original trial start date, and an expiry date for 365 days from trial start, including after account deletion. This separate record contains no readable email address, account ID, payment-card details, résumé, or website content. The keyed hash is pseudonymous, not anonymous; it is used only to check trial eligibility and prevent trial abuse, not for marketing. Deleting or recreating an account does not restart this retention period. Expired records immediately stop affecting eligibility and are physically removed by bounded periodic cleanup; removal may take additional cleanup runs.

Limited records may remain temporarily in backups, security logs, provider systems, or legal records until their applicable retention periods expire. Stripe processes payments and may retain billing records under its own obligations and policies. Search engines and third parties may retain copies of information that was public before deletion.

9. Your choices and controls

• Edit, correct, publish, or unpublish profile content in Studio.
• Control whether supported contact details, headshots, and resume files appear publicly.
• Withdraw optional marketing consent in Account settings without affecting essential service messages.
• Decline optional AI tools and continue using ordinary editing features.
• Delete your account and associated ResumeReveal content from Account settings.

Depending on where you live, you may also have rights to request access, correction, deletion, restriction, objection, or portability of personal information. ResumeReveal will respond to applicable requests after reasonably verifying account ownership.

10. Policy changes

We may update this policy as ResumeReveal changes. The effective date above will be updated when we do. If a change materially affects how account or Google user data is used, we will provide an appropriate notice in the service and request renewed consent when required.

11. Privacy questions and requests

Signed-in users can use the privacy, account-management, and deletion controls in the ResumeReveal Studio. If you cannot access your account, contact the ResumeReveal operator using the developer contact information shown on the verified Google OAuth consent screen and identify the email address associated with your account. We may need to verify account ownership before completing a data request.