Privacy Policy
1. The short version
ResumeScan analyses the resume you upload so we can show you how an applicant tracking system reads it. Your file is processed on our servers, used to generate your result, and permanently deleted within 24 hours. We do not use your resume to train any model, we do not sell your data, and we do not require an account to use the free scan.
- Your resume file is deleted within 24 hours of upload.
- Your resume is never used to train an AI model.
- No third-party AI processor ever receives your file.
- We never sell, rent, or share your personal data.
- Card details are handled entirely by our payment processor and never touch our servers.
2. What we collect
Information you give us
- Resume file. The PDF, DOCX, or TXT you upload, plus technical metadata about it (file size, type).
- Job description. Only if you choose to paste one. It is used for keyword matching and deleted on the same schedule as your resume.
- Industry selection. A category you pick, used to tune detection rules.
- Email address. Optional, and only collected at checkout so we can send your receipt and support replies.
- Support messages. If you email us, we keep them so we can answer you.
Information collected automatically
- Anonymous visitor ID. A random identifier (UUID) stored in your browser's local storage. It is not linked to your name, email, or IP address, and it exists so we can apply free-tier limits and remember your purchase.
- Server logs. Standard request logs including IP address, timestamp, user agent, and requested page, retained briefly for security and debugging.
- Aggregate usage events. Page views, uploads, completed scans, and conversions, recorded with the anonymous visitor ID. These contain no resume content.
- Referrer. If you arrive from a link with a referral tag, we record it to know which channels work.
3. How we handle your resume
When you upload a file, it is transmitted over HTTPS to our server, parsed by our rule engine, and used to generate your score, issue list, and (if purchased) corrected document. The file is written to temporary storage only for as long as processing requires.
Automatic deletion is enforced by a scheduled job, not a manual step. Within 24 hours of upload, both the original and any generated file are overwritten and removed from storage and from backups. What remains is your score, your issue list, and your purchase record — numerical and descriptive metadata that contains none of your resume's actual content.
Access to uploaded files is limited to the engineers operating this service. We do not sell, share, or licence your resume to anyone, and we do not use it for advertising.
4. No model training
Resume detection runs on a deterministic, rule-based engine that we wrote ourselves. No large language model or third-party AI service processes your resume at any point.
Consequently: your resume is not used to train, fine-tune, or evaluate any machine learning model, ours or anyone else's. It is not used to build statistical profiles. If this ever changes, we will update this policy and ask for explicit consent first.
5. Cookies and analytics
We use no advertising cookies, no third-party tracking pixels, and no cross-site behavioural profiling. Specifically:
- localStorage:
rs_visitor— stores your anonymous UUID on your own device. This is a first-party storage entry, not a cookie, and it never leaves your browser except as part of an API request. - sessionStorage:
rs_admin_auth— dashboard credentials, only on the internal admin page, cleared when you sign out or close the tab. - localStorage:
rs_last_scan— remembers your most recent scan ID on your device so you can reopen your report.
We may use privacy-respecting, aggregate analytics to count page views and conversions. This data is reported only in totals (for example, "640 scans"), never broken down to an individual, and is never linked to your resume content. You can block or clear local storage in your browser at any time; the only consequence is that free-tier limits may not be remembered between visits.
6. Payments
All payments are processed by Creem, an independent payment processor. When you purchase, Creem collects your card details directly through its own secure checkout.
Creem never receives your resume file. We transmit only a scan identifier, your anonymous visitor ID, the product you selected, and an email address if you provided one. In addition to this service, Creem acts as a data processor and is required to meet its own legal obligations, including anti-fraud checks and, where legally required, tax determination.
We receive confirmation of the transaction — product, amount, timestamp, and a transaction reference — which we keep as a purchase record for accounting and support purposes.
7. Share links
If you choose to create a share link, we generate a private, unguessable URL that reveals only a score, a verdict, an issue count, and a high-severity count. It does not reveal your name, your contact details, your resume text, or the specific issues found.
Share links expire automatically after 7 days. Anyone who is not logged in can view a share link, so treat it as you would a public URL. You can simply stop sharing it; expiry handles the rest. We do not track who opens a link or how many times it is opened.
8. Data retention summary
| Data | Kept for | Notes |
|---|---|---|
| Uploaded resume file | Under 24 hours | Deleted by scheduled job |
| Pasted job description | Under 24 hours | Deleted with the file |
| Generated corrected file | Under 24 hours | Deleted with the file |
| Score and issue metadata | 12 months | Contains no resume text |
| Purchase records | 7 years | Accounting and tax obligations |
| Server logs | 30 days | Security and debugging |
| Share links | 7 days | Then permanently deleted |
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, to object to processing, and to complain to a supervisory authority.
Because we do not require an account, most of our data is tied to an anonymous browser identifier rather than to you personally. Practically, this means: your resume is already deleted within 24 hours regardless of what you request, which is stronger than any deletion guarantee we could otherwise offer. For everything else, email us and we will respond within 30 days.
We do not sell personal information, and we have not done so in the past. We have not knowingly collected data from children under 13.
10. Children
ResumeScan is a professional tool intended for adults aged 18 and over who are seeking employment. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
11. Contact and policy changes
This is an independent product operated by a solo developer. Questions, deletion requests, and complaints are welcome and answered by a human.
- Email: privacy@resumescan.app
- General: hello@resumescan.app
We may update this policy as the service changes. The "Effective" date at the top always reflects the current version. Material changes to how your data is handled will be announced on this page before they take effect.