Privacy policy

Account: your GitHub name, email, photo and username, and the access token GitHub grants us to read your repositories (you can revoke it on GitHub at any time).

Code history: commit and pull request metadata (identifier, date, lines added and removed, file extensions, message, PR title and description, repository name and address). We never read or store source code or file names. The only exception is dependency manifest files (such as package.json, requirements.txt and docker-compose.yml): from them we read only the list of libraries and services, to learn each project's stack (e.g. PostgreSQL), and we store only the technology names. When you pick a folder in the browser or use the local script, reading happens on your computer and only this metadata is sent.

LinkedIn: the profile PDF is read in memory and discarded; we keep only the extracted data (experience, education, languages, certifications, awards, websites, skills and summary). If you sign in with LinkedIn, we receive your name, email and photo.

LinkedIn data export (optional): the ZIP file is opened in your browser and never uploaded. Only these fields leave your computer: certifications, awards, publications, languages, skills and websites; profile headline, summary (About) and location; primary email and one phone number, for the resume header; positions (company, title, dates, location and description); education (school, degree and years); and projects (name, description, link and dates). Headline, summary, contact details, location, position descriptions and education only fill in what is empty in your profile. We never open messages, connections, invitations, recommendations, saved jobs or applications, receipts, ad data, identity verifications or the text of resumes you uploaded to LinkedIn.

What you write: job descriptions, guided interview answers, edits and the generated resumes.

Feedback and chats (optional): your answers to in-product questions (whether the resume was good, the job result and, when you delete your account, the reason, stored without your name or email), the testimonial you allow us to publish and, if you ask for a call, the phone number you provide, used only to set up the chat and deletable in Settings.

Product usage: funnel events without content (for example, “export imported” and counts), AI usage per generation and technical logs (IP address, browser, date and time) for security, troubleshooting and to prove acceptance of the Terms of use.

Site visits: we count page views and a few clicks (for example, “Create account” and starting a purchase) with Umami, hosted on our own server. No cookies, no third-party trackers and nothing that identifies you; we honor the browser's “Do Not Track”.

Payments: customer, bill and transaction identifiers at AbacatePay (purchases in reais) or Dodo Payments (card purchases) and the payment status. Card data stays with them only.

Providing the service (generating, editing and exporting resumes): performance of a contract (art. 7, V).

Optional imports (LinkedIn, data export, local repositories): your request, which you can undo by deleting the data.

Phone number for the chat with the founder and published testimonial: your consent (art. 7, I), which you withdraw by deleting the number in Settings or asking at [email protected].

Security, fraud prevention and product improvement with aggregated metrics: legitimate interest (art. 7, IX).

Billing and tax obligations: performance of a contract and compliance with legal obligations (art. 7, II and V).

We don't sell your data, don't use it for advertising and don't send it to recruiters: the resume only leaves when you export it.

Anthropic (Claude models), in the United States: receives commit metadata, profile data, the job description and interview answers to write the resume. Under Anthropic's commercial terms, this data is not used to train models.

Oracle Cloud (São Paulo region): server and database hosting. Cloudflare: domain DNS.

GitHub and LinkedIn: only for sign-in and the reads you authorize. AbacatePay (Pix purchases) and Dodo Payments (card purchases, as reseller): payment processing.

Resend, in the United States: sends account emails (welcome, pass confirmation, the reminder that your pass is ending and short emails from the founder asking how it went). It receives your name, email and the email text. The pass-ending reminder has an unsubscribe link.

Public authorities, when required by law or court order.

Using Anthropic involves processing in the United States and, for card purchases, Dodo Payments handles payment data outside Brazil, under article 33 of the LGPD: it is necessary to provide the service you requested and is covered by the providers' contractual safeguards.

While your account exists. When you delete your account (Settings → “Delete my account and data”), we immediately remove your profile, commits, resumes and answers; backups are overwritten within 30 days. Billing records may be kept for the period required by tax law.

So the free plan can't be reused, when you delete your account we keep only an irreversible code derived from your GitHub account identifier and your usage amount (resumes generated and AI consumption), with no name, email or content (legitimate interest: fraud prevention).

We only use what is necessary: the session cookie (sign-in) and the language cookie. Your browser also keeps interface preferences, such as the emails used in the export command. We don't use advertising cookies or third-party trackers.

Encrypted connections (HTTPS), single-use tokens stored only as hashes, a database without public access and backups. No system is 100% secure; in case of a relevant incident, we will notify you and the ANPD as required by law.

Under the LGPD (art. 18), you can confirm the processing, access, correct, request portability, anonymization or deletion of your data, learn who we share it with, revoke consent and file a complaint with the ANPD (Brazil's data protection authority).

Many of these rights are available in Settings (edit and delete). For the rest, write to [email protected].

The service is intended for people aged 18 or older and does not knowingly collect data from minors.

We may update this policy. The date at the top shows the version in force; relevant changes will be announced in the service or by email.