Your data, explained.

Privacy notice · preview v0.6

Résumé documents and images are read in your browser. This release does not upload or store those files on the ResumeSkillMatch server. Full extracted text remains in the current tab only.

Profile snippets, preferences, saved job records and task progress are held in memory by default. Remember this profile saves them in localStorage on this device. Anyone using this browser profile may be able to access them. Use My Data to export or clear local data.

Optional beta accounts store your email, a salted scrypt password hash, session-token hashes and the accepted preview-terms version in a dedicated Hostinger MySQL database. Session cookies are HttpOnly, Secure on HTTPS and SameSite=Lax. A separate CSRF cookie protects account changes. Sessions expire after seven days or 24 hours of inactivity.

Guest and signed-in accounts use separate browser workspace scopes. Switching accounts opens that account’s draft; returning to the guest workspace restores its own draft. Browser localStorage is not an encryption or shared-device security boundary. Signing in does not automatically upload your profile. Save this workspace explicitly stores a snapshot of confirmed skill evidence, preferences, self-reported progress and up to 100 saved listing summaries. Filenames, original files and full extracted résumé text are excluded. Loading a snapshot can replace this tab’s profile after your confirmation.

Account controls export cloud data or delete your cloud account, sessions and snapshot from the active database after password confirmation. Local browser data has a separate clear control. Hosting backups follow the provider’s retention process; deletion is not a promise of immediate removal from every backup. Email verification, password recovery and paid subscriptions are not enabled in this beta.

OCR downloads engine/language data on first use, including from jsDelivr. Those requests reveal ordinary connection metadata to the CDN; the résumé image is processed locally. English OCR is the preview default.

The web host receives normal HTTP connection metadata such as IP address and request paths. No advertising or third-party analytics scripts are included by this app. Clicking an external learning/job link visits that provider under its own policies.

Search sends role/skill terms, job country and page to our server. Query-based providers, including Himalayas and Jobicy, receive search terms and supported country filters. Fixed public feeds are filtered on our server. Original résumé text, names and contact details are not sent to job providers. Public listing IDs and daily aggregate sample counts are retained for first-seen/history views, separately from private accounts.

Exchange-rate requests go from our server to Frankfurter and contain currency codes, not your résumé or profile. Display-country selection stays in the current page. Private-link imports, email digests and payments are not enabled in this preview.

This is an early preview, not a final commercial privacy/compliance declaration. Operating entity, support contact, processing providers and final retention terms must be published before broad customer onboarding. Avoid using a shared/public device for personal profiles.