How your resumes and connected apps are protected

Where your data lives

• Your account and resumes are stored in a Cloudflare D1 database, and the app runs on Cloudflare Workers. We don't pin the database to a region.
• Traffic to cvember.com is encrypted in transit (HTTPS/TLS). Cloudflare encrypts D1 data at rest.
• PDFs are made in your browser, not on our servers.
• Passwords and one-time codes are stored only as hashes.

Who can see it

• Your resumes are tied to your account and are shown only to you when you're signed in.
• An app you connect can reach only your own resumes, with the access you chose (read-only or edit).
• When you upload a resume or use an AI feature, the text is processed by third-party AI providers to produce your results. See the privacy policy for every service provider.

What we never do

• We never sell your data, and we don't show ads. You can delete your account anytime.
• We don't use your resumes to train AI models.
• We don't store card numbers or UPI PINs. Payments are handled by Razorpay or PhonePe, with PayPal for payments outside India; we keep only the order and payment reference.

Deleting your data

• You can delete a single resume, or your whole account from Account and security, after confirming it's you with an email code.
• Deleting your account erases your resumes' content, your name, email, phone number and password at once, and signs you out everywhere.
• Payment records are kept for 8 years, as tax law requires. The privacy policy lists the rest.

Connected apps and API keys

• API keys are shown once and stored only as a keyed hash; they expire (default 90 days) and can be paused or revoked any time.
• Connected apps sign in with OAuth 2.1 (PKCE) and a consent screen, and you can disconnect them at once.
• An app can never buy anything or send your resume anywhere. The ChatGPT and Claude connection won't overwrite a resume until the app sends an explicit confirmation, and tells it to ask you first.
• Tailoring never changes your original resume: each job gets its own version. Every change an app makes can be undone for 30 days.
• Unusual activity pauses or limits a connection automatically and tells you by email.
• Every call is logged without your content and kept 400 days.

Report a problem

Email security@cvember.com. We reply within 3 working days. Please don't access other people's data or disrupt the service while testing.