Privacy Policy

Effective Date: March 11, 2026

1. Introduction

At CVCrafter ("we," "us," or "our"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, process, store, and share information when you use the CVCrafter mobile application ("App").

By downloading, installing, or using CVCrafter, you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use the App.

This Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR), Apple App Store requirements, and other applicable data protection laws.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address through Firebase Authentication. If you choose to sign in with Apple, we receive the information you authorize Apple to share (which may include your email address or an Apple-generated relay email). This information is used to identify your account, manage your subscription status, and communicate with you about your account.

2.2 CV/Resume Content

When you use the App's analysis features, you may upload your CV/resume files. The App supports the following file formats: PDF, DOCX, DOC, TXT, and RTF with a maximum file size of 10MB. This content is processed temporarily for analysis purposes and is not permanently stored on our servers (see Section 4 for details).

2.3 Job Description Content

You may provide job descriptions by pasting text directly into the App or by providing a URL from which the job posting text is extracted. This content is used solely for comparison with your CV during analysis and is not permanently stored.

2.4 Usage Data

We collect usage data stored in Firebase Firestore's usage collection, including:

Daily analysis count (number of analyses performed per day);
Subscription status and plan type (free, weekly, monthly, or yearly);
Account creation date;
Last analysis timestamp.

2.5 Analytics Data

We collect anonymized app usage statistics through Firebase Analytics, including:

App usage frequency and session duration;
Features used (e.g., ATS analysis, CV generation, cover letter generation);
App version and update history;
Crash reports and performance metrics.

2.6 Device Information

Firebase automatically collects certain device information, including:

iOS version;
Device model (e.g., iPhone 15, iPad Pro);
Device language and region settings;
General geographic location (country/region level, not precise location).

3. How We Use Your Information

We use the information we collect for the following specific purposes:

CV Analysis and Optimization: Processing your CV content against job descriptions to provide ATS compatibility analysis;
ATS Compatibility Scoring: Calculating and providing a compatibility score between your resume and the target job description;
Missing Keywords Detection: Identifying important keywords and phrases from the job description that are absent from your resume;
AI-Optimized CV Generation: Generating a professionally optimized version of your resume tailored to the target position;
Cover Letter Generation: Creating personalized cover letters based on your CV and the target job description;
Usage Limit Tracking: Monitoring daily analysis counts to enforce subscription plan limits;
Subscription Management: Verifying your subscription status to provide appropriate access levels;
Service Improvement: Using anonymized analytics data to improve App performance, features, and user experience;
Communication: Sending you important updates about your account, the App, or changes to our policies.

4. How We Process Your CV Data

This section describes the detailed processing flow of your CV and job description data, which we believe is the most important information for our users to understand:

Upload: You upload your CV file (PDF, DOCX, DOC, TXT, or RTF) or paste your CV text, and provide a job description in the App.
Transmission: The CV content and job description are securely transmitted via HTTPS to our Firebase Cloud Functions backend (hosted in the europe-west1 region).
AI Processing: Our Cloud Function forwards the content to the Anthropic Claude API for AI-powered analysis. The API processes the content and returns the analysis results (ATS score, missing keywords, optimized CV, and cover letter).
Response Delivery: The analysis results are returned directly to you through the Cloud Function response. Results are not written to Firestore or any persistent database.
Data Disposal: After the analysis is complete and results are delivered, your original CV content and job description are not stored on our servers. The data exists only in memory during the processing request and is discarded upon completion.
Usage Tracking: Only your usage counters (number of analyses performed, timestamp) are updated in the Firestore usage collection. No CV content, job descriptions, or analysis results are stored.

Important: Anthropic, the provider of the Claude API, does not use API inputs or outputs to train their AI models. For more information about how Anthropic handles data, please refer to Anthropic's Privacy Policy.

5. Third-Party Services

CVCrafter uses the following third-party services to provide its functionality. Each service has its own privacy policy governing how it handles data:

5.1 Firebase Authentication

Used for user account creation, authentication, and session management. Handles email/password authentication and Sign in with Apple integration.

5.2 Firebase Cloud Functions

Our serverless backend hosted in the europe-west1 region. Processes CV analysis requests and communicates with the Anthropic Claude API. All data processing occurs within this controlled environment.

5.3 Firebase Analytics

Collects anonymized usage statistics, app performance data, and crash reports to help us improve the App. No personally identifiable CV content is included in analytics data.

5.4 Firebase Cloud Messaging

Used to deliver push notifications to users about important updates, new features, or account-related information.

5.5 Anthropic Claude API

The AI service used to analyze CV content, generate ATS compatibility scores, identify missing keywords, and produce optimized CVs and cover letters. Anthropic does not use API inputs or outputs to train their models.

5.6 Apple StoreKit 2

All subscription payments, billing, and transaction management are handled by Apple through StoreKit 2. CVCrafter does not have access to your payment details, credit card information, or billing address. All financial transactions are governed by Apple's terms and privacy policy.

6. Data Storage & Retention

Account data (email address, authentication tokens): Retained as long as your account is active. Deleted within 30 days of account deletion request.
Usage data (daily analysis counts, subscription status): Stored in Firebase Firestore as daily counters. Retained as long as your account is active.
CV content and job descriptions: Not stored permanently. Processed only in-memory during the analysis request and discarded immediately after results are delivered.
Analysis results (ATS scores, optimized CVs, cover letters): Returned directly to the App and not stored on our servers or in Firestore.
Analytics data: Retained in aggregated, anonymized form according to Firebase Analytics' standard retention periods (14 months for user-level data, aggregated data retained indefinitely).
Device-local data: The App may store certain data locally on your device (such as guest usage tracking). This data is removed when the App is uninstalled.

To request deletion of your account and all associated data, contact us at support@cvcrafter.co. We will process your request within 30 days.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Encryption in transit: All communications between the App, our backend, and third-party services are encrypted using HTTPS/TLS protocols.
Secure authentication: User authentication is managed through Firebase Authentication with industry-standard security practices.
Firestore security rules: Client-side access to Firestore is configured as deny-all. All data write operations are performed exclusively through Firebase Cloud Functions using the Admin SDK, preventing unauthorized direct database access.
Rate limiting: Per-user rate limiting of 10 requests per minute is enforced to prevent abuse and ensure system stability.
No persistent CV storage: By design, CV content and job descriptions are never written to persistent storage, minimizing the risk of data exposure.
Server-side validation: All usage limits and subscription verification are enforced server-side through Cloud Functions.

While we strive to use commercially acceptable means to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to improve our security measures.

8. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or other jurisdictions with applicable data protection laws, you have the following rights regarding your personal data:

Right of Access: You have the right to request a copy of the personal data we hold about you.
Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your personal data. You can delete your account by contacting us, and all associated data will be removed within 30 days.
Right to Data Portability: You have the right to request your personal data in a structured, commonly used, and machine-readable format.
Right to Object: You have the right to object to the processing of your personal data for certain purposes, including direct marketing.
Right to Restrict Processing: You have the right to request that we limit how we process your personal data under certain circumstances.
Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at support@cvcrafter.co. We will respond to your request within 30 days. If we need additional time, we will inform you of the reason and extension period (up to an additional 60 days).

If you believe that we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with a supervisory authority in your jurisdiction.

9. Children's Privacy

CVCrafter is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13 years of age. If you are under 13, please do not use the App or provide any personal information.

If we become aware that we have inadvertently collected personal data from a child under 13, we will take immediate steps to delete that information from our systems. If you are a parent or guardian and believe that your child under 13 has provided us with personal information, please contact us immediately at support@cvcrafter.co.

10. Cookies and Tracking

As a native iOS application, CVCrafter does not use traditional browser cookies. However, the following tracking technologies may be used:

Firebase Analytics SDK: Uses device identifiers to collect anonymized usage statistics. This data helps us understand how users interact with the App and improve our services.
Firebase Cloud Messaging: Uses device tokens to deliver push notifications.
Local storage: The App may store limited data locally on your device (such as guest usage tracking and user preferences).

You can opt out of Firebase Analytics data collection through your device's privacy settings: Settings > Privacy & Security > Analytics & Improvements on iOS. Please note that opting out may limit our ability to improve the App experience.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

The "Effective Date" at the top of this page will be updated;
The revised policy will be posted on our website at cvcrafter.co/privacy;
For material changes, we will provide notice through an in-app notification.

Your continued use of the App after the revised Privacy Policy has been posted constitutes your acceptance of the changes. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or if you wish to exercise your data protection rights, please contact us at:

Email: support@cvcrafter.co
Website: cvcrafter.co

We aim to respond to all inquiries within 30 days.