Privacy Policy

When you create an account we store your email, display name, phone number, and a hashed password (argon2id, never the plaintext).

We also store a SHA-256 hash of each resume, the text extracted from it, and the analysis results attached to your account.

We do not store the original resume file. The PDF or DOCX you upload is parsed in memory and the binary bytes are discarded the moment text extraction is complete.

The free check stores nothing on our servers: no file, no text, no result. So that an account made afterwards can pick it up, this browser tab keeps the file until you close it.

We also record some technical details about your connection when you sign up and sign in. This is how we tell real students from bots and duplicate accounts, which keeps the free AI credits available for people who need them.

How the service is protected is on the security page.

We do not collect GPS or precise location, track you across other websites, or sell any of this to advertisers.

We compare resume hashes between accounts to find duplicate sign-ups.

Ask us and we will tell you exactly what is stored against your account, or ask for it to be erased.

• To authenticate your sessions and keep your analyses private to your account.
• To run ATS scoring, keyword analysis, and rule-based feedback, entirely with local, deterministic rules on our own servers. No resume text leaves our infrastructure for this step. If you never use the AI features, no third party ever sees your resume content.
• To generate AI rewrites, suggestions and a reading of a job description, only when you explicitly tap those buttons. Before any text is sent to either AI provider, we automatically redact email addresses, phone numbers, and URLs (including LinkedIn and GitHub links) and replace them with placeholders. We restore them only when displaying results back to you.
• To send a one-time email verification code when you register.

Two AI providers handle different features, and both receive the same PII-redacted text. Honest details so you can make an informed choice:

• Groq powers job-description extraction, bullet rewrites and resume suggestions. It is used because it is several times faster, which matters for features you wait on.
• Google (Gemma and Gemini models, via AI Studio) powers cover letters, interview prep, tailored versions and LinkedIn improvements, and is the automatic fallback if Groq fails or is switched off. Which model handles which feature changes as we tune for speed and quality; the provider does not.

• What we send: Snippets of your resume text and (where relevant) the job description you pasted, after redaction.
• What we now strip: Your own name, taken from your resume header, in addition to emails, phones and URLs.
• What we still do not strip: Names of schools and companies, and other people's names. Rewriting a bullet about an employer needs to know which employer it is. The model is also instructed not to address you by name.
• Free-tier reality: Google's free tier may use the prompts we send for service improvement, including model training. We are on the free tier because it lets us offer AI features to students at no cost. The redaction step means what Google could see is anonymized fragments, not your full identified resume, but we want you to know exactly what the trade-off is.
• If you would rather not: Just don't use the AI buttons, such as "Improve weak bullets" or "Get AI suggestions". The ATS score, keyword analysis, formatting checks, and rule-based feedback are always available with no AI provider in the loop.

• We do not sell, rent, or share your data with recruiters, employers, or data brokers.
• We do not train our own AI models on your resume data, we don't train models at all.
• We do not run advertising or install tracking pixels.
• We do not store the original resume file after parsing.
• We do not send any resume content to an AI provider when you are only using the ATS score and rule-based feedback, those run entirely on our servers.

What you paste into the scam check is checked in memory by fixed rules and then discarded. It is not stored, not sent to an AI, and not linked to your account.

Our logs keep only which warning signs matched, the result, and how long the message was.

Python, JavaScript and TypeScript run inside your browser, and that code never leaves your device, unless your browser cannot run them and the judge takes over.

Java, Kotlin, Go, Rust, C# and, when the judge is on, C and C++ run on a code judge we operate on Google Cloud in Mumbai, India. The language menu shows which languages run there.

• When you press Run or Submit in one of these languages, your code and the test inputs are sent there over HTTPS.
• The judge runs them in a sealed, throwaway sandbox with no network access, returns the result and deletes the sandbox.
• We do not store that code, and it is not sent to an AI.
• The judge's logs keep only the language, the number of tests, whether the code compiled and how long it took.
• Google Cloud's standard request logs record the time, your IP address and your browser, never your code.
• Your account identifier is held in memory for rate limits and is not logged by the judge.
• We count your judge runs per day to apply a daily limit, and delete those counts within days.
• When a solution is accepted, we record which problem you solved, when, and in which language, for your progress and achievements. Never the code.

Your list of attempts on My submissions is kept on this device in every language and is never uploaded.

We use the following third-party services. Each operates under its own privacy policy:

• Google AI Studio (Gemma and Gemini models), cover letters, interview prep, tailored versions and LinkedIn improvements, and the fallback if Groq fails. Only PII-redacted snippets are sent, and only when you explicitly trigger an AI feature. Free-tier prompts may be used by Google for service improvement. Google's privacy policy and AI Studio terms apply.
• Groq, job-description extraction, AI bullet rewrites and resume suggestions. Only PII-redacted text is sent, and only when you explicitly trigger one of those three features. Groq's privacy policy applies.
• Neon Postgres, hosted database for account and analysis storage.
• Render, backend hosting. Your data is processed within Render infrastructure.
• Cloudflare, DNS, CDN, and bot protection (CAPTCHA) for the API.
• Vercel, frontend hosting, and Vercel Web Analytics, which counts page views without cookies.
• Brevo, transactional email (verification codes and account notifications only). This replaced Resend at the optiresume.in migration; the policy named the old provider until 2026-08-14.
• Google Workspace (Apps Script, Sheets and Gmail), used only when you send us something: a support query, feedback, or a credit request. Your name, email, message and current credit balance are written to a private sheet and emailed to Yash, so the request can be answered. Nothing is sent here unless you press send.
• Sentry, error monitoring, so crashes get noticed and fixed. It receives where a fault happened, never what you sent: request bodies and the values inside the code are switched off, so your resume, a job description or a message you checked is not included.

We keep your data for as long as your account is active. There are two ways to leave, and they do different things.

Deactivate, yourself, from Settings → Danger zone. This signs you out everywhere and blocks sign-in. Your data is retained, and your email and phone stay reserved so the account cannot be re-created.

Full erasure, on request to support. An operator runs it, and it is irreversible. It removes:

• your resume text, every analysis, and everything derived from one
• your applications, academic profile, LinkedIn imports and skill proofs
• all preparation progress: solves, practice days, achievements, test attempts and certificates
• your password, name, phone, Google link, IP addresses and location data

Your email is released, so the same address can register again as a new account. What remains is an anonymous record that an account once existed, plus usage metrics with no personal data in them.

We use one HttpOnly, Secure, SameSite=Lax cookie for your refresh token, scoped only to the auth endpoint. No advertising cookies, no cross-site trackers.

Access tokens live in browser memory only, never in localStorage or IndexedDB.

Analytics uses no cookies. Our own counters are anonymous daily counts of named events, such as a check finished or a share pressed, with no identifier attached.

Vercel Web Analytics, from our host, counts page views and referrers. Neither builds a profile of you across the web or can identify you individually.

Questions or requests? Reach us at support@optiresume.in or via https://yashadake.com.