Security

You upload a PDF or DOCX of up to 5 MB. We read it in memory, take the text, and discard the file. The file is never written to disk or to the database.

The free check stores nothing on our servers: no file, no text, no result. So that an account made afterwards can pick it up, this browser tab keeps the file until you close it.

Signed in, we keep the extracted text, a SHA-256 hash of the file, and the analysis result on your account, so you can re-check and compare.

The scam check and the roast work the same way: read in memory, answered, discarded. The scam check log keeps only the ids of the rules that matched, the result level, and the length of the message.

Source · , parser limit 5 MB · , engineering security notes · , privacy

An account: your email, display name, phone number, and a password hash made with argon2id. The password itself is never stored.

What you create: resume text and results, tailored versions, applications, academic details for eligibility, prep progress and certificates.

Connection details at sign-up and sign-in: IP address, approximate region, network operator, and times. The privacy policy lists each with its reason.

Source · , privacy policy · , argon2id, password hashing module

While your account is active.

Deactivate from Settings: it signs you out everywhere, blocks sign-in, keeps your data, and reserves your email and phone so the account cannot be re-created.

Full erasure on request: an operator runs it and it cannot be undone.

It removes your resume text, analyses, applications, profile, prep progress, certificates, password, name, phone, Google link, IP addresses and location data. An anonymous record that an account once existed remains.

An answer from an AI provider is kept so that the same request within 7 days returns the saved answer without using a credit.

Source · , privacy policy · , our promise

Every page and every API call is served over HTTPS. In production the API sends a Strict-Transport-Security header of two years that covers subdomains, so a browser that has visited once will not fall back to plain HTTP.

At rest we rely on the hosting providers: the database is hosted on Neon and backups go to Cloudflare R2. We add no encryption layer of our own on top of theirs.

A daily database backup is scheduled. We have not yet proven a restore from it, and we will say so here until we have.

Source · , API security headers · , engineering security notes, 20 Aug 2026

Passwords are hashed with argon2id.

An access token lives in browser memory for 15 minutes. The refresh token is an HttpOnly, Secure, SameSite=Lax cookie scoped to the auth endpoint.

The refresh token is rotated on every use. If a rotated token is presented again within 60 seconds of its rotation, we treat it as two tabs refreshing at once and keep you signed in.

Presented again after that, it is treated as a stolen token and the whole session family is revoked.

A session ends 8 hours after sign-in whatever happens. Repeated failed sign-ins lock the account for a while; the lock is keyed on the account, not the address, so changing address does not reset it.

Source · , auth configuration · , 15 minute access token, 8 hour session, 60 second grace

Two providers, named as providers and never as models, because routing changes.

Groq first for job-description extraction, bullet rewrites and suggestions, with Google AI Studio as the fallback when Groq fails or is switched off. Google AI Studio for cover letters, interview prep, tailoring and LinkedIn improvements.

Text goes to them only when you press an AI button. Before it leaves, email addresses, phone numbers, links and your own name are replaced by placeholders, and restored only in what you see.

Schools and employers stay, because a rewrite needs them.

Every call goes through one gateway, and each call's input is capped: 24,000 characters for a tailored version and 16,000 for every other call. The score never uses an AI provider.

Source · , privacy, full disclosure · , AI gateway, one chokepoint

• Sign-up has a limit per address, a Turnstile check when it is switched on, a check that the email domain has mail records, and a short list of throwaway-mail services it refuses. Email verification comes before any AI call.
• Sign-in has a limit per address and a lockout per account after repeated failures.
• The free check has a limit per address and a short queue. When the queue is full it answers at once with a wait time instead of timing out.
• Each account has a number of AI credits and at most 8 uncached AI calls a minute. The whole service has a daily ceiling on AI calls.
• Requests are capped at 6 MB and uploads at 5 MB.
• A failed AI call is not charged, and an exact repeat is served from the saved answer.

Source · , API configuration · , auth email checks · , engineering security notes, 9 Jun 2026

Crash reports go to Sentry with where the fault happened, never the request body or the values inside the code. Your resume, a job description or a message you checked is not in them.

Analytics uses no cookies. Our own counters are anonymous daily counts of named events, such as a check finished or a share pressed, with no identifier attached.

Vercel Web Analytics, from our host, counts page views and referrers without cookies. Neither builds a profile of you.

Source · , privacy · , error monitoring settings · , event counters

Found a security problem, or something that does not match this page? Use the feedback form. Every message is read. Signed in, use Support.

Please do not probe the service for weaknesses beyond what you need to report. The terms ask for written consent first.