Privacy Policy

Last updated: 9 September 2026

cv0 ("cv0", "we") is a résumé-tailoring service operated by the owner of cv0.org. This policy explains what we store when you use the site at cv0.org and the application at app.cv0.org, why we store it, and how to get it back or delete it. If anything here is unclear, write to hello@cv0.org.

What we collect

Account data. Your email address, display name, password hash or passkey credential, and optional Google or GitHub sign-in identifiers. Email verification, login and password-reset messages are sent through Resend.

Résumé content. Everything you type or import into the editor: work history, education, skills, projects, links, summaries, and uploaded source files (PDF or DOCX). Uploaded source files are deleted from storage as soon as they have been parsed; only the structured result is kept.

Job descriptions and application packages. The job postings you paste, the role-fit screen, the tailored versions you approve, cover letters, ATS answers, and the tracking notes you add (dates, status, salary quote). Each approved package is stored as an immutable record together with an audit trail of what the AI proposed and what you accepted.

Facts and boundaries. The optional bank of standing facts you maintain in settings: work authorization, sponsorship, relocation, salary range, canonical education line, links, verified facts, and the "do not claim" ledger. It exists so the service never restates something you told it not to.

Browser extension. If you install the cv0 extension, it sends the form fields of the job application page you are on, and the package you selected, to the application so it can propose values. It never submits a form for you and stops on anything it cannot map with certainty. Reviewed page snapshots are kept only for the duration of the fill.

Billing. Subscriptions are handled by Stripe. We store your Stripe customer identifier, plan, and subscription status. We never see or store card numbers.

Usage. Server logs (IP address, user agent, timestamps) for security and debugging, and cookieless page-view analytics on the marketing site (Umami, self-hosted). The application uses only the session cookie needed to keep you signed in.

How we use it

  • To run the product: store your résumé, generate tailored versions, render PDFs, and fill forms you ask us to fill.
  • To generate text with a large language model. Résumé content, the job description, your facts bank, and cover-letter drafts are sent to xAI's API for the duration of the request. Prompts and outputs are not used by xAI to train models under its API terms. We keep the AI's proposals in your audit trail so you can see exactly what was generated and what you approved.
  • To send transactional email (verification, sign-in links, password resets, receipts).
  • To bill you, if you subscribe.
  • To keep the service secure and to investigate abuse.

We do not sell personal data and we do not use your résumé content for advertising, model training, or anything other than serving your account.

Where it lives and who processes it

Data is stored on a server we operate in the European Union (PostgreSQL and object storage on the same host). The processors we rely on:

| Processor | Purpose | |---|---| | xAI (api.x.ai) | Text generation for role screening, tailoring, cover letters, bullet rewrites, form-fill suggestions | | Stripe | Subscriptions and payments | | Resend | Transactional email | | Google / GitHub | Optional social sign-in |

Retention

| Data | Kept until | |---|---| | Uploaded source files | Deleted immediately after parsing | | Résumés, versions, packages, facts bank | You delete them, or you delete your account | | AI audit rows (what was proposed) | 12 months, or account deletion | | Editor snapshots | The most recent 30 per résumé | | Server logs | 30 days | | Billing records | As long as tax law requires |

Your rights

You can export every résumé as JSON Resume or cv0 JSON from the editor at any time, and delete individual résumés, versions, and packages. Deleting your account from Settings → Danger zone removes your data from our systems within 30 days, except billing records we are legally required to keep. You may also ask us to access, correct, or erase your data, or object to processing, by writing to hello@cv0.org. If you are in the EU or UK you can lodge a complaint with your data-protection authority.

Cookies

app.cv0.org sets a session cookie required for sign-in and a preference cookie for language and theme. cv0.org sets no tracking cookies; analytics are cookieless and aggregate.

Changes

We will post changes to this page and update the date at the top. Material changes will also be announced in the application.