Privacy policy

What we keep

Only what the service needs to work:

• What you write — your CVs, cover letters and any photo you add. It is yours; we store it so you can come back to it.
• Your account, if you make one — an email address, and a password stored only as a hash. If you sign in with Google we receive your email address and nothing else.
• Your settings — the country you are applying in, your language and your theme.
• Your job applications, if you use the tracker — the employer, the role, the stage, your notes and the CV version you sent.
• Sign-in records and server logs — session times, browser, IP address and similar — kept briefly to keep you signed in, fix problems and stop abuse.

No account needed

You can write without signing up. In that case we create a guest account behind the scenes so your work survives a page reload, reachable only through the cookie in your browser. If you sign up later, the work moves to your account.

Cookies and analytics

Cookies are for signing in, not for advertising or following you around the web: one session cookie that keeps you signed in for 30 days, and a short-lived one during Google sign-in. Your theme and language stay in your browser.

We count visits with a privacy-focused tool we run ourselves. It sets no cookies and builds no cross-site profile; what we record is deliberately coarse — a page, a template, a country — and never what you wrote. Some deployments also load Google Analytics.

PDF export

When you download a PDF, your document is rendered on our server and the file is not kept afterwards.

Who else sees it

We do not sell your data or share it for advertising. It reaches other companies only where the service could not run without them — our hosting and storage providers, our email provider, Google if you choose to sign in with Google, and Cloudflare in front of the site. Some of them may process data in other countries. We will also disclose data where the law genuinely requires it.

Keeping and deleting

Documents you delete stay recoverable for about 30 days and are then erased. Abandoned guest accounts and expired sessions are cleaned up automatically. Deleting your account deletes your documents and uploaded files; if something is not doable in the interface, write to us and we will do it.

Security

Traffic runs over HTTPS, and passwords and session tokens are stored hashed. No service can promise perfect security, so do not put anything in a CV you would not want a future employer to read.

Children

CVSheet is not aimed at children under 16, and we do not knowingly collect their data.

Changes and contact

If this policy changes we will update the date at the top of the page. Questions, corrections or deletion requests: [email protected].