ResumeHome

Privacy Policy

Effective date:
Last updated:

Who is responsible

  • Resume Home is operated by Bolong Tech Inc., British Columbia, Canada, which is responsible for your personal information. Write to [email protected] with any privacy question or request.

What we collect

  • Account details: your email address, the name you give, and a password stored only as a salted hash — or, if you sign in with Google, the email address, name and profile picture Google shares with us; or, if you sign in with Apple in the iOS app, the email address Apple shares with us, which may be a private relay address Apple forwards to yours
  • What you put into Resume Home: profile facts and their history, resumes, job descriptions, tailored resumes and cover letters
  • A photo, only if you add one to a resume: it is cropped, resized and re-encoded in your browser before it is saved, so the original file and its details (such as location and camera) are not kept
  • Text extracted from a resume when you confirm it as Profile facts; the uploaded PDF or DOCX itself is not retained
  • No card details: if you subscribe, Stripe takes the payment and keeps the card. We keep your Stripe customer and subscription ids, the subscription’s status and billing period, and the ids of the payment events Stripe sends us
  • Each sign-in session records the IP address and browser it was started from, kept with the session until you sign out or delete the account
  • A message you send through the contact form — your name, email address and the message — which reaches us by email
  • If you import a resume without an account, a random identifier in a cookie on your browser, used only to limit how often one browser can do it
  • Usage records of each AI task — which model ran, how many tokens it used, how long it took — without the text sent or returned
  • Operational logs needed to run and secure the service
  • Anonymous counts of requests for public pages, grouped by page category, referring service and browser or crawler category. These records do not include your IP address, account or visitor identifier, cookies, full web address, search terms or browser details, and do not track you across pages. They are kept for 30 days to help us understand how our public pages are discovered.
  • Anonymous page-load timing. Your browser measures how long a page took to load and sends the result to us, without cookies and without storing anything on your device. Each record has the kind of page (never the address of a page behind your sign-in), whether your device looks like a phone or a computer, and where you are: your country and, in the United States and Canada, your state or province. It does not include your IP address, city, account or visitor identifier, and it does not track you across pages. It is kept for the same 30 days and used to find places where Resume Home loads slowly.

Resumes contain sensitive information

  • A resume may include your address, phone number, education, employment history and work authorisation. Treat this section as the core of the policy, not a footnote.
  • A photo can reveal things about you, such as your appearance and likely age, that the rest of a resume does not. It is optional, it is never sent to the AI model provider, and you can remove it from a resume at any time; saved versions keep theirs, as described under Retention.

How we use it

  • To provide Resume Home: to store your profile, build and export your documents, and run the AI tasks you ask for
  • To send the emails the account needs: confirmation codes and password resets
  • To keep the service secure and to investigate abuse
  • To understand usage and cost, from records stripped of your account identifier
  • We do not sell your information, show you advertising, or use your content to train AI models.

How AI processing works

  • AI tasks are processed by Z.ai, Zhipu AI’s international platform, through its API, outside mainland China. What is sent depends on the task: the text of a resume you import, your profile facts and the job description when you tailor a resume or write a cover letter, and the text you ask to have rewritten. Your photo is never sent.
  • Z.ai does not use data sent through its API to train its models and does not keep it long-term. The AI Transparency Notice has the details.

Who else processes it

  • Your information is stored on servers we operate. A short list of providers handles parts of the service for us — AI processing, payments, email, sign-in with Google and Apple, and network security and bot checks — and the Subprocessors section below names each one, what it receives and where.
  • Some of those providers process information in the United States, and our AI provider processes it outside mainland China; there it is subject to the laws of those places.

Subprocessors

Current subprocessors

Resume Home is run on servers we operate. These providers process personal information on our behalf, each for one purpose:

  • Z.ai (Zhipu AI’s international platform, outside mainland China) — AI processing, with GLM models. Receives the text an AI task needs: a resume you import, your profile facts and job descriptions, or text to rewrite. Never your photo. Added 2026-10-01.
  • Stripe (United States) — payments, if you subscribe. Receives your email address, your billing name and address, and your payment details. Added 2026-10-01.
  • Resend (United States) — email. Receives your email address and the message: confirmation codes, password resets, and what you send through the contact form. Added 2026-10-01.
  • Cloudflare (global network) — delivery and protection of the website, and the Turnstile check on the upload and contact forms. Carries all traffic to Resume Home, including your IP address. Added 2026-10-01.
  • Google (United States) — sign-in with Google, only if you use it. Shares your email address, name and profile picture with us. Added 2026-10-01.
  • Apple (United States) — Sign in with Apple in the iOS app, only if you use it. Shares your email address with us, which may be a private relay address, and is asked to revoke your sign-in when you delete your account. Added 2026-10-03.

Notice of change

  • We add a provider to this page before it starts processing your information, with the date it was added.

Retention

  • Uploaded files are processed in memory and are not stored
  • A resume photo is kept with that resume’s design settings until you remove it or delete the account. A tailored resume or a copy made from a resume takes its own copy of the photo, removed there. Saved versions of a resume, made when it is exported or regenerated or when changes are accepted, keep the photo they had until the account is deleted. PDFs already made keep the photo they were printed with until they are deleted, 180 days after they are made (a preview, within three hours). The export queue’s record of each job does not keep it. Before you sign in, the photo stays only in your browser’s storage.
  • Confirmed Profile facts and their source text remain with the account until you delete it
  • Billing records — your Stripe customer and subscription, and the ids of the payment events about them — are kept until you delete the account, which also closes your customer record at Stripe. Stripe keeps its own records of payments as the law requires of it.
  • If you sign in with Apple, a token Apple issues for that sign-in is kept, encrypted, only so that deleting your account can ask Apple to revoke it; it is removed when the account is. It is the only token from a sign-in provider we keep.
  • Parsing a resume without an account caches the extracted result for up to 1 hour, keyed to a hash of the document text, so resubmitting the same file does not call the AI model again; it is not linked to an account and expires on its own
  • Generated PDFs are held in private object storage and deleted 180 days after they are made; a job runs hourly to do it
  • The preview the app shows while you edit is drawn on your phone and is not stored. A preview PDF the app asks for is kept in the same private storage and deleted within three hours
  • AI run records contain model, token, timing and rejection metadata, but not prompts or Resume content. They are kept for 180 days and removed in the monthly purge that follows; what remains after that is a copy with the account identifier stripped, kept for usage and cost statistics.
  • Parsing a resume without an account also records the request’s IP address, browser identifier (User-Agent) and the random identifier from its cookie, kept for 90 days to investigate abuse and removed in the monthly purge that follows. These records are linked to no account, so they cannot be deleted on request — only on schedule. The stripped statistical copy contains neither.

Cookies and similar storage

What we use

  • Only what the service needs to work. When you sign in, a session cookie keeps you signed in until you sign out or the session expires.
  • While you sign in with Google, a short-lived cookie ties the sign-in to your browser.
  • If you import a resume without an account, a cookie holds a random identifier for a year, used to limit how often one browser can do it and to investigate abuse. It says nothing about who you are.
  • Cloudflare, which carries traffic to Resume Home, may set a cookie to tell people from automated traffic, and its Turnstile check runs on the resume upload and contact forms for the same reason.
  • Your browser’s own storage holds a resume you are building before you sign in, so it is still there when you come back, and a few display preferences. It leaves your device only when you save the resume to an account, and clearing this site’s data in your browser removes it.

What we do not use

  • No analytics, advertising or tracking cookies, and no session replay. The only third-party script is Cloudflare’s Turnstile check on the two forms above. Because every cookie we use is strictly necessary, there is nothing to consent to and no banner asking you to.

Your choices

  • You can block or delete cookies in your browser. If you block the session cookie, you will not be able to stay signed in.
  • If we ever add a cookie that is not strictly necessary, we will ask for your consent first and update this page.

Security

  • Traffic is encrypted in transit, exported files are kept in private storage, and passwords are stored only as salted hashes. No system is perfectly secure; if a breach puts your information at real risk of significant harm, we will tell you and the authorities the law requires us to tell.

Your rights

  • Account → Privacy shows a count of the data currently stored
  • Account → Privacy takes a full copy of your data as one file, and deletes the account and everything in it
  • You can correct anything you entered from the app itself, and ask us at [email protected] for access to or correction of anything else we hold about you
  • If you are unhappy with how we handled your information, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or the privacy regulator where you live

Children

  • Resume Home is not for anyone under 16, and we do not knowingly collect information from them.

Changes to this policy

  • When we change this policy we update the date above. If a change affects how we use information you have already given us, we tell you by email before it takes effect.