Privacy Policy

• •Your CV is local-first. Every CV is saved in your browser, on your device.
• •Up to 3 CVs, the ones you choose, can also be kept on your account so they follow you to other devices. Nothing is uploaded unless you switch a CV to sync. Every other CV stays on your device only.
• •Anonymous usage analytics, never advertising profiles. Visits are counted in aggregate and are not connected to your CV or account identity.
• •Downloading a PDF sends your CV through our server to be rendered, and it is discarded as soon as the file is sent back.

Vercel Web Analytics counts page views and approximate unique visitors so we can understand whether the service is useful. It may report the page, referrer, country, device type, operating system and browser. The analytics record is anonymous, uses no tracking cookie, does not retain an IP address, and is not joined to a CleanCV account or CV.

When the editor is opened while signed out, CleanCV also stores a random browser ID in local storage. Only a one-way hash of that ID, first and last activity times, and a visit count are stored. It is not based on an IP address, device fingerprint, name, email, or CV content.

Signed-in account activity shown to the service owner is limited to account details already listed below, the number of synced CVs, and timestamps from sessions and sync writes. The dashboard does not expose CV content.

CleanCV is run by Muhammad Rasel. Questions, requests and complaints go to mdraselswe@gmail.com.

Everything you type into the editor — your name, contact details, photograph, employment history, every bullet — is stored by your browser on your own device, in IndexedDB. It is saved as you type and remains usable offline. Signed-out CVs are not stored in our database, so clearing browsing data can erase the only copy unless you made a backup.

If you point the app at a workspace folder, it also writes copies of your documents into that folder. That folder is on your own disk (or in whatever service you have syncing it), and the app has no access to anything outside the folder you chose.

Photographs and signatures you upload are converted to data URLs and stored the same way — in your browser, alongside the rest of the document.

Signing in does not upload anything by itself. A CV is copied to our database only after you switch it to sync to my account, and an account can keep at most 3 such CVs, each up to 200 KB including its photograph or signature. Those copies are merged across your signed-in devices; the newest saved copy wins. Stopping sync removes the server copy and leaves the CV on your device. Deleting a synced CV leaves a small marker so an old offline device cannot restore it.

A free account is required to download a PDF, and it lets you keep up to 3 CVs of your choice on the server. Writing, designs, ATS scoring, imports, backups and the document library work without an account.

When you create an account, our database holds:

• •Your name and email address, as Google reports them.
• •If you signed in with Google: the account identifier Google gives us, and the tokens Google issues for it. We ask Google for your name, email address and profile picture, and nothing else.
• •One row per active session, holding a session token, the IP address and browser user-agent it was created from, and when it expires. This is what lets you stay signed in, and what makes it possible to sign every other browser out when you reset your password.
• •Counters keyed by IP address, used to rate-limit sign-in attempts.
• •The CVs you chose to sync (at most 3), their names and timestamps, and deletion markers for CVs removed on another device.

Cloud sync, PDF export, and optional smart import send document content off your device. Sync applies only to a CV you switched on, after you sign in; the other two start only when you request them.

Downloading a PDF. The PDF is rendered by a real browser so it carries a genuine text layer rather than a picture of one, and that rendering happens on our server. Your document is sent there, laid out, turned into a PDF, and returned to you. It is held in memory for the seconds that takes and is not written to a disk or a database. If the render fails, the error is logged; the document is not.

Smart import. If you configure an AI endpoint of your own to help parse a CV you are importing, the text of that CV is forwarded to the endpoint you named, using the API key you supplied. Our server is a pass-through here: it stores nothing and logs nothing, and it exists only because a browser cannot make that request directly. What the provider you chose does with the text is governed by their policy, not ours. This feature is off unless you turn it on.

Note that an exported PDF has your CV data embedded inside it as an attachment, so that opening the file in CleanCV later restores the document exactly. That is a feature of the file you downloaded — if you send that PDF to someone, the data goes with it.

One cookie, and only once you sign in: the session cookie that keeps you signed in. It is signed, marked HttpOnly and SameSite, and served over HTTPS only.

There are no advertising cookies, analytics cookies or cross-site trackers on this site. Anonymous analytics are cookie-free. Your theme choice and a few interface preferences are kept in your browser's local storage, which is not a cookie and never leaves your device.

4 services, each doing one job:

• •Vercel hosts the site, keeps request logs, and provides anonymous aggregate Web Analytics.
• •Neon hosts the database that holds accounts, sessions and signed-in users' synced CVs.
• •Google, if and only if you choose to sign in with Google.
• •Google Gemini rewrites a bullet or summary when an account on a short invitation list presses Polish with AI. Only that text — and the job description, if you pasted one — is sent, from the server, never from the browser. It is not available to other accounts.

Vercel receives CV content briefly when rendering a PDF, and Neon stores synced CVs for signed-in users. Google Gemini receives only the text being rewritten, and only for accounts allowed to use AI polish. Google sign-in is sent no CV content. We do not sell personal data.

Account data is kept while the account exists. Ask us to delete it and everything above is removed within 30 days, sessions included. Expired sessions and used tokens are deleted as they expire, without being asked.

Server copies of CVs are removed for an account that has been inactive for 6 months, at our discretion and without a notice. The account itself, and every CV in your own browsers, are not affected, and you can switch a CV back to sync at any time.

Your CV is kept for exactly as long as you keep it, because it is on your machine. Deleting your account does not touch it.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it and the account with it. Write to mdraselswe@gmail.com from the address on the account and we will act on it.

You can also empty everything on your own side at any time: the document library has a delete for each CV, and clearing this site's browsing data removes all of it at once. Export a JSON backup first if you want to keep any of it.

This is a tool for people applying for work and is not directed at children. Do not create an account if you are under 16.

If this changes, the date at the top changes with it. A change that affects what we do with data you have already given us will be sent to the email address on your account before it takes effect.

The rules for using the service are in the Terms of Service.