Transmission and processing
The site and its API use HTTPS. Previews and exports are produced in your browser. Only an explicit save while signed in sends the résumé to the server. The service and its host can then process its content; this is not end-to-end encryption.
Access to résumés
Each saved résumé is linked to the account that created it. The database permission rules allow only the owner to read and delete a résumé, and every creation or update goes through a server function that checks the identity of the session and validates the content it receives.
Résumés cannot be reached at a public address, and the service offers no sharing link.
Sign-in
Sign-in uses a one-time code sent by email, valid for fifteen minutes, together with a verification phrase shown in the browser. No password is stored. Code requests and attempts are rate-limited by the platform.
An email informs you of every new sign-in to your account, with the device, the IP address and the country of the connection.
From your account, you can add an authenticator app as a second factor. Its 6-digit code is then requested after the email code; recovery codes, shown once, let you sign in if you lose the app.
Sign out on a shared device.
Retention and backups
Saved résumés are kept for as long as the account exists. The database is backed up every day, with seven days of retention, in the same hosting region. Deletion requests are described in the privacy policy.
Processing protections
The server function rejects any content that does not match the expected format: structure, known languages and templates, field length, number of entries and total size. Internal identifiers are restricted to a safe character set and the content is escaped before display, which protects the preview and the exports against code injection.
Each account is limited to 50 résumés. Error messages do not copy the content of résumés.
Choosing what you save
You can edit and export without an account: the résumé stays on your device. Before choosing to save it online, check that its information can be entrusted to a hosted service. This page is not a security or compliance certification.
The location of the storage is not, on its own, enough to rule out any access from abroad. See the information on hosting and transfers.
Reporting a problem
In the event of abnormal access, exposed data or a suspected vulnerability, use the security contact page. Describe the problem with an example without real data and limit your checks to your own data.