Privacy policy

SnugCV ("SnugCV", "we", "us") provides a web application at snugcv.com and a browser extension that tailor your resume and cover letter to job postings and help you track your applications (together, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have.

By creating an account or using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

SnugCV is operated by its founder as a sole proprietorship based in Texas, United States, and is the controller of the personal data described in this policy. You can reach us about anything in this policy at support@snugcv.com.

We collect the following categories of data, most of which you provide directly:

• Account data: your name, email address and a hashed password. We never store your password in readable form.
• Profile data: the resume PDF you upload and the structured profile we build from it (contact details, social links, work history, education, skills, languages, certificates, summary), plus any edits you make.
• Job data: job descriptions you paste or capture with the browser extension, including the posting title, company, URL, location, job type and salary where present, and your application status and notes in the Job Tracker.
• Generated documents: the tailored resumes and cover letters we create for you, including matched keywords and the explanations of each change.
• Saved application answers: questions from job application forms and your answers to them, only when you choose to save them in the browser extension (see "Autofill and saved application answers" below) or answer a question for auto-apply (see "Auto-apply" below). Answers to voluntary demographic questions are kept only with your explicit consent.
• Auto-apply data: the job preferences you set for auto-apply (titles, locations, companies to skip), the postings SnugCV matches for you, the postings and application forms it reads for you (the posting's text, the form's questions and the answers prepared for them), what the extension saw on each attempt to submit (such as the page's address, part of its text and the site's messages, but not the answers in the form's fields), what happened when an application was submitted (the confirmation page's address and a short piece of its text), and the public job boards you ask us to watch. See "Auto-apply" below.
• Preferences: resume language, tone, font, template, section order, theme and similar settings.
• Billing data: your subscription status, plan and credit balance. Payments are processed by Stripe. We receive a customer identifier and the last four digits of your card; we never see or store your full card number.
• Technical data: IP address, browser type, device information, pages visited, timestamps and error logs, collected automatically through server logs and strictly necessary cookies.
• Communications: messages you send us, for example support requests.

We do not ask for special categories of data (such as health, religion, racial or ethnic origin or political opinions). The one exception is answers to voluntary demographic questions on application forms, which we keep only with your explicit consent, as described below. Please do not include such information in your resume. We do not knowingly collect data from anyone under 18.

We use your data for the following purposes:

• To provide the Service: build your profile from your resume, tailor documents to job postings, render PDFs, keep your document history and Job Tracker, and run the browser extension (performance of our contract with you).
• To fill in job application forms for you with your profile and the answers you chose to save, and with auto-apply to prepare and submit the applications you approve (performance of our contract with you; for answers to voluntary demographic questions, your explicit consent).
• To run your account: sign-in, sessions, credits, subscriptions and invoices (performance of our contract; legal obligations for tax and accounting).
• To keep the Service secure and reliable: rate limiting, fraud and abuse prevention, debugging and monitoring (our legitimate interests).
• To improve the Service: understanding which features are used and where they fail, using aggregated or de-identified data where possible (our legitimate interests).
• To communicate with you: transactional emails such as sign-in or billing notices, replies to your requests, and important changes to the Service or this policy (contract and legitimate interests).
• With your consent, where we ask for it: for example if you turn on the recruiter opt-in in Settings, or for any marketing emails, which you can withdraw at any time.

We do not sell your data. Its only advertising use is measuring our own ads on Instagram and Facebook, as described under "Cookies and local storage": nothing from inside the app (your resume, profile, jobs, documents or answers) is ever used for advertising.

Tailoring is performed with large language models provided by Anthropic. When you generate a document, we send the relevant parts of your profile and the job description to Anthropic's API and receive the tailored text back. Anthropic processes this data on our behalf under its commercial terms and does not use API inputs or outputs to train its models.

Generated documents are drafts based on the information you provided. They may contain mistakes. Always review them before you send them to an employer yourself. With auto-apply, you accept them when you approve the application, including a document finished after you approve (see "Auto-apply").

Autofill and saved application answers do not use AI, and are not sent to Anthropic or any other AI provider, unless you turn on AI answers for auto-apply (see "Auto-apply").

The blog and the free tools at snugcv.com/tools can be used without an account. This is what they collect and why:

• Reading and searching the blog: we keep the name of the guide you read last in a first-party cookie for 30 days. If you later create an account, we copy that name onto it once, so we can see which guides lead people to sign up. Reading events (how far down a guide you scrolled, which questions you opened, which templates you copied) go to our analytics services with the guide's name and nothing you typed. Searching sends what you type to our server so it can find matching guides. We do not store search terms or link them to you. Our hosting provider may keep standard request logs, which can include the address of the search request.
• "Was this guide helpful?": if you answer, we store your answer, your optional comment and a salted one-way hash of your IP address and the guide, which limits repeat answers. We do not store the address itself. Please do not put personal details in the comment.
• Free tools (job posting keyword finder and ATS resume checker): we count each run so the free allowance can be enforced. The count is stored with a salted hash of your IP address, never the address itself, and a random identifier in a first-party cookie (snugcv_tool, one year). If you are signed in, it is also linked to your account. A job posting you paste is sent to our AI provider to be read and is not stored by SnugCV. A resume PDF you upload is read in memory while the check runs and discarded; it is never written to disk or storage, and neither it nor the posting is logged. The run counters are kept for as long as the free allowance needs them and hold nothing else about you.
• Guide emails: if you join the blog email list, we collect your email address, the page you were on when you signed up, and the times you confirmed and, if you do, unsubscribed. To limit how often one connection can submit the form we keep a salted, one-way hash of your IP address for up to one day; it is not linked to your email address. We use this to send a confirmation email, a checklist PDF once you confirm, and a short email about new guides at most once a week. We send nothing until you confirm, so nobody can add you by typing your address. Joining does not create a SnugCV account. We keep your address until you unsubscribe. After that we keep only the address and the fact that you unsubscribed, so we never email it again by mistake. Write to ${CONTACT} and we will delete that record too. Emails are delivered by Resend, which receives your address and the message.
• Promo emails: if a promo code you brought can't be used (used up or ended) and you ask to hear about the next promo, we keep your email address, the code, where that code was posted, which page you asked from, and the source and campaign of your first visit (from the traffic-source cookie). We use it only to email you about a future promo, and every such email has a way to unsubscribe. Write to support@snugcv.com and we will delete it.
• Checklists, calculators and your answers: ticked checklist items and your answer to the helpful question are remembered in your browser's local storage on this device only. The notice date calculator and the resume word counter run in your browser and send nothing to us.

The SnugCV browser extension connects to your account with a private access token stored on your device. Your password is never entered into the extension. You can revoke any device from Settings → Browser extension.

The extension runs on the websites you visit so that it can recognise job postings and job application forms, including application forms embedded inside another page. This check happens entirely in your browser, and the extension does nothing on pages that are not job postings or application forms. It does not collect your browsing history or send SnugCV the contents of the pages you visit, except in these cases:

• A job page with the SnugCV panel open on it, and a posting you tailor a document for or add to your Job Tracker, as described in the next paragraph.
• An application form you submit. The extension sends the page's address and the job title, and the company and job description when the page shows them, so the job is marked as Applied in your Job Tracker, with the date (see "Autofill and saved application answers").
• Answers you choose to save from an application form: the form's questions and your answers to them (see "Autofill and saved application answers").
• Auto-apply. The extension sends SnugCV parts of each page it opens for your applications, and of a form it leaves open in the SnugCV window for you to finish (see "Auto-apply").

The SnugCV panel appears beside job postings on the job sites in our list (such as LinkedIn Jobs, Indeed, Glassdoor, Greenhouse, Lever and Workday), on pages with a job application form, and on any page where you click the extension icon. While the panel is shown on a job page, the extension sends that page's address to SnugCV to find the documents and Job Tracker entry you already have for that job. When you tailor a document or add a job to your Job Tracker, it also sends the posting's title, company and description, which are then stored with your account.

The list of job sites and the rules the extension uses to recognise application forms are downloaded from snugcv.com. That download contains no personal data, and nothing about you is sent with it.

Autofill (a Pro feature) fills in a job application form when you click "Autofill application" in the SnugCV panel. It uses the details in your SnugCV profile and any answers you saved earlier, and it can attach the resume and cover letter you tailored for that job. The form is filled in your browser. Autofill never submits an application: you review the form and submit it yourself. From version 0.3.0 of the extension, Autofill also leaves an e-signature empty for you to sign.

Your answers on application forms are saved to your SnugCV account in only two cases:

• You click "Save my answers now" in the SnugCV panel.
• You have ticked "Save my answers automatically when I submit an application" in the SnugCV panel. This box is unticked until you tick it, and you can untick it at any time.

If you do neither, nothing you type or choose on an application form is sent to SnugCV or stored by us.

When you save from the extension, we keep each question as the form worded it, together with your answer: for example a dropdown choice, a yes-or-no answer or a short text answer. We never save long written answers (such as "Why do you want to work here?"), uploaded files, or anything that looks like a password, an ID number (such as a passport, driver's licence, government or tax ID), or a payment card or bank account number. From version 0.3.0 of the extension, a required agreement box you ticked is saved as "Yes", so a box with the same words is ticked for you on later forms. Details already in your profile, such as your name and email address, are not copied; your profile stays the one place they are kept.

Some application forms ask voluntary demographic questions, such as gender, race or ethnicity, veteran status or disability. These can be special categories of personal data. We save your answers to them only if you also tick "Include my answers to voluntary demographic questions" in the extension, or "Remember my answers to voluntary questions" on the auto-apply page or in Settings, which are unticked until you tick them. Without that tick these answers are left out, even when you save your other answers; our servers check for them independently of the extension, and turning remembering off in Settings stops them being saved from the extension too. If you tick it, we process these answers on the basis of your explicit consent, only to fill in the same questions on your later applications, including ones that word the question differently; only answers saved after you turned remembering on are used. We do not use them to tailor documents, do not send them to our AI provider, do not share them with recruiters or employers, and do not use them for any other purpose. You can withdraw your consent by unticking the box and deleting those answers, which Settings lets you do in one step; turning remembering off also takes them off applications you haven't sent yet.

Saved answers are listed in Settings → Saved application answers, where you can delete one or all of them at any time. They are also deleted when you delete your account.

When you submit an application form on a page where the extension is active, the extension marks that job as Applied in your Job Tracker, with the date. If the job isn't in your Job Tracker yet, it is added with the page's address and the job title, and the company and job description when the page shows them. This happens whether or not you save your answers. You can change or delete the entry in the Job Tracker.

Auto-apply (part of a paid plan) submits job applications for you, with your approval, in your own browser. Here is exactly what it does with your data:

• Matching: we poll the public job feeds of company job boards (Greenhouse, Lever, Ashby, Workable, SmartRecruiters, BambooHR, Paylocity and Workday) and keep the postings that fit the preferences you set. These feeds are public and need no account. The postings we keep are company job data, not personal data about you.
• Preparing: for the postings you keep, the browser extension opens each posting and its application form in your browser and sends SnugCV the posting's title, company and text, and the form's questions (each with its choices and whether it is required). Nothing is typed at that point. We work out the answers from your SnugCV profile and your saved application answers. They are listed on the application, where you can check them before you approve it. A required question we cannot answer is shown to you; we never guess. An optional question we cannot answer is not shown and is left blank, unless a saved answer fits it when the form is sent (see "Submitting"). An answer you gave to the same question in other words ("Gender" and "What is your gender identity?") is reused only when it means the same as one of the form's own options, and such answers are shown to you with the question you originally answered before you approve. This matching follows fixed rules on our servers and does not use AI, unless you turn on AI answers (below). Voluntary demographic questions are never answered from your profile, only from an answer you saved with your explicit consent.
• AI answers (on only if you choose it: the auto-apply setup offers it with its box already ticked, and you can also turn it on in Settings or on an application waiting for your answers; you can turn it off in Settings at any time): for the questions your profile and saved answers cannot answer, we send your profile, the posting, the form's questions and your saved application answers to Anthropic's Claude, which answers only what those support and leaves the rest to you. Answers to voluntary demographic questions are never sent. To find your answer on a form that words those questions differently, and to tell what a required box agrees to, we send only the form's words for them to Claude, nothing about you, and our own code then uses your saved answer or the agreement you let SnugCV give. Work authorization and visa sponsorship are never answered by AI. With "On, I check them", each AI answer is marked and you look at it before you approve the application. With "On, automatic", AI answers are used without that separate look: they appear with an "AI" label among the application's answers, and you still approve each application. AI answers are not added to your saved application answers, unless you later save the answers on a form left open for you (see "Forms left for you to finish"). You can turn it off at any time; answers already given stay on those applications until you change them. Separately, when you press Suggest on a question, we send your profile and the posting to Claude to draft an answer for you to edit (with AI answers on, also the other answers on that application).
• Tailoring: we create a tailored resume (and a cover letter where the form takes one) for each prepared application, through Anthropic's Claude as described under "AI processing". The first three auto-apply applications of an account are tailored straight away, and the rest through Anthropic's batch processing, which can take longer. The same data is sent either way, as for any tailored resume: your profile and the posting.
• Submitting: only after you press "Apply" for the applications you approved. The extension fills each form with the answers prepared for it, attaches the documents, and submits it. It is also given your profile details and your saved application answers. It uses them for any question on the form that the application's answers don't cover, when the question asks for a profile detail or matches a question you saved an answer to. That can be a follow-up that appears after you pick an option, a question on a later step of the form, or an optional question that had no answer when the form was read. You don't see these answers before the form is sent. An optional question you chose to leave blank on the application stays blank, whatever your profile or saved answers hold. Answers to voluntary demographic questions are among the saved answers given only if you have asked us to remember those. If the site confirms the application, the job is added to your Job Tracker as Applied. If we cannot confirm it, we tell you to check on the site.
• E-signatures and forms left for you to finish: when a form asks you to sign by typing your name, the extension types your name from your SnugCV profile, and the date where the form asks for it, as you would, and submits the form when you have pressed "Apply". If a form asks for a signature it cannot type, such as your initials, the extension fills in the rest and leaves the form open in the SnugCV window for you to sign and submit. It also leaves the filled form open when the site refuses the automatic submit, and when the form shows a box asking for your agreement that you haven't ticked on the application. The extension then checks that tab every few seconds, for up to 40 minutes. When the site confirms the application, or refuses a submit you made there, it sends SnugCV what it sees on the page, masked like the record of each attempt (see the next point), so the application shows what happened. When the check ends, the tab is like any other. So is a form left open for another reason, such as an application you took back during the run or one where SnugCV couldn't tell whether it was sent, once the run ends. If you submit such a form, the job is marked Applied, and if you save your answers there from the extension, or have them saved when you submit, its answers are saved as from any other form, AI answers included (see "Autofill and saved application answers").
• What the extension sends about each attempt: so we can tell you why an application didn't go through, and fix the cause, the extension sends SnugCV what it saw on each attempt to submit: the page's address and title (and the addresses of any frames inside it), whether the page loaded, signs of a sign-in page or a captcha, the page's main heading and up to 2,000 characters of its text outside the application form, the site's own messages (such as an error or a note that the job is closed), the labels of its apply buttons, each question's label with whether it was filled and whether it was required, the choices a question offered when your saved answer wasn't one of them (for a search box, whose suggestions follow what was typed, only their pattern of words and numbers, such as "Aa, AA"), whether your documents uploaded, any error the extension ran into, and the extension's version. It never sends the answers in the form's fields. Where the page's text repeats your name, email address, phone number or one of your answers as you gave it, the extension replaces it before sending, and our server does the same again, for short answers such as "Yes" too, before the record is stored. When we store a page's address, we keep only a job's id from its query. We keep these records for 90 days and delete them with your account. To find and fix the cause of a problem many attempts run into, SnugCV may have Anthropic's Claude read these masked records, without your name or email, together with the public job posting they were made on. Screenshots of an attempt are taken only on SnugCV's own staff accounts, never on yours.
• Answers you type on an application, to a question we could not answer or in place of an answer we filled in, are saved to your saved application answers, so the next form with the same question is answered without asking, and your other prepared applications waiting on that question are answered too. Unlike saving from the extension, this keeps a long written answer too. An answer to a question that asks for a password, an ID number, or a payment card or bank account number is never saved: it is used on that one application only, is never sent to the AI, and is removed from the application once it is sent. An answer to a demographic question is saved only if you have asked us to remember those. Leaving an optional question blank changes nothing in your saved answers. You can delete any saved answer in Settings.

You can remove any matched posting, stop a run at any time from the panel or the page, and turn matching off in your preferences. The employer receives your application exactly as it would if you had submitted the form yourself; we do not add anything to it and we do not tell the employer that SnugCV was used.

We use a small number of cookies and browser storage entries to run the Service:

• A session cookie that keeps you signed in.
• Local storage entries for your theme and sidebar preferences, and on the blog for ticked checklist items and your answer to the helpful question, on this device.
• Stripe may set cookies during checkout for fraud prevention.
• On the blog: a cookie naming the guide you read last (30 days, used to see which guides lead to signups) and, if you use a free tool, a cookie holding a random identifier that counts your runs (one year).
• If you visit from the European Economic Area, the United Kingdom or Switzerland: a cookie that keeps the Meta Pixel (below) from loading, until you close your browser.
• If you arrive from a Google ad: a cookie holding the click id Google added to the ad's link (90 days), used to tell Google Ads whether that click led to a sign-up or a payment (below).

We use two analytics services to understand how the Service is used: Vercel Web Analytics, which is cookieless and does not identify you, and Google Analytics 4, which sets first-party cookies to distinguish visits and sessions. We configure Google Analytics with Google signals and ad personalisation turned off. You can block analytics cookies in your browser without affecting the Service.

Advertising measurement (Meta Pixel): we advertise SnugCV on Instagram and Facebook. To see which ads bring people to SnugCV, and to show them to people likely to sign up, our public pages (home, pricing, blog, free tools, affiliate program, sign-up and sign-in) load the Meta Pixel for visitors who are not signed in. It sets Meta cookies (_fbp, and _fbc when you arrive from a Meta ad) and tells Meta which of those pages you viewed, with your IP address and browser details. If you then create an account, our server tells Meta that a sign-up happened (when you confirm your email address, or straight away if you sign up with Google), with your email address and account ID each hashed (turned into a code that can be matched but not read back), your IP address and browser type, and those cookies, so Meta can match it to the ad you saw. Meta handles this data under its own terms and may use it to improve its ads. The pixel never runs inside the app, and we never send Meta your resume, profile, jobs, documents, answers or anything else you do in SnugCV.

The pixel does not load, and no sign-up is sent to Meta, when you visit from the European Economic Area, the United Kingdom or Switzerland, or when your browser sends a Global Privacy Control signal. You can also block it with your browser's tracking protection or an ad blocker, and manage how Meta uses data about you in your Meta ad settings.

Advertising measurement (Google Ads): we also advertise SnugCV in Google search results. Google adds a click id to the ad's link; we keep it in the cookie above and, if you create an account, on your account. For 90 days after that click, our server reports to Google Ads that the click led to a sign-up (once your email address is confirmed) and to each payment for a plan or credit pack, with its amount before tax. Google receives only the click id, which of those happened, when, the amount, and a reference number for that sign-up or payment so it isn't counted twice: never your email address, name, resume or anything else you do in SnugCV. We don't load any Google advertising script on our pages. Google handles this data under its own terms. None of this happens when you visit from the European Economic Area, the United Kingdom or Switzerland, or when your browser sends a Global Privacy Control signal; if you turn Global Privacy Control on after signing up, we stop reporting your payments the next time you use SnugCV.

We do not sell or rent your personal data. We share it with service providers that process it on our behalf, under contracts that restrict them to our instructions, and with Meta and Google to measure our ads:

• Anthropic (AI generation of tailored documents, and of answers to application questions when you ask for them).
• Vercel (hosting, serverless functions, file storage for uploaded resumes, and Web Analytics).
• Google Analytics (usage statistics; first-party cookies; ad personalisation disabled).
• Meta (advertising measurement on our public pages; see "Cookies and local storage"). Unlike the providers above, Meta also uses this data under its own terms.
• Google Ads (advertising measurement: the sign-ups and payments that follow a Google ad click; see "Cookies and local storage"). Google also uses this data under its own terms.
• Neon (managed PostgreSQL database).
• Sentry (error monitoring: when SnugCV itself fails, the error and where it happened, with your details removed).
• Stripe (payments and subscription management).
• Email delivery providers for transactional messages.

We may also disclose data when required by law, to protect the rights, safety or property of SnugCV or others, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.

If you turn on the recruiter opt-in in Settings, you consent to us sharing your profile with recruiters. This is off by default.

SnugCV is operated from the United States and our providers store and process data primarily in the United States. If you use the Service from outside the United States, your data will be transferred there. Where a provider processes data of EEA, UK or Swiss residents in a country without an adequacy decision, we rely on Standard Contractual Clauses or equivalent safeguards.

We keep your account, profile, jobs, documents and saved application answers for as long as your account is active so you can return to them. If you delete an item, it is removed from our production database promptly and from backups within 30 days. Removing an application on the auto-apply page takes it off the page, but we keep it, with its posting, the form's questions and the answers on it, until you delete your account, so the same posting isn't matched for you again.

If you delete your account, we delete your personal data within 30 days, except where we must keep it longer for legal, tax or accounting reasons (for example invoices), or to resolve disputes. Server logs are kept for up to 90 days. We keep a record of each email we send you (the address, subject, which email it was and whether it was delivered, never its content) for 90 days, and delete it with your account. Auto-apply's records of each application attempt are deleted after 90 days. If you used a promo code, we keep a record that it was used, with a keyed one-way hash of your email address (with any "+" part, and for Gmail any dots, taken off) and of the IP address it was used from, also after you delete your account, so the same person can't use a code twice. A hash can't be turned back into the address.

Depending on where you live (including under the GDPR, UK GDPR and US state privacy laws such as the CCPA), you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data. Most profile data can be edited directly in the dashboard.
• Delete your data. You can delete profile sections, documents, uploads and jobs yourself, and delete your whole account in Settings → Delete account (or ask us to).
• Restrict or object to certain processing, and withdraw consent where processing is based on consent.
• Receive your data in a portable format.
• Not be discriminated against for exercising these rights.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@snugcv.com from the address on your account. We will respond within 30 days (or sooner where the law requires). We may ask you to verify your identity first.

We do not sell personal data. The Meta Pixel, the sign-up we tell Meta about, and the sign-ups and payments we report to Google Ads (see "Cookies and local storage") may count as sharing personal data for cross-context behavioral advertising under some US state laws. To opt out, turn on Global Privacy Control in your browser, which we honor automatically, or block the pixel as described there. After you sign up, we send Meta nothing more about you while you are signed in, and Google Ads only your payments in the 90 days after the ad click.

We protect your data with encryption in transit (TLS) and at rest, hashed passwords, per-device revocable extension tokens, access controls and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and tell us right away if you suspect unauthorized access to your account.

The Service is intended for people who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

We may update this policy as the Service or the law changes. We post the new version here with its effective date at the top of this page. Changes take effect on that date, which is the day we post them unless we choose a later one. For significant changes we also tell you by email or in the app. If you keep using the Service after a change takes effect, the updated policy applies to you.

Questions, requests or concerns about this policy or your data: support@snugcv.com.