Privacy policy (previous version)

SnugCV ("SnugCV", "we", "us") provides a web application at snugcv.com and a browser extension that tailor your resume and cover letter to job postings and help you track your applications (together, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have.

By creating an account or using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

SnugCV is operated by its founder as a sole proprietorship based in Texas, United States, and is the controller of the personal data described in this policy. You can reach us about anything in this policy at support@snugcv.com.

We collect the following categories of data, most of which you provide directly:

• Account data: your name, email address and a hashed password. We never store your password in readable form.
• Profile data: the resume PDF you upload and the structured profile we build from it (contact details, social links, work history, education, skills, languages, certificates, summary), plus any edits you make.
• Job data: job descriptions you paste or capture with the browser extension, including the posting title, company, URL, location, job type and salary where present, and your application status and notes in the Job Tracker.
• Generated documents: the tailored resumes and cover letters we create for you, including matched keywords and the explanations of each change.
• Saved application answers: questions from job application forms and your answers to them, only when you choose to save them in the browser extension (see "Autofill and saved application answers" below). Answers to voluntary demographic questions are kept only with your explicit consent.
• Preferences: resume language, tone, font, template, section order, theme and similar settings.
• Billing data: your subscription status, plan and credit balance. Payments are processed by Stripe. We receive a customer identifier and the last four digits of your card; we never see or store your full card number.
• Technical data: IP address, browser type, device information, pages visited, timestamps and error logs, collected automatically through server logs and strictly necessary cookies.
• Communications: messages you send us, for example support requests.

We do not ask for special categories of data (such as health, religion, racial or ethnic origin or political opinions). The one exception is answers to voluntary demographic questions on application forms, which we keep only with your explicit consent, as described below. Please do not include such information in your resume. We do not knowingly collect data from anyone under 18.

We use your data for the following purposes:

• To provide the Service: build your profile from your resume, tailor documents to job postings, render PDFs, keep your document history and Job Tracker, and run the browser extension (performance of our contract with you).
• To fill in job application forms for you with your profile and the answers you chose to save (performance of our contract with you; for answers to voluntary demographic questions, your explicit consent).
• To run your account: sign-in, sessions, credits, subscriptions and invoices (performance of our contract; legal obligations for tax and accounting).
• To keep the Service secure and reliable: rate limiting, fraud and abuse prevention, debugging and monitoring (our legitimate interests).
• To improve the Service: understanding which features are used and where they fail, using aggregated or de-identified data where possible (our legitimate interests).
• To communicate with you: transactional emails such as sign-in or billing notices, replies to your requests, and important changes to the Service or this policy (contract and legitimate interests).
• With your consent, where we ask for it: for example if you turn on the recruiter opt-in in Settings, or for any marketing emails, which you can withdraw at any time.

We do not use your data to build advertising profiles and we do not sell it.

Tailoring is performed with large language models provided by Anthropic. When you generate a document, we send the relevant parts of your profile and the job description to Anthropic's API and receive the tailored text back. Anthropic processes this data on our behalf under its commercial terms and does not use API inputs or outputs to train its models.

Generated documents are drafts based on the information you provided. They may contain mistakes. Always review them before sending them to an employer.

Autofill and saved application answers do not use AI. They are never sent to Anthropic or any other AI provider.

The blog and the free tools at snugcv.com/tools can be used without an account. This is what they collect and why:

• Reading and searching the blog: we keep the name of the guide you read last in a first-party cookie for 30 days. If you later create an account, we copy that name onto it once, so we can see which guides lead people to sign up. Reading events (how far down a guide you scrolled, which questions you opened, which templates you copied) go to our analytics services with the guide's name and nothing you typed. Searching sends what you type to our server so it can find matching guides. We do not store search terms or link them to you. Our hosting provider may keep standard request logs, which can include the address of the search request.
• "Was this guide helpful?": if you answer, we store your answer, your optional comment and a salted one-way hash of your IP address and the guide, which limits repeat answers. We do not store the address itself. Please do not put personal details in the comment.
• Free tools (job posting keyword finder and ATS resume checker): we count each run so the free allowance can be enforced. The count is stored with a salted hash of your IP address, never the address itself, and a random identifier in a first-party cookie (snugcv_tool, one year). If you are signed in, it is also linked to your account. A job posting you paste is sent to our AI provider to be read and is not stored by SnugCV. A resume PDF you upload is read in memory while the check runs and discarded; it is never written to disk or storage, and neither it nor the posting is logged. The run counters are kept for as long as the free allowance needs them and hold nothing else about you.
• Guide emails: if you join the blog email list, we collect your email address, the page you were on when you signed up, and the times you confirmed and, if you do, unsubscribed. To limit how often one connection can submit the form we keep a salted, one-way hash of your IP address for up to one day; it is not linked to your email address. We use this to send a confirmation email, a checklist PDF once you confirm, and a short email about new guides at most once a week. We send nothing until you confirm, so nobody can add you by typing your address. Joining does not create a SnugCV account. We keep your address until you unsubscribe. After that we keep only the address and the fact that you unsubscribed, so we never email it again by mistake. Write to support@snugcv.com and we will delete that record too. Emails are delivered by Resend, which receives your address and the message.
• Checklists, calculators and your answers: ticked checklist items and your answer to the helpful question are remembered in your browser's local storage on this device only. The notice date calculator and the resume word counter run in your browser and send nothing to us.

The SnugCV browser extension connects to your account with a private access token stored on your device. Your password is never entered into the extension. You can revoke any device from Settings → Browser extension.

The extension runs on the websites you visit so that it can recognise job postings and job application forms, including application forms embedded inside another page. This check happens entirely in your browser. The extension does not send the contents of the pages you visit to SnugCV, does not collect your browsing history, and does nothing on pages that are not job postings or application forms.

The SnugCV panel appears beside job postings on the job sites in our list (such as LinkedIn Jobs, Indeed, Glassdoor, Greenhouse, Lever and Workday), on pages with a job application form, and on any page where you click the extension icon. While the panel is shown on a job page, the extension sends that page's address to SnugCV to find the documents and Job Tracker entry you already have for that job. When you tailor a document or add a job to your Job Tracker, it also sends the posting's title, company and description, which are then stored with your account.

The list of job sites and the rules the extension uses to recognise application forms are downloaded from snugcv.com. That download contains no personal data, and nothing about you is sent with it.

Autofill (a Pro feature) fills in a job application form when you click "Autofill application" in the SnugCV panel. It uses the details in your SnugCV profile and any answers you saved earlier, and it can attach the resume and cover letter you tailored for that job. The form is filled in your browser. Autofill never submits an application: you review the form and submit it yourself.

Your answers on application forms are saved to your SnugCV account in only two cases:

• You click "Save my answers now" in the SnugCV panel.
• You have ticked "Save my answers automatically when I submit an application" in the SnugCV panel. This box is unticked until you tick it, and you can untick it at any time.

If you do neither, nothing you type or choose on an application form is sent to SnugCV or stored by us.

When you save, we keep each question as the form worded it, together with your answer: for example a dropdown choice, a yes-or-no answer or a short text answer. We never save long written answers (such as "Why do you want to work here?"), uploaded files, agreement or consent boxes, or anything that looks like a password, government ID, tax ID or payment card number. Details already in your profile, such as your name and email address, are not copied; your profile stays the one place they are kept.

Some application forms ask voluntary demographic questions, such as gender, race or ethnicity, veteran status or disability. These can be special categories of personal data. We save your answers to them only if you also tick "Include my answers to voluntary demographic questions", which is unticked until you tick it. Without that tick these answers are left out, even when you save your other answers; our servers check for them independently of the extension. If you tick it, we process these answers on the basis of your explicit consent, only to fill in the same questions on your later applications. We do not use them to tailor documents, do not send them to our AI provider, do not share them with recruiters or employers, and do not use them for any other purpose. You can withdraw your consent by unticking the box and deleting those answers.

Saved answers are listed in Settings → Saved application answers, where you can delete one or all of them at any time. They are also deleted when you delete your account.

When you submit an application form on a page where the extension is active, the extension marks that job as Applied in your Job Tracker, adding it if needed with the page's address and the job title. This happens whether or not you save your answers. You can change or delete the entry in the Job Tracker.

We use a small number of cookies and browser storage entries, all of which are necessary to run the Service:

• A session cookie that keeps you signed in.
• Local storage entries for your theme and sidebar preferences, and on the blog for ticked checklist items and your answer to the helpful question, on this device.
• Stripe may set cookies during checkout for fraud prevention.
• On the blog: a cookie naming the guide you read last (30 days, used to see which guides lead to signups) and, if you use a free tool, a cookie holding a random identifier that counts your runs (one year).

We use two analytics services to understand how the Service is used: Vercel Web Analytics, which is cookieless and does not identify you, and Google Analytics 4, which sets first-party cookies to distinguish visits and sessions. We configure Google Analytics with Google signals and ad personalisation turned off, and we do not use advertising cookies or third-party tracking pixels. You can block analytics cookies in your browser without affecting the Service.

We do not sell or rent your personal data. We share it only with service providers that process it on our behalf, under contracts that restrict them to our instructions:

• Anthropic (AI generation of tailored documents).
• Vercel (hosting, serverless functions, file storage for uploaded resumes, and Web Analytics).
• Google Analytics (usage statistics; first-party cookies; ad personalisation disabled).
• Neon (managed PostgreSQL database).
• Stripe (payments and subscription management).
• Email delivery providers for transactional messages.

We may also disclose data when required by law, to protect the rights, safety or property of SnugCV or others, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.

If you turn on the recruiter opt-in in Settings, you consent to us sharing your profile with recruiters. This is off by default.

SnugCV is operated from the United States and our providers store and process data primarily in the United States. If you use the Service from outside the United States, your data will be transferred there. Where a provider processes data of EEA, UK or Swiss residents in a country without an adequacy decision, we rely on Standard Contractual Clauses or equivalent safeguards.

We keep your account, profile, jobs, documents and saved application answers for as long as your account is active so you can return to them. If you delete an item, it is removed from our production database promptly and from backups within 30 days.

If you delete your account, we delete your personal data within 30 days, except where we must keep it longer for legal, tax or accounting reasons (for example invoices), or to resolve disputes. Server logs are kept for up to 90 days.

Depending on where you live (including under the GDPR, UK GDPR and US state privacy laws such as the CCPA), you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data. Most profile data can be edited directly in the dashboard.
• Delete your data. You can delete profile sections, documents, uploads and jobs yourself, and delete your whole account in Settings → Delete account (or ask us to).
• Restrict or object to certain processing, and withdraw consent where processing is based on consent.
• Receive your data in a portable format.
• Not be discriminated against for exercising these rights.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@snugcv.com from the address on your account. We will respond within 30 days (or sooner where the law requires). We may ask you to verify your identity first.

We do not sell personal data or share it for cross-context behavioral advertising, so there is no need to opt out of those activities.

We protect your data with encryption in transit (TLS) and at rest, hashed passwords, per-device revocable extension tokens, access controls and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and tell us right away if you suspect unauthorized access to your account.

The Service is intended for people who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

We may update this policy as the Service or the law changes. We will post the new version here with a new effective date and, for significant changes, notify you by email or in the app before they take effect. Continued use after the effective date means you accept the updated policy.

Questions, requests or concerns about this policy or your data: support@snugcv.com.