Privacy policy

We collect the following because you type it, upload it, or ask us to fetch it.

• Account. Your email address and a password. Supabase stores the password as a hash. We do not see the password itself.
• Resume. The file you upload (PDF, Word, or plain text, up to 5 MB) and the text and fields read from it. You can correct those fields. We save the resume on your account.
• Jobs. The title, company, and description you paste. If you give us a LinkedIn job link, our server requests that public page and reads the title, company, and description. The “Send to Reframe” bookmarklet reads the title, company, and description on the job page open in your browser, or text you have selected, and opens Reframe with those fields filled in. We store the text you save, not a separate copy of the link.
• Work from that resume. The tailored resume, the edits you accept or reject, cover letters, gap bullets, the template you pick, the application status you set, and the keyword match we show you.
• Billing. If you subscribe, we sell the plan and Stripe collects payment as the payment processor. We store your plan, billing period, status, and Stripe customer and subscription ids. We do not store your card number. Stripe keeps the card, tax, invoices, and receipts.

A resume can include work history and other details you might consider sensitive. Do not include information you do not want stored and sent to OpenAI for the features below.

• Sign-in cookie. A necessary cookie, and extra cookies with the same purpose when the session is large, so you stay signed in. This does not depend on the analytics choice.
• Analytics, only if you allow them. PostHog records page views and actions such as starting or finishing sign-up, uploading a resume, starting checkout, opening billing, adding a job, finishing a tailor, writing a cover letter, adding or saving a skill, accepting or keeping a change, and downloading. An event can include a count, a plan name, a billing period, whether an upload succeeded, a file format, or a template name. It does not include your resume, job text, cover letter, or email. After you sign in, we tie events to your account id so Delete my data can remove that analytics person. Session recording is off. Automatic click capture is off.
• Where you came from. On your first visit we remember, in session storage on your device, the UTM tags in the address (source, medium, and campaign, each cut off at 100 characters) and the host name of the site that referred you. We do not keep the full referring address. We send that source to PostHog only if you allow analytics.
• Company logos. When logos are turned on, the company name on a job is sent from your browser to Logo.dev to fetch a logo. When they are not, we show the company’s first letter and do not call Logo.dev.

Our providers may see your IP address and browser type while they host the site, sign you in, process a payment, or, if you allow it, record analytics.

We use information to:

• Create your account and keep you signed in.
• Store your resume and jobs, tailor a resume, write a cover letter, and write a gap bullet.
• Count the tailored jobs in the current period and apply the plan you chose.
• Record the token counts OpenAI reports for each call.
• Take payment and open the billing portal, through Stripe.
• Send account email through Supabase, such as a confirmation message when one is required.
• See which product actions people take, if you allow analytics. We do not use this to advertise to you on other sites.
• Cancel a plan and delete data when you ask, and protect the service from abuse.

When you upload a resume, tailor a resume, score keywords, write a cover letter, or write a gap bullet, we send the relevant resume text and job text to OpenAI to produce that result. We do not sell that text, and we do not use it to train a model of our own. For each of those calls we store the token counts OpenAI sends back, the model name, and OpenAI’s id for that response. That log does not include the resume or the job text.

What OpenAI does with API inputs is governed by OpenAI’s terms. This policy does not promise that OpenAI deletes that text or never trains on it.

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We share it with companies that process it for us:

• Supabase stores your account, resume, jobs, plan usage, and OpenAI token counts, handles sign-in, and sends account email.
• OpenAI receives resume and job text to produce the writing described above.
• Stripe collects the card, tax, invoices, and receipts for checkout and the subscription.
• PostHog receives analytics events only if you allow analytics.
• Logo.dev receives a company name when logos are turned on.
• Netlify hosts the public pages. Your resume and jobs are stored in Supabase, not on that host.

When you give us a LinkedIn job link, our server requests that public page. We also disclose information if the law requires it, or to protect Reframe, our users, or others from harm or fraud. If the service is transferred to someone else, account information may go with it, and we will update this policy to name the new operator.

We keep your account, resume, jobs, plan usage, and OpenAI token counts while the account exists. You can delete one saved job from your jobs list. That removes that job’s description, tailored resume, and cover letter. Plan usage and token counts stay until the account is deleted.

Delete my data is on the Account page. It cancels an open paid plan, then deletes your resume, saved jobs, plan usage, OpenAI token counts, subscription record, and account. It also deletes the PostHog person tied to your account when that deletion is configured. If we cannot cancel an open plan, or a configured analytics deletion fails, we leave the account in place so you can try again. Stripe keeps customer and payment records, because payment records have to be kept.

The sign-in cookie lasts for the session. Your analytics choice is stored in local storage on this browser until you change it or clear site data. The referring host we remember for a first visit stays in session storage until the tab is closed.

You can correct your resume in the app, delete a saved job, decline analytics, and delete the account. You can download a resume as Word or PDF and copy a cover letter.

Email reframeresumeapp@gmail.com to access, correct, or get a copy of the rest of the account data, or to object to processing we base on legitimate interests. We may ask you to confirm you control the account email. We respond within 30 days. You can withdraw analytics consent on this page, or with the choice shown when you first visit. Withdrawing consent does not affect processing that already happened.

If you live in California, the California Consumer Privacy Act, as amended by the CPRA, gives you the rights below. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics for advertising.

In the last 12 months we may have collected these categories, from you or from the providers above:

• Identifiers, such as your email, account id, and IP address.
• Commercial information, such as the plan you bought. Card charges stay with Stripe.
• Internet activity, such as page views and product actions, if you allow analytics.
• Professional information, such as the resume and job text you submit.
• Account credentials. The password is stored as a hash. A resume may also include sensitive details you chose to put in it.

We use those categories for the purposes in “How we use information,” and we keep them for the periods in “How long we keep it.” We do not draw inferences about you for advertising.

You have the right to:

• Know the personal information we collect, use, and disclose.
• Correct inaccurate personal information.
• Delete personal information, subject to exceptions the law allows, including payment records.
• Opt out of sale or sharing for cross-context advertising. We do not do either.
• Limit the use of sensitive personal information to providing the service you asked for.
• Not be discriminated against for exercising these rights.

Use Delete my data, the analytics choice on this page, or email reframeresumeapp@gmail.com. An authorized agent may submit a request if they show permission to act for you. We will confirm the request with the account email when we need to.

If you are in the European Economic Area or the United Kingdom, Emerson Stewart is the controller of your personal information. We have not appointed a representative in the EEA or the UK. Contact reframeresumeapp@gmail.com.

We rely on these legal bases:

• Contract. Your account, storing and tailoring your resume, cover letters, and gap bullets.
• Consent. Analytics. You can withdraw that consent at any time.
• Legal obligation. Payment records, which Stripe keeps as the payment processor.
• Legitimate interests. Keeping the service secure and preventing abuse, and remembering the referring host on your device before you choose analytics. You can object.

You can ask to access, correct, delete, or restrict your information, to receive a portable copy, to object, and to withdraw consent. You can also complain to your local supervisory authority. Email us first and we will respond within one month.

Supabase, OpenAI, Stripe, PostHog, Logo.dev, and Netlify may process information in the United States and other countries. Where a provider offers a lawful transfer tool, such as standard contractual clauses, we rely on that provider’s tool.

The sign-in cookie is required for an account. PostHog’s cookie and local storage are optional and are set only after you allow analytics. This browser also stores your analytics choice in local storage, and may store the referring host for this tab in session storage.

Reframe is for people 18 and older. We do not knowingly collect personal information from anyone younger. If you believe we have, email reframeresumeapp@gmail.com and we will delete the account.

The site is served over HTTPS. Database rows are limited so an account sees its own data. Passwords are hashed by Supabase. We do not store card numbers. No method of storage or transmission is perfectly secure.

We post changes on this page and change the effective date at the top. This version is effective October 13, 2026.