Privacy policy

Your CV data — without an account

Everything you type into the editor — your name, contact details, experience, education — is stored in your browser's local storage, on your own device. We keep no copy of it on our servers and share it with no one.

There are exactly two occasions when your CV content is sent to our server, and neither happens without you pressing a button: when you request a machine translation, and when you request a PDF download — the file is generated on the server because that is the only way to produce correctly shaped Arabic text an applicant tracking system can read. In both cases the data is held in memory only for as long as the operation takes, and is then discarded: never written to disk, never recorded in our logs.

In this case we can't recover your data if you lose it, and we can't delete it on your behalf, because we simply don't have it. You can clear it at any time by clearing the site data in your browser settings.

Your CV data — with an account

An account is entirely optional: building, previewing, the ATS check and the cover letter all work without signing in. If you do sign in, your CV is saved on our servers against your account — which is the whole point of the account: to carry on from another device instead of your work being trapped in one browser.

What we store is the CV content you wrote and the time it was last edited. We do not read your CV, analyse it, or use it for any purpose other than showing it to you and exporting it when you ask, and we share it with no third party.

You can delete any individual CV from your account page, or delete your account entirely — which permanently removes every CV, every session and your account details from our database. We keep no shadow copy of 'deleted' data.

Your account and signing in

Signing in is handled by Google. We never see your Google password; Google verifies you and then tells us three things only: your email address, your display name, and your stable Google identifier. We do not request access to your mail, your files or your contacts, and we could not read them.

We store those three fields to identify your account and attach your CVs to it. We use your email to contact you about your account when necessary, not for marketing.

Your session is held in a cookie that page scripts cannot read, and our database stores only a hashed fingerprint of it rather than the value itself — so nobody could derive a working session from our database even with access to it. You can end all your sessions from your account page.

What we do collect

• Aggregated, anonymised usage data: pages visited, device type and referral source — to understand what users need and improve the site.
• Basic technical data that servers log automatically, such as IP address and browser type, for security and abuse prevention.
• If you sign in: your email address, display name, Google identifier and the date your account was created — plus any CVs you have saved.
• Your email address and the contents of your message if you contact us directly, used only to reply to you.

Cookies

We use essential cookies to run the site and remember preferences such as your chosen language. We may also use analytics tools to measure performance in aggregate.

If you sign in, a session cookie is added — that is what keeps you signed in between pages. It ends when you sign out or when it expires. During the sign-in itself a temporary ten-minute cookie is used to protect the request from forgery.

You can disable cookies in your browser settings, though disabling essential ones may prevent your work from being saved automatically and will prevent signing in.

Third-party services

We may use service providers for hosting, performance measurement and, in future, payment processing. These providers process data on our behalf under agreements requiring them to protect it, and we give none of them the contents of your CV to use for their own purposes. The single exception is the machine-translation provider, which receives your CV text at the moment you request a translation, and only then.

Google is our sign-in provider, and its handling of you at that moment is governed by its own privacy policy. We never send it the contents of your CV.

We do not sell or rent your data to anyone.

Your rights

• Request to know what data we hold about you, if any.
• Delete any saved CV, or your account and all its data, directly from your account page — no need to email us.
• Request correction or deletion of personal data we hold.
• Object to your data being processed for analytics.
• To exercise any of these, email us at: support@osacv.com

Children

The service is aimed at job seekers and we do not knowingly collect data from anyone under sixteen. If we become aware of such data, we will delete it promptly.

Changes to this policy

We may update this policy as the service or legal requirements change. We'll publish the updated version on this page with its review date, and continuing to use the site after an update means you accept the new version.