Privacy policy

Your CV data — without an account

Everything you type into the editor — your name, contact details, experience, education — is stored in your browser's local storage, on your own device. We keep no copy of it on our servers and share it with no one.

Without an account, the contents of your CV stay on your device: the editor, the preview and the smart assistant's questions run in your browser, and the ATS check analyses your file on your own machine without uploading it anywhere. The one exception is downloading: when you download your CV, its contents pass through our server to generate the file, processed in memory and then discarded, never written to disk or logged — it is generated on the server because that is the only way to produce correct Arabic text an applicant tracking system can read. The Word file and the AI tools require an account.

In this case we can't recover your data if you lose it, and we can't delete it on your behalf, because we simply don't have it. You can clear it at any time by clearing the site data in your browser settings.

Your CV data — with an account

An account is entirely optional: building, previewing, the ATS check and the cover letter all work without signing in. If you do sign in, your CV is saved on our servers against your account — which is the whole point of the account: to carry on from another device instead of your work being trapped in one browser.

What we store is the CV content you wrote and the time it was last edited. We do not read your CV, analyse it, or use it for any purpose other than showing it to you and exporting it when you ask.

With an account, your data passes through our server in three cases, all of them at your request: saving automatically as you edit, generating the download as a PDF or Word file — done on the server because that is the only way to produce correct Arabic text an applicant tracking system can read — and the AI tools described below. Apart from the saving, nothing is written to disk: it is processed in memory to complete what you asked for and then discarded, and never recorded in our logs.

You can delete any individual CV from your saved CVs page, or delete your account entirely from your account page — which permanently removes every CV, every session and your account details from our database. We keep no shadow copy of 'deleted' data and we do not archive what you remove. The one thing that remains is a one-way hash derived from your Google identifier — it reveals neither your name nor your email and cannot be reversed — recording that you used the free summary improvement, so it is not handed out again if you delete your account and come back.

One exception, stated plainly: we take a daily backup of the whole database as protection against hardware failure. A backup is a picture of the database as it stood when it was taken, so it can still contain data you deleted afterwards. Those backups are never opened, never read, and used only to restore the entire database after a disaster — and each one is deleted automatically after fourteen days.

Your account and signing in

Signing in is handled by Google. We never see your Google password; Google verifies you and then tells us three things only: your email address, your display name, and your stable Google identifier. We do not request access to your mail, your files or your contacts, and we could not read them.

We store those three fields to identify your account and attach your CVs to it. We use your email to contact you about your account when necessary, not for marketing.

Your session is held in a cookie that page scripts cannot read, and our database stores only a hashed fingerprint of it rather than the value itself — so nobody could derive a working session from our database even with access to it. You can end all your sessions from your account page.

What we do collect

• Basic technical data that servers log automatically, such as IP address and browser type, for security and abuse prevention.
• If you sign in: your email address, display name, Google identifier and the date your account was created — plus any CVs you have saved.
• Your email address and the contents of your message if you contact us directly, used only to reply to you.
• If you sign in: the basic steps you take with the service and when, linked to your account and the CV — such as creating and completing a CV, opening the payment page, a payment succeeding or failing, and downloading — so we can see where people get stuck and improve the service. Our own servers record them; we share them with no one, and they are deleted when you delete your account.
• And nothing else. We use no third-party analytics tool and we do not track you across sites.

Cookies

We use essential cookies to run the site and remember preferences such as your language and theme. We use no analytics tool, no third-party cookies and no tracking pixels — which is why you will not find a cookie consent banner on this site: there is nothing here for you to consent to.

If you sign in, a session cookie is added — that is what keeps you signed in between pages. It ends when you sign out or when it expires. During the sign-in itself a temporary ten-minute cookie is used to protect the request from forgery.

You can disable cookies in your browser settings, though disabling essential ones may prevent your work from being saved automatically and will prevent signing in.

Third-party services

We use service providers for hosting, and Moyasar to process payments. You type your card details on Moyasar's own page and they never reach us — all we receive is that the payment went through, and its amount. These providers process data on our behalf under agreements requiring them to protect it, and we give none of them the contents of your CV to use for their own purposes.

The single exception is our AI provider: Anthropic. It receives your CV text in four cases, each one only when you ask: translating into the other language, rewriting the wording of your summary (the free trial), importing a CV you already have so its content can be sorted into the fields, and polishing the wording of your whole CV with “Polish the wording” in the smart assistant or “Polish the CV” in the editor. None of them happens automatically or in the background, and all of them need you to be signed in. The smart assistant's questions themselves run in your browser, and your answers are sent nowhere.

We send the least each operation needs. The translation does not send your phone, email, LinkedIn or national ID. Polishing the wording sends the job title, summary, experience, education, skills, languages and certificates only — not your name, phone, email, city or national ID. Rewriting a single field sends that field's text, with only the job title or the degree for context.

The import is the one exception to that minimisation, and it cannot be otherwise: you are handing us a finished file to sort into fields, and we do not know which line is your name and which is your phone number until the provider reads it and tells us. So the text extracted from your file is sent in full, contact details included. The file itself is read inside your browser and never leaves your device — what is sent is the text alone, and only when you press the button.

Google is our sign-in provider, and its handling of you at that moment is governed by its own privacy policy. We never send it the contents of your CV.

We do not sell or rent your data to anyone.

Your rights

• Request to know what data we hold about you, if any.
• Delete any saved CV from your saved CVs page, or your account and all its data from your account page — no need to email us.
• Request correction or deletion of personal data we hold.
• To exercise any of these, email us at: support@osacv.com

Children

The service is aimed at job seekers and we do not knowingly collect data from anyone under sixteen. If we become aware of such data, we will delete it promptly.

Changes to this policy

We may update this policy as the service or legal requirements change. We'll publish the updated version on this page with its review date, and continuing to use the site after an update means you accept the new version.