Legal
Privacy Policy
CareerCaddy ("CareerCaddy," "we," "us," or "our") is a project built and operated by Caleb and David. This Privacy Policy explains what information we collect when you use the CareerCaddy website, review tool, and dashboard (the "Service"), how we use it, who it's shared with, and the choices you have. It's written to describe what the Service actually does today, not a generic template. If you have questions after reading it, use the contact details at the bottom.
Information We Collect
We collect information in three ways: what you type or upload, what we generate on your behalf, and a small amount of technical information collected automatically.
What You Provide
- Your resume or work history. A file you upload, text you paste, or a link to a page with your resume. We extract the text and don't keep the original file.
- Your work history corrections. The list of jobs we read from your resume, with any dates, titles, or jobs you fix or add.
- Career details. The positions you're going for, jobs and industries you like, your interests, your story and what you value, hobbies, job descriptions or job-post links you add, and any formatting requirements or style document.
- Your answers to the review's follow-up questions, including options you pick, and the skill ratings you set.
- Answers to optional follow-ups if you use them: questions that back up your top-rated skills, daily check-in questions, interview-practice answers, questions on your dashboard's "Next Up" card, and the "More About You" page (for example, whether you want remote work, how far you'll commute, or what pay would make you switch).
- Cover letter details (if you generate one): the target company, role, job description, and details you give us for that role.
- Account information, if you create a free account: your email address and a password. Your password is never stored in plain text; only a one-way cryptographic hash of it is kept, which can't be turned back into your password.
- Feedback you send us at the end of a review, on a specific part of your results, or to unlock an optional feature.
- An email address to receive a copy, if you ask us to email your review or a link back to an unfinished draft.
- Purchase details, if paid features are offered and you buy one: Stripe collects your payment details on its own checkout page. We never see your card number. We receive your email, which feature you bought, and Stripe's reference numbers for the purchase.
- Job feed swipes, if you use the job feed: which jobs you liked or passed on, and the optional reason for a pass.
- Push notification settings, if you turn on notifications: your browser gives us a device-specific address for sending them.
What We Generate
Bulk Apply. If you use Bulk Apply, we process job links, pasted descriptions, uploaded documents or screenshots, and your answers to shared and job-specific questions. Job text and screenshots are sent to Anthropic to read the posting and tailor your resumes. We keep extracted job details, answers, match assessments, generated resumes, and optional LinkedIn text in your saved batches. Raw page text, original files, and screenshots are processed for the request rather than saved in your batches.
The AI-generated output tied to your session or account: your follow-up questions, our recommendations, the rewritten resume and its earlier versions, the review write-up, cover letters, daily check-in questions, interview-practice questions and feedback, and a short profile of facts about your career goals, preferences, and work history (see "Data retention"). It's stored so we can show it to you again and, if you have an account, so you can come back later and find it.
Collected Automatically
- IP address and browser/user-agent string, logged when you submit a review.
- IP address, briefly, when you log in, request a password reset, or use the AI-powered features. This is anti-abuse logging only, to stop repeated login attempts and to keep any one visitor from running up AI costs. It isn't linked to your resume content.
- A session identifier, used to connect your in-progress answers to your browser.
- Usage metadata: which AI action ran and roughly what it cost us, used only to manage our operating costs.
- Error logs: short technical notes when something fails (for example, an email that didn't send). Email addresses in these notes are replaced with a scrambled code before anything is written, and the notes are deleted after 30 days.
Stored Only on Your Device
Your light/dark theme choice, your selected resume font, and whether you've seen the example-answers walkthrough or dismissed the cookie notice are saved in your browser's local storage. These never leave your device. How you've arranged your dashboard tiles is saved there too and, if you're logged in, also to your account, so your dashboard looks the same on every device.
While you fill in the review form, what you've typed and which step you're on are kept in your browser's session storage, so a refresh doesn't lose them. Session storage is cleared when you close the tab, and also once you move on to the questions. The copy in session storage never leaves your device; if you're logged in, each step is also saved to your account as a draft.
How We Use It
- To run the review: read your work history, suggest options, ask follow-up questions, and write your analysis, rewritten resume, and cover letter.
- To keep your account useful between reviews: remember your career goals and work history, suggest your next question, write daily check-in questions, and run interview practice.
- To email you a copy of your review, a link back to an unfinished draft, a password reset link, or a note that your daily check-in is ready, when those apply.
- To send push notifications you turned on (currently just "Your daily check-in is ready").
- To unlock features you've bought or unlocked with feedback.
- To understand, in aggregate, how much the AI features cost to run, and to find and fix errors.
- To read and act on the feedback you send us, and to respond if you contact us.
- To keep the Service safe and lawful: prevent abuse and fraud, enforce our Terms, comply with legal obligations and valid legal requests, and protect the rights and safety of our users, ourselves, and others.
We do not sell your information. We do not use your resume or the details you provide to train our own AI models, and we do not use them to serve you ads. We don't run any advertising on this site.
Data Retention
Bulk Apply batches. We keep your five newest batches, including their extracted job details, answers, assessments, generated resumes and optional LinkedIn text, until they are replaced by newer batches or you delete your account. This saved content can contain personal information from your resume and answers.
The resume text you upload, paste, or link is deleted within 24 hours of your review, along with the IP address and browser information recorded with it. This runs automatically on a schedule; you don't have to ask.
If you don't create an account, that's the whole story: your review, your answers, and everything else tied to your session are deleted within 24 hours too.
If you do create an account, we still delete the uploaded resume text on the same 24-hour clock. We keep what we made together until you delete it or close your account: your reviews (with the answers and career details that went into them, so later rewrites can use them), your rewritten resume and its earlier versions, cover letters, saved drafts, daily check-in history, job feed likes and passes, and questions waiting on your dashboard. That's the feature you signed up for. If you'd rather nothing be kept, don't create an account.
Account profile. With an account we also keep a short profile of facts about you: target roles, seniority, preferences (like remote work or pay), your confirmed work history, and short notes on the evidence you gave for your top skills. It doesn't include the text of any resume or document you upload. We keep it so each new resume, rewrite, or cover letter reflects what you've told us. You can view, edit, or delete any fact, or clear the whole profile, from your dashboard.
Shorter-lived records: password reset links expire after 1 hour, sign-in tokens after 30 days, anti-abuse records after their limit window (at most a day), and error logs after 30 days. Anonymous, aggregated operating metrics (how many reviews ran and roughly what they cost) are kept longer; they contain no personal information, and we don't try to link them back to anyone.
Your Choices & Rights
You can, at any time:
- Delete your account yourself from your dashboard ("Delete Account," confirmed with your password). This permanently deletes your account and everything tied to it: reviews, resumes, cover letters, profile, check-ins, waiting questions, job feed swipes, notification settings, dashboard layout, purchases on record, sign-in tokens, and your lines in our error log.
- View, correct, or delete your profile facts from your dashboard.
- Turn off check-in emails and notifications by choosing Off in the Daily Check-In tile on your dashboard.
- Download your rewritten resume (Docs-ready .docx or PDF) from your results.
- Ask us for a copy of everything we hold about you, or to correct or delete something you can't change yourself. We aim to complete these requests within 30 days.
California residents. The categories of personal information we collect are: identifiers (email, IP address), professional and employment information (your resume, work history, and career details), commercial information (purchases, if any), and inferences (your profile facts). We collect them from you and use them only for the purposes above. You have the right to know, access, correct, and delete your information, and we won't treat you differently for using these rights. We don't sell or "share" personal information as California law defines those terms, and we don't use sensitive personal information for anything beyond providing the Service. We also don't give personal information to anyone for their own direct marketing (California's "Shine the Light" law).
Other US states. If you live in a state with its own consumer privacy law (such as Colorado, Connecticut, Virginia, Texas, or Oregon), you have similar rights: to know, access, correct, and delete your information, to get a copy of it, and to opt out of its sale, of targeted advertising, and of profiling. We don't sell your information, we don't do targeted advertising, and we don't use your information for profiling or automated decisions that have legal or similarly significant effects on you. Our AI writes suggestions for you and chooses which jobs to show you; it never makes decisions about you for an employer or anyone else.
Making a request. Use the contact details at the bottom of this page. To protect your account, we'll act only on requests we can tie to it: for example, one sent while you're logged in, or one we confirm with the account's email address. You can have an authorized agent make a request for you with your signed permission; we may still confirm it with you directly. If we turn down a request, we'll tell you why, and you can appeal by replying to our answer; we'll respond to an appeal within the time your state's law requires.
Browser privacy signals. We don't sell or share your information or track you across other sites, so a Do Not Track or Global Privacy Control signal has nothing to turn off here. We still treat a Global Privacy Control signal as a request to opt out of any sale or sharing.
Elsewhere. If you're in the UK, EU, or another place with its own data protection law, the same rights apply, along with the right to object to or restrict certain processing and to complain to your local data protection authority. We rely on your consent when you submit your resume and answers and, for account features, on providing the service you asked for by creating an account.
Children's Privacy
The Service isn't directed at children under 13, and we don't knowingly collect information from anyone under 13. You must be at least 16 to use the Service, or have a parent or guardian's permission if you're younger; see the Eligibility section of our Terms. If we learn we've collected information from a child under 13, we'll delete it. Contact us if you believe that's happened.
Security
We use reasonable administrative and technical safeguards to protect your information. For example, passwords, password reset links, and sign-in tokens are stored only as one-way hashes, the site is served over HTTPS, and the admin dashboard used to view submissions is password-protected and not linked from any public page. No method of transmission or storage is 100% secure, and we can't guarantee absolute security. If you believe you've found a security issue, please contact us.
Where Your Data Lives
The Service is hosted in the United States. If you're using it from outside the US, your information will be transferred to, stored, and processed in the US, where privacy laws may differ from those in your country.
Changes to This Policy
If we make material changes to how we handle your information, we'll update the "last updated" date at the top of this page and, where practical, note the change on the site. If the Service moves to a new web address, your account and data move with it and this policy keeps applying. Continuing to use the Service after an update means you accept the revised policy.
Contact Us
Questions, feedback, or a request about your information (access, correction, deletion, export)? The end-of-review feedback questions are the fastest way to reach us right now; we read every one directly. For a privacy request, or if you can't reach us through the feedback form, email caleb.darjany [at] gmail [dot] com (written that way to keep spam bots out; swap in the @ and the dot).
See also: Terms of Service