Privacy Policy

Last updated: 2026-10-05

CVRater helps you analyze, tailor and design your CV. This policy explains what we collect, why, who receives it and what you can do about it.

What we collect

Account: your email address and a salted hash of your password (we never store the password itself).
Purchases: which products you bought, store transaction identifiers, refund status and your credit balance history.
AI usage: for each AI operation, its type, credit cost, status and time. The text and images you submit for an operation are used only to run it; we do not keep them. The generated result is stored with your account until you delete the account.
Security counters: short-lived rate-limit counters that include the network address of the request, kept for hours, not linked to your profile.
On your device only: your CV documents, drafts, templates and settings. They are not uploaded to our servers.

When you run an AI feature, the text (or images) you submitted is sent through our server to Google Gemini to produce the result, and is not used by us for any other purpose. Do not submit information you do not want processed this way.

Apple: App Store purchases and subscriptions.
RevenueCat: subscription and purchase management; receives your internal account identifier and purchase information.
Google (Gemini API): processes the CV text and images you submit for AI features.
Mailtrap: delivers verification and password-reset emails; receives your email address and the code.
Railway: hosts our servers and database.
We do not sell personal data, show ads or use advertising or analytics trackers.

Account data and stored AI results: until you delete your account.
Financial records (purchases, refunds and credit ledger): kept after account deletion as required for accounting and legal obligations; they are no longer linked to your email.
Verification codes expire in 10 minutes.

Delete your account in the app: Settings, Account, Delete account. This removes your email and password, signs out all sessions and erases stored AI results.
Deleting the account does not cancel an App Store subscription; manage it in your Apple ID subscription settings.
You can ask us to access, correct or delete your data, or object to processing, by contacting support. Depending on where you live (for example the EU/UK under GDPR or Türkiye under KVKK) you may have additional rights, including complaining to your data protection authority.

Traffic uses HTTPS. Passwords are hashed. Sign-in tokens are kept in the iOS Keychain. No system is perfectly secure; tell us at once if you suspect misuse.

CVRater is not directed to children under 16 and we do not knowingly collect their data.

We will update this page when practices change and show the date above. Questions: see the Support page.