Privacy Policy

Your privacy is the foundation of Resumi.

Last updated: October 14, 2026

Data We Collect

Resumi requires no account and no sign-up. Your resumes, job descriptions, and settings are created and stored entirely on your device. The only server-side data we keep is a random anonymous license key (used for purchases, trial status, and rate limits) and, unless you turn it off in Settings, anonymous in-app event counters — never resume or job-description content. Details in the sections below.

Browser Extension

The Resumi browser extension reads the job posting on the page you're viewing only when you click it (or use its context-menu option). The posting text is passed directly to the Resumi app on your device via a local app link and is never uploaded to our servers by the extension.

How Your Data Is Stored

Your resumes, job descriptions, ATS scores, and settings are stored in a local SQLite database within the app's local container on your device. This data never leaves your device unless you explicitly export, email, or back it up.

Usage Stats

Resumi collects anonymous usage statistics on by default — event counters like "a score was run" or "the docx export failed," never resume or job content. Events are tied to a random license key with no personal information and are used only to improve the app. You can turn stats off anytime in the app under Settings → Anonymous usage stats.

AI Features

When you use AI-powered features (the AI polish pass, ATS scoring with AI, skill gap analysis, resume import), your resume text and the relevant job description are sent to a secure API relay for processing. This relay:

• Routes requests through OpenRouter (openrouter.ai) to Google's Gemini models for processing
• Sends every request with zero-data-retention routing enforced, so only AI endpoints whose providers do not use prompts for training or product improvement (Google Vertex AI) can serve them; any upstream retention is limited to the provider's standard safety and abuse-monitoring window
• Your resume and job-description text is used only to produce the output you requested — never to train, tune, or improve any AI model, and never sold or shared with anyone
• Does not store, log, or retain any resume content
• Tracks Pro status tied to an anonymous license key and the purchase email — never resume content

Information received from Google APIs is never transferred to any AI service. The AI features process only the resume and job-description text you enter directly in the app.

AI scoring and AI resume import are free; the AI polish pass and cover letters are unlocked with a one-time Pro purchase. You can build, edit, preview, and export resumes without Pro.

Payments

• Pro purchases (Mac & Windows): processed by Polar, which acts as the merchant of record. Polar collects the information needed to process your payment — name, email, billing details, and a payment token — and calculates any applicable taxes.

We do not receive or store your full payment card details. See Polar's privacy policy for how they handle payment data.

Google Account Data (Gmail)

If you choose "Send application with Gmail" in Resumi, the app requests access to the sensitive Google scope gmail.send — permission to send email on your behalf. It is the only Google permission Resumi requests.

• Emails are sent only when you explicitly click the send button for a specific application. Resumi never sends email without your action.
• Resumi does not read, download, index, store, or transfer any other Gmail data — no inbox contents, messages, drafts, contacts, or mailbox metadata.
• Your Gmail OAuth tokens are stored only on your device, in the app's local data folder. They are never sent to us or to any server. Disconnecting Gmail in the app deletes them from your device.
• The recipient's email address and the attached resume PDF are used only to compose and send your message. Neither is stored on our servers or shared with third parties.
• You can revoke Resumi's access at any time from your Google Account at myaccount.google.com/permissions.

Resumi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Protecting Data from Google APIs

Resumi applies the following mechanisms to protect any data accessed through Google APIs:

• Encryption in transit: all communication between the app and Google APIs, our relay, and any AI or email service occurs over HTTPS with TLS 1.2 or higher.
• Encryption at rest: Gmail OAuth tokens are encrypted with your operating system's key storage (Apple Keychain on macOS, Windows DPAPI on Windows) before being written to your device's disk. Tokens are never transmitted to our servers — our infrastructure never sees them, and when Gmail is connected, your message content travels directly from your device to Google's Gmail API.
• Least privilege: the send-only scope means Resumi is technically incapable of reading inbox contents, drafts, attachments, contacts, or mailbox metadata, so there is no mailbox data at rest anywhere in our systems.
• No human review: we never review, monitor, or manually inspect the content of messages sent through the Gmail API.
• No selling or advertising: we do not sell, rent, or use data received from Google APIs for advertising of any kind.
• Retention: we store no data received from Google APIs. Only an anonymous daily send counter is kept on our relay to enforce rate limits. Where an application email is delivered through our fallback email service instead of Gmail (older app versions, or Gmail not connected), the message passes through that provider solely for delivery and is not retained by us.
• Deletion: disconnecting Gmail inside Resumi securely deletes the stored tokens from your device, and revoking access at myaccount.google.com/permissions invalidates them at Google immediately.
• Incident response: if we discover unauthorized access to data received from Google APIs, we will notify affected users promptly via in-app messaging and email, revoke and rotate affected credentials, and document the incident and remediation.

Third-Party Services

Resumi uses the following third-party services only when you explicitly trigger them:

• Gmail: email delivery when you send an application with your connected Google account (see "Google Account Data (Gmail)" above)
• AI Processing: AI scoring, polish, review, and import requests are sent over TLS through our relay to OpenRouter and Google Vertex AI, with zero-data-retention routing enforced; content is never stored by us and never used to train AI models
• Resend: transactional email delivery for the "email me this resume" feature and for application emails sent while Gmail is not connected; messages pass through Resend (resend.com) solely for delivery
• Job Search: when you use "Find a Job", listings are retrieved from third-party job-board aggregation services; your search terms are sent to that service to return results, and nothing about your resume is shared with it
• Polar: merchant of record that processes Pro purchases on both Mac and Windows

The Resumi desktop app contains no advertising networks or third-party analytics/tracking SDKs; its only telemetry is the anonymous, opt-out event counters described under "Usage Stats", which never include resume or email content. The marketing website loads a Reddit ads conversion pixel that reports standard anonymous browser signals to measure ad performance; it never receives data obtained from Google APIs, email content, resume content, or any other personal data described in this policy. No other advertising or analytics services are used.

Children's Privacy

Resumi does not collect any personal data from anyone, including children under 13.

Changes to This Policy

If we update this privacy policy, we will post the updated version here with a new effective date.

Contact

Questions about privacy? Email us at [email protected].