Privacy Policy

Overview

DraftCareer ("we," "us") helps you build resumes and cover letters from a single profile. This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account information — your email address and password (stored as a one-way hash, never in plain text). If you sign in with Google or LinkedIn, we store the identifier that provider gives us, so a future login with the same provider recognizes your account.
• Profile and document content — whatever you enter or upload: contact details, address, a photo (if you add one), work experience, education, skills, languages, certifications, links, and the content of any resume or cover letter you create.
• Support messages — if you use the Help Center's contact form, we receive your message and your account email, so we can reply to you.
• Usage data — we use PostHog for basic analytics (which pages you visit, whether a signup completed), not Google Analytics — chosen partly because PostHog writes its cookie to our own domain rather than a third party's. If you found us through a Google ad, we also tell Google Ads that a signup happened (not which pages you visited, or anything else about your activity) so we know which campaigns are working. Both only run for visitors who accept the optional cookie in our cookie banner; decline it and neither is used.
• How you signed up — when you create an account we record two things about that one request: whether it came from a phone, tablet or computer, and which country it came from. We use these to understand where the product is being used and whether it works properly on the devices people actually have. We do not store your IP address or your browser's identifying string, only these two summaries, and this does not track you around the site or between visits.

How we use your information

We use your information to:

• Provide the service — rendering your profile into the resume/cover letter templates you choose.
• Let you sign in, including via Google or LinkedIn if you choose to link those accounts.
• Generate AI-assisted drafts (summaries, bullet points, cover letters) when you ask for one — your profile/resume text is sent to our AI provider only for that specific request, to produce that draft.
• Respond to messages you send us through the contact form.

We do not sell your information, and we do not share it with employers or other users.

Cookies

We use one strictly-necessary cookie to keep you signed in — the site cannot function without it, and (as is standard under most cookie laws) it doesn't require consent. Everything else is optional and only runs after you accept the cookie banner: PostHog analytics (written to our own domain, not a third party's) and a Google Ads conversion tag, which tells Google when a signup happened so we can measure whether an ad campaign is working. That conversion tag is one-way and event-only — it doesn't let Google build an ad-retargeting or remarketing audience from your visit, and it's off entirely if you decline the cookie banner. Separately, if the Help Center contact form's Cloudflare Turnstile bot-check is active, Cloudflare may set its own cookie for that specific check, purely to confirm you're not a bot — it isn't used to track you across other sites, and doesn't depend on the cookie banner choice.

Third-party services we use

• Google / LinkedIn Sign-In — only if you choose to log in or link your account with one of these; we receive your name, email, and profile photo from them, never your password.
• Groq — powers our AI writing-assist features. Text you submit for an AI action (e.g. "polish this summary") is sent to Groq to generate that response. By Groq's own policy, this text isn't used to train their models. Groq doesn't retain it beyond what's needed to generate that response, except for temporary operational logs (kept up to 30 days) used only to investigate abuse or platform-reliability issues.
• Resend — sends the email when you use the Help Center contact form.
• Polar — processes payment for paid plans and acts as our authorized reseller (merchant of record) for billing. If you subscribe, Polar handles your payment details directly on its own checkout page — we never see or store your card number.
• Cloudflare Turnstile — may be used on the contact form to reduce automated/bot submissions, without relying on a third-party tracking cookie the way some CAPTCHAs do.
• PostHog — analytics, described above. Only runs for visitors who've accepted the optional cookie in the banner.
• Google Ads — conversion tracking, described above. Tells Google that a signup happened, for ad campaign measurement — not general browsing activity, and not used to retarget you with ads elsewhere. Only runs for visitors who've accepted the optional cookie in the banner.

Where your data is processed

DraftCareer's application and database run on Railway, hosted in the EU (Amsterdam, Netherlands) — your account, profile, and document content lives in a database there. Analytics (PostHog) also runs on its EU Cloud, an entirely separate instance hosted in Frankfurt, Germany (AWS eu-central-1).

A few of the third-party services listed above are still US-based companies: Google (Sign-In, only if you choose to log in that way, and Ads conversion tracking, only if you've accepted the cookie banner), LinkedIn (only if you choose to sign in with them), Groq (AI writing-assist), Resend (contact-form email), and Polar (payment processing for paid plans). Using any of those specific features means the data involved in that request is transferred to and processed in the US, even though your core account and document data stays in the EU.

Data retention and deletion

We keep your information for as long as your account is active. You can permanently delete your account at any time from My Account → Danger Zone — this removes your profile, resumes, and cover letters from our live database immediately and permanently, and cannot be undone. Railway, our hosting provider, keeps rolling database backups for disaster recovery, so a deleted account's data may persist in those backups for up to roughly 4 weeks before it's fully purged, even though it's no longer accessible through the app or to us in normal operation.

Legal basis for processing (EU/UK/similar)

If you're in the EU, UK, or another jurisdiction with similar requirements, here's the legal basis we rely on for each kind of processing:

• Providing the service (building your resume, saving your profile, letting you sign in) — necessary to perform our contract with you (our Terms).
• AI writing-assist — performed at your specific request, also under contract.
• Analytics (PostHog) and ad conversion tracking (Google Ads) — your consent, given via the cookie banner; you can withdraw it at any time by declining or clearing the cookie.
• Responding to support requests — our legitimate interest in operating the service, and contract if you're already a user.
• Security and fraud prevention — our legitimate interest in keeping the service and its users safe.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or receive a portable copy of your personal information, and to object to certain processing. Most of this is already self-serve — your information is editable directly from your Profile and Account pages, and account deletion is available any time from My Account → Danger Zone. For anything else — a data export, a correction we haven't built a self-serve tool for yet, or an objection to a specific use — contact us at privacy@draftcareer.com and we'll respond within 30 days.

If you're in the EU or UK and believe we haven't handled your request properly, you also have the right to lodge a complaint with your local data protection supervisory authority.

Children's privacy

DraftCareer isn't directed at children, and we don't knowingly collect information from anyone under 13.

Changes to this policy

If we materially change how we collect or use your information — for example, adding an analytics tool — we'll update this page and the "Last updated" date above.

Contact us

Questions about this policy? privacy@draftcareer.com