Privacy Policy

1. Information We Collect

Information you provide

• Account information: your name, email address, and sign-in details when you register, sign in with email and password, or connect a Google or GitHub account.
• Profile & Knowledge Bank: headline, summary, location, target roles and companies, salary preferences, and the skills, work history, education, certifications, projects, and other career details you enter or import.
• Jobs & applications: job postings you add or capture (including title, company, description, salary, and notes), application status, and offers you record.
• Documents: resumes and cover letters you upload or build, generated drafts, and exported files.
• Interview prep: questions, strategy notes, and per-job research.
• Contacts & calendar: recruiter and contact details, interview events, and (if you connect it) information synced from your Google Calendar.
• Feedback & support: anything you send us through feedback forms, support requests, or email.

Information collected automatically

• Usage and diagnostics: first-party product events, described in the Product Analytics section below, and technical data such as browser type, device, and approximate region.
• Error data: when something breaks, our error-monitoring tool may collect technical context such as an error identifier, browser or server information, and your IP address so we can diagnose and fix problems. It does not record your browsing sessions.
• Account activity: sign-in events, feature usage, and email delivery status, which we use to operate, secure, and improve the Service.

Information from linked services

If you link an account (such as Google Calendar) or use the Chrome extension to save a posting, we receive the information needed to perform that action. Job postings you capture come from third-party websites you visit; you are responsible for capturing them in line with those sites' terms.

2. How We Use Your Information

We use your information to:

• Provide, run, and maintain your account and the features you use, including AI-assisted features.
• Process the content you add so features like resume tailoring, interview prep, and company research work.
• Send you transactional and notification emails you've asked for or that are needed to run your account (for example, password resets, interview reminders, weekly digests). You can manage notification preferences in your settings.
• Provide and improve the Service, troubleshoot, and fix errors.
• Protect the security and integrity of the Service, detect and prevent fraud or abuse, and comply with legal obligations.
• Respond to your support requests and communicate with you about your account.

We do not sell your personal data, and we do not use it to advertise to you or to profile you for third-party advertising.

3. AI Processing

Some features use AI models to generate or rewrite content. To do this, we send the inputs needed for the specific task to our AI providers. For example:

• To tailor a resume, we may send the job description, your resume text, and relevant Knowledge Bank details.
• To draft a cover letter or email, we may send the job details and your chosen tone and emphasis.
• To prepare interview questions or company research, we may send the job and company context.
• To extract a captured job posting, we may send the page content we retrieved from the site you saved it from.

These requests go to our AI providers: OpenRouter, Google Vertex AI, and Cerebras.

For capture through the Chrome extension, the page content is sent from your browser to RoleReady to extract the job's fields, and the extracted fields may then be sent to our AI providers to refine the result. Raw page HTML is processed server-side to extract markdown and structured data, then discarded; it is not retained.

Outputs are produced for your review; you decide what to keep, edit, or discard. Each AI run is logged (for example, the feature, model tier, and timing) so we can operate, monitor, and improve the feature. Your content is not used to train AI models. The no-training option is enabled at the provider level in our AI gateway configuration, so inputs you send through RoleReady are not used to train or refine the underlying models.

4. Cookies & Local Storage

We keep tracking to a minimum.

• Essential cookies: a session cookie keeps you signed in (it lasts about 7 days). This is required for the Service to function and cannot be disabled if you want to stay logged in.
• Functional storage: we use first-party local storage for things like your theme and onboarding state. This stays on your device and isn't shared.
• No advertising or cross-site tracking cookies. Our product analytics use no cookies, and we don't use advertising or marketing-tracking networks.

Most browsers let you control or delete cookies and local storage; doing so may sign you out or reset some preferences. Our Chrome extension operates locally in your browser and doesn't set tracking cookies on roleready.me.

5. Sharing & Service Providers

We share your data only as needed to run the Service, comply with the law, or protect rights. We never sell your data. We use service providers ("processors") that handle data on our behalf under contractual obligations to protect it. Categories of providers we rely on include:

• Hosting and database: Google Cloud (Cloud Run and Cloud SQL) runs the application and stores your account data in the us-central1 region (United States).
• File storage: Cloudflare R2 stores files you upload or generate (resumes, cover letters, exports).
• AI model providers: OpenRouter, Google Vertex AI, and Cerebras power AI features, as described above.
• Email delivery: Resend sends transactional and notification emails on our behalf.
• Payments: Polar handles checkout and billing as merchant of record. We share only what's needed to process a payment (such as your account identifier and email); your full payment details are handled by Polar, not stored by us.
• Page retrieval: Jina receives the job URL you save and returns the page text.
• Web search: Brave Search receives the search query we generate for company research, such as a company name and topic.
• Maps and logos: Stadia Maps, Nominatim, and OSRM provide geocoding, maps, and commute estimates for locations you enter; logo.dev provides company logos.
• Background processing: Inngest runs queued jobs (such as generating an export).
• Authentication: Better Auth handles email, Google, and GitHub sign-in.
• Error monitoring: Sentry.
• Connected services: if you connect Google Calendar, that provider's terms apply to your use of Google Calendar.

See our credits page for more on these tools. We may also disclose information where required by law, to protect our rights or safety, or in connection with a merger, acquisition, or sale of assets (in which case we'll require comparable privacy protections).

Product Analytics

We record a small set of product events so we can see whether RoleReady helps people: signing up, finishing onboarding, saving a job, uploading or tailoring a resume, moving a job to a new stage, opening the upgrade page, and completing a checkout. Each event is linked to your account ID and carries a few fixed labels, such as where a job came from, the stage it moved to, your plan, or the campaign tag in the link you signed up from.

• Events are stored in a table in our own PostgreSQL database.
• We use no cookies and no third-party analytics vendor for these events.
• Events are tied to your account ID, so they are personal data, but their properties never include the contents of your resumes, job postings, notes or messages. The fields are fixed in code, so free text cannot be added.
• Events are deleted automatically after 395 days, and with your account if you delete it.

This applies to the RoleReady app. The marketing site at roleready.me is hosted on Vercel and uses Vercel Analytics, which is cookie-less and aggregated.

6. Data Security

Data is encrypted in transit using TLS. Sensitive credentials we store (such as tokens you provide by connecting a calendar) are encrypted at rest. We limit access to personal data to the people and systems that need it, and we monitor our infrastructure for security issues. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authorities as required if a breach occurs.

7. Data Retention & Deletion

We keep your data for as long as your account is active so the Service works as you expect. Specifically:

• Account data: kept while your account is open.
• When you delete your account: your data is removed from the live Service promptly, and any active paid subscription is cancelled. Residual backup copies are overwritten in line with our normal backup schedule.
• Exports: a data export you download is available for a limited time and then automatically removed.
• Some records kept longer: we may retain limited information (such as security, billing, or audit logs) where needed for legitimate business purposes, to protect against fraud, or to meet legal obligations, and then delete it when no longer required.

8. International Data Transfers

RoleReady and its providers are primarily based in the United States. If you use the Service from another country, your data will be transferred to and processed in the US and potentially other countries. Where required, we put appropriate safeguards in place for these transfers, such as standard contractual clauses approved by the European Commission, and require our providers to protect your data consistently with this policy.

9. Children's Privacy

RoleReady is not intended for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, contact us at privacy@roleready.me and we will delete it.

10. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Many of these are things you can do yourself: edit your profile, manage notifications in settings, export your data, or delete your account. For anything else, contact us at privacy@roleready.me.

If you're in the EU, UK, or EEA, the GDPR gives you specific rights; see our Data Protection & GDPR Rights page for details. If you're a California resident, the CCPA/CPRA gives you rights to know, delete, and correct your personal information and to opt out of any "sale" or "sharing" (we don't sell or share your data as those terms are defined). We will not discriminate against you for exercising your rights.

We respond to verified requests within the time required by applicable law (generally within a month).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date at the top, and for material changes we'll give you notice (for example, by email or an in-app message) before they take effect. Continued use after the effective date means you accept the updated policy.

12. Contact

Privacy questions or rights requests: privacy@roleready.me
Anything else: our contact page.