Privacy Policy

Service Operator

Transform Resume Team

Contact

hello@transformresume.com

Service URL

localhost:3000

Effective date

2025-01-01

Transform Resume is open-source and can be operated in different ways (for example, by the official hosted service, or by an organization/self-hosted deployment). The specific data controller for your use depends on who operates the instance you are using.

What the Service Does

Transform Resume is a resume builder that lets you:

• Create and edit resumes in a browser-based builder
• Store resumes in an account, optionally mark them public, and share them via a link
• Export/print resumes to PDF and generate preview screenshots
• Upload files such as profile pictures (and other assets used in a resume)
• Optionally configure AI features (e.g., using OpenAI/Gemini/Anthropic) from your own device

Information We Collect

Account information

When you create an account or sign in, the Service stores:

• Identity and profile: name, email address, username/display username, optional profile image
• Authentication state: whether email is verified; whether two-factor authentication is enabled

If you use social sign-in (e.g., Google, GitHub, or a custom OAuth provider), the Service stores identifiers and tokens needed to link and maintain that login.

Authentication and security data

To keep your account secure and keep you signed in, the Service stores:

• Session data: session token, session expiry, and (if provided) IP address and user agent
• Verification data: values used for email verification, password reset, or email change flows
• Two-factor authentication: a 2FA secret and backup codes (if you enable 2FA)
• Passkeys (if you use them): public key, credential ID, device metadata, counters, and related fields

The Service Operator may also send transactional emails (for example, password reset or email verification). Depending on deployment, these emails may be delivered via an email provider or (in development/testing) the links may be logged to server output.

Resume content

When you create or import a resume, the Service stores the resume data you provide, which may include personal data such as:

• Contact details, location, summary
• Employment, education, projects, links, and other resume sections
• Any other content you add (including rich text)

Resumes may also have metadata such as tags, a slug, visibility (public/private), and an optional resume password (if you lock a resume).

Public resume access and statistics

If you publish a resume, other users may access it via its public link. The Service may also maintain simple statistics such as:

• View count and download count
• Last viewed/downloaded timestamps

Uploaded files (e.g., profile pictures)

If you upload files, the Service stores them either:

• On the local filesystem of the server (default: under a data/ directory), or
• In S3-compatible object storage, if configured by the Service Operator

Depending on configuration, uploaded files may be publicly accessible. The Service Operator is responsible for selecting appropriate access controls for uploads.

API keys created in the Service

If the Service Operator enables API key functionality, the Service can store:

• API key metadata and rate limit counters
• The API key value itself (as stored by the Service)

Local-only preferences and settings

Some settings are stored on your device:

• Cookies: UI preferences such as theme and locale
• Local storage: some client-side state and, if you enable AI features, your AI provider configuration and API key may be stored in your browser's local storage

These local-only values are stored in your browser and are not necessarily transmitted to the Service Operator unless you choose to use related features.

Data Storage

All user data (account information, resume content, purchase records, and related metadata) is stored in a PostgreSQL database operated by the Service Operator. The database is hosted on secured infrastructure with access restricted to authorized personnel and services only.

Uploaded files (such as profile pictures) are stored either on the server's local filesystem or in S3-compatible object storage, depending on deployment configuration.

How We Use Information

We use the information above to:

• Provide and operate the Service (account access, resume editing, storage, sharing)
• Authenticate users and prevent abuse/fraud (sessions, security logs/metadata)
• Generate PDFs and screenshots you request
• Maintain basic functionality such as localization and theme preferences
• Provide support and respond to user requests (if you contact the Service Operator)

Cookies and Similar Technologies

The Service uses cookies primarily for functionality:

• Authentication cookies: to keep you signed in
• Preference cookies: theme (theme) and language (locale)

The Service does not include built-in behavioral advertising or third-party analytics by default.

Sharing and Third Parties

We do not sell, rent, or trade your personal data to any third party. We share information only as needed to provide the Service:

PDF generation and screenshots (Printer)

When you export to PDF or request a screenshot, the Service sends a request to a configured printer endpoint (a headless Chromium browser) to render a resume URL. Depending on your deployment, the printer may be self-hosted or operated by a third party.

Storage providers (optional)

If configured, uploaded files may be stored in an S3-compatible provider. In that case, the storage provider processes and stores file data on behalf of the Service Operator.

OAuth providers (optional)

If you sign in via OAuth (Google/GitHub/custom), those providers receive authentication requests and return profile information to the Service, as permitted by your provider settings.

AI providers (optional, user-supplied)

If you enable AI features and provide your own API key, prompts and generated content may be sent to your selected AI provider (OpenAI, Google, Anthropic), according to your use of those features and the provider's policies.

Data Retention

Retention depends on the Service Operator's configuration and your actions. As a baseline:

• Account data and resumes are retained until you delete them (or your account is deleted).
• Session and security data may be retained as needed for authentication and security.
• Uploaded files are retained until deleted (for example, when you remove a picture or delete a resume/account).
• Cached screenshot artifacts may be retained briefly for performance.

The Service Operator may also retain backups and logs for limited periods.

Security

We take reasonable measures to protect data (authentication, access controls, and storage separation). No method of transmission or storage is 100% secure; you should use strong passwords and enable 2FA/passkeys where available.

International Transfers

If the Service Operator (or its vendors) stores or processes data in other countries, your information may be transferred internationally. The Service Operator is responsible for providing appropriate safeguards where required by law.

Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, export, or restrict processing of your personal data. You can often exercise these rights directly in the Service (for example, by editing or deleting resumes), or by contacting the Service Operator.

Children's Privacy

The Service is not intended for children under the age of 13 (or the minimum age required in your jurisdiction). If you believe a child has provided personal data, contact the Service Operator.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

Contact

For privacy requests or questions, contact:

• Service Operator: Transform Resume Team
• Email: hello@transformresume.com