Privacy Policy
What FreeCV.org collects, who receives it, how long we keep it, and how to delete it. This policy covers the website, the Android app and the iPhone app.
Last Updated: 18 September 2026The short version
You can build a CV without an account, and while you do, it stays in your browser. When you sign in, download a PDF, or use an AI feature, some of your information reaches our servers or a company that works for us. This page names every one of them, says what each receives, how long it is kept, and how to have it deleted.
Overview
FreeCV.org ("we", "our", "us") is a CV builder. This Privacy Policy explains what happens to your information when you use the website at freecv.org, the FreeCV app for Android, or the FreeCV app for iPhone and iPad. All three are the same service and share one account.
How much we hold depends on how you use it:
- Building without an account: your CV is kept by your browser, on your device. We do not have it.
- Downloading a PDF: the CV is sent to our server to be turned into a PDF, and a copy is archived. This happens whether or not you have an account. See What We Collect.
- Using an AI feature: the text or the photo that feature needs is sent to the AI provider named in AI Features.
- With an account: your email, your name, your saved CVs and cover letters and a few settings are stored on our servers and sync between the website and both apps.
We do not sell personal information. We do not use your CV to train AI models, and the providers we use are bound by their business terms not to train on data sent through their APIs.
What We Collect, How, and Why
Every category below is collected because you took an action that needs it. Nothing is collected in the background, and the apps contain no advertising or analytics tracker.
| What | How we collect it | What we use it for |
|---|---|---|
| Email address and display name | When you create an account, sign in with Google, or sign in with Apple. Apple may give us a private relay address instead of your real one, which works fine here. | To sign you in, to sync your CVs, and to send account email such as a sign-in code or a receipt. |
| Your CVs and cover letters | When you are signed in and save, edit or download one. | To store them for you and sync them between the website, the Android app and the iPhone app. |
| Account settings: your livelink.cv address, whether your public page is on, its theme, and whether your contact details appear on it | When you claim a link or change those settings. | To publish the page you asked for, in the way you asked for it. |
| Saved jobs in the job tracker | When you save a job. | To show your tracker on every device. |
| A copy of each PDF you download, the CV content behind it, the name on it, the email on the account or in the CV, the country and the IP address of the download | Every time a PDF is generated, with or without an account. | Support, because people ask us to recover a CV they lost, checking how our templates render, and detecting abuse of a free service. |
| Text you send to an AI feature: CV content, a job ad, a letter, an imported CV, chat messages | When you use that feature. | To produce the result you asked for, and to look into quality complaints. See AI Features. |
| The photo you pick for a headshot | Only when you use the headshot tool and choose a picture. | To generate the headshot. See Photos and Headshots. |
| Purchase records: your email, the amount, the currency, the date, the processor reference or store transaction id | When you buy PRO. | To give you PRO, send a receipt, handle refunds and chargebacks, and keep our accounts. |
| Crash and error reports | When the website or an app hits an error. | To find and fix bugs. Reports from the apps carry your account id so we can tell one person's crash loop from another. They carry no CV content. |
| IP address and usage counters | Each time you use an AI feature. | Rate limits. Without an account the counter is keyed to your IP address, with an account to your account id. |
| An email address you type at the download prompt | Only if you choose to type it. | To send the CV tips we offered. Every message carries an unsubscribe link. |
Our database and sign-in system are hosted by Supabase. Archived PDF copies are stored on Cloudflare R2. Both act for us and use your data for nothing else.
What we never collect
Card numbers, expiry dates and security codes never reach us. They go to the payment processor's own checkout page. We do not collect your contacts, your location, your photo library, your calendar, or what you do on other sites, and we do not record your screen or your keystrokes.
If You Do Not Sign In
You can use the builder without an account. While you type, the CV is saved by your browser on your own device, in local storage. We cannot read it.
- It stays on that device and syncs nowhere.
- Clearing your browser data removes it.
- The "Reset" button in the builder clears the current CV.
Two things still leave your device without an account. If you download a PDF, the CV is sent to our server to be rendered and a copy is archived, as described above. If you use an AI feature, that text goes to the AI provider. Everything else stays local until you sign in.
One more thing lives in that same local storage: if you arrived through an affiliate link (a web address ending in ?ref= and a name), the name is kept for 90 days so the person who referred you is credited if you buy. It is not a cookie, nothing about your browsing is recorded, and it is only ever sent if you actually pay.
AI Features
FreeCV uses two AI companies. Each receives only what its feature needs, and only when you use that feature.
- OpenAI, L.L.C. handles the text: the CV assistant chat, cover letters, the job match and ATS check, the recruiter review, bullet, skill and summary suggestions, the quantify helper, and the pages of a CV you import. It receives the CV text, the job ad or the letter for that request, and returns the result.
- Google LLC (Gemini API) receives the photo you choose for a headshot, and nothing else. See Photos and Headshots.
Both process this under their business API terms, which do not allow using your content to train their models.
Your choice, and how to withdraw it
- In the iPhone and Android apps: the app asks once, before the first request leaves the device, and names both companies. Nothing is sent until you agree. You can change your mind at any time in Settings, AI data sharing. With it off, the app blocks those requests and the AI features stop working, while the rest of the app keeps working.
- On the website: there is no separate switch. Choosing to use an AI feature is the choice, and not using it sends nothing. If you want us to stop processing your data for AI features altogether, email info@freecv.org.
We keep a log of AI requests, which includes the CV summary and job description behind a generated letter and your chat messages, so we can investigate quality complaints. Those logs are deleted with your account.
Photos and Headshots
A photo on your CV is optional. If you add one and never use the headshot tool, the photo stays inside your CV and goes where that CV goes: your device, and your account if you are signed in.
If you use the AI headshot tool, this is the path your photo takes:
- The photo is uploaded to our server.
- Our server passes it to FreeHeadshot.org, our own headshot service, run by the same company that runs FreeCV.
- FreeHeadshot sends it to Google (Gemini API), which generates the new image and returns it.
- The generated headshot is saved to your account so you can place it on your CV. FreeHeadshot keeps a copy of the generated image for quality and abuse checks.
The photo you upload is held only for as long as the request takes, and we do not store it afterwards. The generated headshot is stored until you remove it or delete your account. Deleting your account deletes the headshots generated from your photos.
The apps ask for a picture only when you choose one, through the system picker, which hands over that single image. Neither app asks for access to your photo library.
Third Parties
These are all of them, and what each one receives:
- Supabase, Inc.: hosts our database and sign-in. Holds your account, your CVs, your letters and your settings.
- Cloudflare, Inc.: serves and protects the website, and stores the archived copies of generated PDFs.
- OpenAI, L.L.C.: the text AI features. Receives the CV text, job ad, letter or chat message for that request.
- Google LLC (Gemini API): generates headshots. Receives the photo you chose.
- FreeHeadshot.org, run by the same company as FreeCV: performs the headshot generation and keeps a copy of the generated image.
- Stripe, Inc.: our payment processor on the web. Receives your email and your card details directly.
- Freemius, Inc.: backup payment processor, used only when Stripe is unavailable.
- PayPal: no longer offered. It still handles subscriptions bought through it before September 2026, and any refund on an older order.
- Apple App Store and Google Play: take the payment if you buy PRO inside an app and confirm to us that it is valid. We never see your card details.
- Functional Software, Inc. (Sentry): receives crash and error reports. App reports carry your account id, never CV content.
- Resend and ZeptoMail: deliver our email. They receive your address and the message.
- Google AdSense: ads on the website only, as described above.
- Google Fonts and script CDNs: deliver fonts and libraries to the website, and see the request, including your IP address.
Equal protection
Every third party named on this page is bound, by contract or by its own published terms, to protect your data to the same standard as this policy, to use it only to provide the service we asked them for, and not to sell it or use it for their own purposes. Where a provider offers a data processing agreement, we have entered into it. We do not share your data with anyone who does not meet that standard.
We may also disclose information when the law requires it, for example a valid court order, or to protect our rights or someone's safety. We would tell you unless we are legally prevented from doing so.
Payments
FreeCV is free to use and a free CV is never watermarked. PRO is optional: monthly, yearly, or a one-time lifetime purchase.
- On the web: Stripe, Inc. takes the payment. If Stripe is unavailable we fall back to Freemius, Inc.. We stopped taking PayPal payments directly in September 2026; subscriptions bought through PayPal before then still bill there.
- In the apps: the Apple App Store or Google Play takes the payment under its own terms. That subscription is managed in the store, not by us.
- Card data: entered on the processor's own page. Card numbers, expiry dates and security codes never reach FreeCV.org.
- What we store: your email, the amount, the currency, the date, and the processor reference or store transaction id. Enough to give you PRO, send a receipt, and handle a refund or a chargeback.
- Tax: where sales tax or VAT applies, the payment processor or the app store calculates and remits it.
- Their policies: Stripe, Freemius, PayPal, Apple, Google.
How Long We Keep Data
| Data | How long we keep it |
|---|---|
| Account, CVs, cover letters, settings, saved jobs | Until you delete the item or delete your account. Nothing expires on its own while the account exists. |
| AI request logs, meaning letter inputs and chat messages | Until you delete your account. |
| Generated headshots | Until you remove them or delete your account. |
| Share links and download records, including the CV behind them and the IP address of the download | 90 days, then they expire automatically. You can revoke a share link sooner from your dashboard. |
| Archived copies of generated PDFs | Kept for support and quality checks, not published anywhere. We delete them on request. |
| Usage counters for AI limits | Counted per hour and per day. A bucket stops being used when that hour or day ends, and holds counts only, never CV content. |
| Purchase records | As long as tax and accounting law requires, normally several years, and long enough to defend a chargeback. These survive account deletion, see below. |
| Email list entries | Until you unsubscribe. After that we keep only your address on a suppression list, so that we never email you again. |
| Crash and error reports | Kept by Sentry under its own retention schedule. We do not extend it and we do not copy them elsewhere. |
| Web server logs | Rotated and deleted within a few weeks. Kept for security and diagnostics. |
Deleting Your Data and Withdrawing Consent
Delete your account, yourself
- iPhone and iPad app: Settings, then Delete Account. You confirm by typing DELETE.
- Android app: Settings, then Delete Account, with the same confirmation.
- Website: your dashboard, under account settings, has the same Delete Account action.
The apps call POST /api/account/delete and the website's dashboard runs the same erasure through its own settings endpoint. Both use one shared routine, so all three platforms erase exactly the same things. It runs immediately: there is no email to send and no waiting for us to act.
What is erased: your CVs, your cover letters, the AI request logs holding your CV summary and job descriptions, your builder chat messages, your saved jobs, your notifications, your profile with its livelink address and portfolio settings, the share and download records tied to your email, the headshots generated from your photos, and the sign-in record itself. If you signed in with Apple, the app sends a fresh authorisation code with the request so that we can revoke the Sign in with Apple link at Apple.
What survives, and why: purchase records, because tax law requires a seller to keep records of a sale and because a chargeback can arrive months later. They hold your email, the amount and the processor reference, never your CV. Usage counters also stay, because they are counts with no personal content.
Subscriptions: deleting the account cancels a subscription we manage at the end of the period you already paid for. A subscription bought inside the iPhone or Android app is managed by Apple or Google, so cancel it in the App Store or Google Play as well, or the store will keep billing you.
Withdrawing consent
- AI data sharing: turn it off in the app under Settings, AI data sharing. Requests to OpenAI and Google stop at once.
- Advertising: Your Privacy Choices on the website.
- Email: the unsubscribe link in any message.
- Anything else: email info@freecv.org and say what you want stopped or deleted. This is a fallback, not the only route. We answer within 30 days, usually within a week.
You can also delete single items without deleting the account: a CV, a cover letter, a generated headshot, or a share link.
Your Privacy Rights
Wherever you live, you can:
- See what we hold: sign in and look, or ask us for a copy.
- Correct it: edit it in the builder, or ask us.
- Delete it: Settings, Delete Account, as described above.
- Take it with you: download your CV as a PDF at any time, as a Word file with PRO, and ask us for your account data in a machine-readable file.
- Object or restrict: tell us to stop a particular use, for example AI processing or email.
We do not make automated decisions that have legal effects about you. The AI features suggest wording and scores, and you decide what to keep.
Security
- Traffic to the website and from both apps is encrypted with HTTPS.
- Data in our database is encrypted at rest by Supabase, and access is limited to the accounts that need it.
- Rows are protected so that one account cannot read another account's CVs.
- We keep what we need and no more, which is why building without an account leaves almost nothing on our side.
No service can promise perfect security. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.
Operator Information
The website freecv.org and the FreeCV apps are operated by Outline Technologies LLC, a limited liability company registered in the State of Wyoming, United States. Outline Technologies LLC is the data controller for the personal data described here. The simplest way to reach the controller for any data, legal or policy matter is by email:
Operator Contact
Outline Technologies LLC
30 N Gould St, Ste R
Sheridan, WY 82801
United States
Email: info@freecv.org
Our servers are in the European Union and the United States, and the providers listed above may process data in the United States. Where personal data leaves the European Economic Area or the United Kingdom, we rely on the European Commission's standard contractual clauses or an equivalent safeguard offered by that provider.
For EU consumers, the European Commission provides an online dispute resolution platform at ec.europa.eu/consumers/odr. We are not obligated to and do not participate in alternative dispute resolution proceedings before a consumer arbitration board.
Your GDPR Rights
If you are in the EU, EEA, UK or Switzerland, the GDPR gives you these rights over the data described on this page:
| Right | What it means | GDPR |
|---|---|---|
| Access | Ask what we have on you and get a copy. | Art. 15 |
| Rectification | Fix anything we have on you that is wrong. | Art. 16 |
| Erasure (Right to be Forgotten) | Delete it all. Records we must keep for tax and accounting are the exception. | Art. 17 |
| Restriction | Pause our processing while we sort something out together. | Art. 18 |
| Portability | Get your data in a machine-readable format you can take elsewhere. | Art. 20 |
| Object | Stop us using your data for direct marketing or on the basis of legitimate interest. | Art. 21 |
| No automated decisions | Refuse decisions made purely by algorithm. We do not make those, but you have the right anyway. | Art. 22 |
| Withdraw consent | Revoke any consent you gave, at any time, with no penalty. | Art. 7(3) |
Our legal bases are: contract for running your account and the features you ask for, consent for AI data sharing in the apps, for marketing email and for advertising cookies, legitimate interest for security, abuse prevention and fixing bugs, and legal obligation for keeping records of a sale.
How to exercise any of these: email info@freecv.org with the subject "GDPR Request". Free of charge unless the request is repetitive or excessive. We answer within 30 days as required by Art. 12(3), and we will ask you to confirm your identity before we hand over or erase anything sensitive.
Not satisfied with our response?
You can lodge a complaint with your local Data Protection Authority. Germany: bfdi.bund.de. France: cnil.fr. Spain: aepd.es. Italy: garanteprivacy.it. UK: ico.org.uk.
California Privacy Rights (CCPA / CPRA)
California residents have specific rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. The categories we collect are listed in What We Collect: identifiers such as your email address, the CV content you write, commercial information about a purchase, and internet activity such as an IP address. We collect them from you, and we use them for the purposes named beside each one.
We do not sell personal information. We "share" it in the CPRA sense in one place only: Google AdSense on the website, for cross-context behavioural advertising. The apps show no ads.
You can:
- Know what categories of personal information we collect, where they come from, and who receives them
- Access the specific personal information we hold about you
- Delete your personal information, with the accounting exception above
- Correct anything inaccurate
- Opt out of sharing for advertising
- Limit the use of sensitive personal information
- Non-discrimination, so exercising a right never degrades your service
Opt out in 10 seconds
To opt out of sharing for advertising, go to Your Privacy Choices. We also honour the Global Privacy Control browser signal automatically, so if you have it turned on, you are already opted out.
For other rights, email info@freecv.org with the subject "CCPA Request". We verify identity by matching the email against our records. We respond within 45 days, extendable to 90 if the request is genuinely complex.
Children
FreeCV is a tool for job seekers and is not directed at children. Our Terms require you to be at least 13 years old. In parts of the European Union the age for agreeing to data processing on your own is 16, and below it a parent has to agree for you. We do not knowingly collect data from a child below the applicable age. If you believe a child has created an account, email info@freecv.org and we will delete it.
Changes to This Policy
We update this policy when the product changes. When we do, we change the "Last Updated" date at the top of this page. If a change affects your rights, we will say so clearly on the website and, where the law requires it, ask for your consent again.
Contact Us
Questions about this policy, or about anything we hold on you:
Get in Touch
Email: info@freecv.org
Post: Outline Technologies LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States
Or use our Contact Page.