Privacy Policy

Introduction

CheckATS ("we", "our", or "the Service") offers a free, browser-based resume scoring tool and a paid AI resume rewrite service. This Privacy Policy explains what information we handle for each part of the Service, why we handle it, and how we protect it.

The Service has two modes with very different data flows. Please read the one you use.

Mode 1: Free ATS Score — Your Resume Never Leaves Your Device

The free score check — resume parsing, keyword matching, and scoring — runs entirely in your web browser. When you choose a PDF, DOCX, or TXT file, the text is extracted locally on your device and the scoring computation happens locally as well. In this mode your resume file, its contents, and the job description you paste are never uploaded to, transmitted to, or stored on our servers.

Mode 2: AI Rewrite — Text Is Sent to Us and to AI Providers

When you use a purchased rewrite pack or an existing subscription for AI rewriting, the flow is different:

1. What is sent. The extracted text of your resume, the job description you provide, and the keyword list from the score check are sent to our server (hosted on Cloudflare) so the rewrite can be performed.
2. Content review. Before AI rewriting, the text is reviewed by our content-safety provider (SeeAPI) to block prohibited content. Its handling of that text is governed by its own privacy policy and terms.
3. AI processing. The reviewed text is sent to our AI provider (Kie.ai) to generate your rewritten resume and change summary. Your resume text is used only to produce your result.
4. What we store. For each rewrite we store a request record: your account ID, the plan and model used, a cost or conservative reservation figure, the status of the request, the rewritten resume, the change summary, and a timestamp. We keep this so the feature works (e.g. returning your result if the same request is retried) and for cost accounting.
5. Retention and deletion. Rewrite records are kept while your account exists. You can request deletion of your rewrite history or your entire account at any time (see Contact Us) and we will delete it.

If you use the profile photo upload or attach images to support tickets, those images are stored in our object storage (Cloudflare R2) after passing an automated content check.

Account and Billing

When you create an account with Google sign-in we store your email address and, if provided, your name. Google OAuth tokens are stored encrypted. When you buy a pack, we record the order, remaining rewrite allowance, reservations, usage and expiration. For existing subscriptions we retain the plan, period and state. These records let us deliver purchases, return failed reservations and reconcile refunds without duplicate charges. Payments are processed by Stripe; we never receive or store your full card number or card security code. Stripe processes your payment details under its own privacy policy.

Usage Data and Cookies

Essential cookies keep you signed in and remember your language preference. See our Cookie Policy for details.

Google Analytics 4 is optional and stays off until you select Allow analytics. It measures visits to public pages and a limited set of product milestones (such as completing a check). Events may contain a file-format label, checker mode and score-version label, but never resume text, job-description text, filenames, account IDs, email addresses or document identifiers. Query strings and URL fragments are excluded from page locations; referrers are limited to their origin. Account, admin, authentication and payment pages are excluded from our page tracking.

If you opt in, Google processes usage and device/browser information and sets analytics cookies, configured here to expire after 30 days without automatic renewal. We do not enable advertising personalization, Google signals or optional account data sharing with Google. Google's processing is described in How Google uses information. You can reject analytics or withdraw consent using Analytics preferences at the bottom of public pages; the checker remains available. Your choice is stored locally in this browser. Blocking cookies or scripts may prevent measurement.

If you explicitly turn on the optional resume-draft retention control, the extracted resume text, JD text, and filename are kept in this browser tab's sessionStorage for up to 30 minutes so you can recover an interrupted edit. The control includes a clear action and expired drafts are removed; this data is not uploaded by the free checker. You can leave retention off and clear it at any time.

Service Providers

We do not sell or rent personal information. To run the Service we use these processors, each bound by its own privacy terms:

• Google Analytics — optional, consent-based usage measurement
• Cloudflare — hosting, database (D1) and object storage (R2)
• Stripe — one-time payment processing and existing subscription billing
• SeeAPI — automated content-safety review of rewrite input and uploaded images
• Kie.ai — AI processing for the rewrite feature
• Resend — transactional email (e.g. password reset)

Data Security

All traffic is encrypted with HTTPS. OAuth tokens and provider credentials we hold are stored encrypted at rest. Resume text in Mode 2 is used only to deliver the rewrite and its record; the most sensitive data in Mode 1 never reaches our servers at all.

Your Rights

You may request access to, correction of, or deletion of the personal information we hold about you — including your rewrite history — by contacting us at the address below. You may also cancel your subscription at any time from your billing settings.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date at the top of this page.

Contact Us

Questions or requests about this Privacy Policy: hello@checkats.app