Privacy Policy

Last updated: July 2026

This policy explains what maxcv.ai (operated by Coder AI, Warsaw, Poland) collects, stores and — just as importantly — what it never does with your data. It covers the maxcv.ai website and web app and the "MaxCV.ai: Max Your CV!" Chrome Extension.

The short version

  • As a guest, we store nothing: your CV and the job posting are processed only to produce your result and are not persisted on our servers.
  • When you sign in, we keep your master CV so you don't have to re-upload it for every job — until you delete it. Deletion is self-serve and takes one click.
  • We never train AI models on your data, never sell it, and run no third-party analytics.

1. Who we are

maxcv.ai is built and operated by Coder AI, Warsaw, Poland. For anything related to this policy or your data, contact us at hello@maxcv.ai.

2. What we store, and for how long

DataWhoWhereHow long
CV + job text (guest use) Guests Processed transiently on our servers; results live only in your browser (localStorage) Not persisted server-side
Master CV (structured data including the full CV text) Signed-in users Our database (Cloudflare D1) Until you delete it — Settings → "Delete stored CV" (DELETE /api/cv) or by deleting your account (DELETE /api/account)
Job descriptions sent from the Chrome extension Extension users Server-side hand-off store ~15 minutes, then they expire
Tailored CVs & interview kits Everyone Only your browser (localStorage) Until you delete the match or clear your browser data — never on our servers
Account data (email, credit balance, passkey public keys, payment references) Signed-in users Our database (Cloudflare D1) Until you delete your account

3. What we never do

  • We never train AI models — ours or anyone else's — on your CVs, job descriptions or personal details.
  • We never sell, rent or share your data with recruiters, marketers or any other third parties.
  • We never send marketing email.
  • We show no ads and run no third-party analytics on the site.

4. Processors we rely on

To provide the service, the following processors handle parts of your data under their own security commitments:

  • Cloudflare — hosting, database (D1) and bot protection (Turnstile).
  • OpenAI & OpenRouter — transient LLM processing of your CV and the job text to produce the tailored result. Not used for model training.
  • Stripe — payment processing. We never see or store your card number.

5. Chrome extension permissions

The extension extracts job postings from job boards and sends them to the web app. It requires:

  • activeTab & scripting: it only reads the content of the current tab when you explicitly trigger it, to extract the job description. It does not track your browsing history or read other tabs.
  • host_permissions: it communicates only with our API (https://maxcv.ai/*) to submit job postings and get a link back into the web app.
  • storage: chrome.storage.local is used only to track processing status ("processing", "ready", "error") for the badge — no personal data.
  • notifications: to alert you when a job posting is processed and ready.

5.1 Limited Use Disclosure — MaxCV Chrome Extension

The MaxCV browser extension collects: the content of the job posting on the page you are viewing (posting text and HTML, the page's title and URL) from linkedin.com, indeed.com, glassdoor.com, pracuj.pl, nofluffjobs.com, justjoin.it, rocketjobs.pl, theprotocol.it, bulldogjob.pl, or another job page you explicitly invoke it on; and, if you are signed in, your maxcv.ai account e-mail address. Collection happens only after your click and your explicit in-extension consent.

Our use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:

  1. Allowed use. We use this data only to provide and improve the extension's single, user-facing purpose: tailoring your CV to the job posting you asked us to process, and keeping that feature reliable (error diagnostics). Job-posting content is processed transiently and is deleted from our servers automatically approximately 15 minutes after processing. We do not use it for analytics profiles, market research, or training general-purpose AI models.
  2. Allowed transfer. We transfer this data only: (a) to service providers processing it on our behalf and under our instructions to deliver the tailoring feature (for example, the AI model provider that performs the analysis, acting as our processor); (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition, or asset sale, after obtaining your explicit prior consent. We never sell this data.
  3. Prohibited advertising. We do not use or transfer data obtained through the extension for any advertising purpose. This includes personalized, re-targeted, and interest-based advertising. We do not use it for ad measurement or ad targeting of any kind.
  4. Prohibited human interaction. We do not allow humans to read data obtained through the extension, except: (a) with your explicit prior consent for specific data (for example, when you ask our support team to investigate a problem); (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) after the data has been aggregated and anonymized, for internal operations.

6. Your rights (GDPR / CCPA)

  • Access: your stored master CV is returned to you by GET /api/cv (it's what the "My CV" view shows).
  • Rectification: upload a new CV — it replaces the stored one.
  • Erasure: self-serve, immediate — "Delete stored CV" in Settings removes your master CV; deleting your account removes everything, including credits and passkeys.
  • Portability: your CV data is available to you as structured data via the app.
  • Complaint: you may lodge a complaint with your local data-protection authority; we'd appreciate the chance to resolve it first at hello@maxcv.ai.

Paid plans, for reference: Free (3 tailorings at sign-up), 30-pack for $9.99 (no expiry), and Unlimited for $39 / 30 days. Payment data is handled by Stripe as described above.

7. Changes & contact

We review this policy actively and post any updates on this page with a new "Last updated" date. Questions, requests or concerns: hello@maxcv.ai.