Privacy Policy

This policy explains what maxcv.ai (operated by Coder AI) collects, stores and — just as importantly — what it never does with your data. It covers the maxcv.ai and maxcv.pl websites and web apps and the "MaxCV.ai – Resume Tailor & ATS Optimizer" Chrome Extension.

The short version

Contact details are masked first. Your name, email, phone and links, including social profiles, are detected on our own server without any AI model and replaced with placeholders before the models that analyze and tailor your CV. Detection is automatic and can miss things (section 2.1). In our database they are kept only in an encrypted vault for each record.
AI providers do process your CV. The rest of your CV content goes to the providers in section 4, and an uploaded PDF goes in full, contact details included, through OpenRouter to read its text before masking happens. A Word (.docx) file is read on our own server and is not sent to a model for extraction.
We don't keep the original file or the PDFs we generate, only the text and results described below.
As a guest, your tailoring run is stored on our servers for up to 7 days: your CV, the tailored result and interview kit, the score summary and — only if you enter it — your email address (encrypted). Your browser only shows the score numbers, not the tailored CV. If you enter your email, we use it only to send you that one result email (the PDF attached plus a one-time sign-in link valid for 7 days; opening an expired or used link sends you a fresh standard sign-in link instead) — no marketing. Opening the link moves the run into your account (an account is created if you have none; for an existing account only the match is added) and erases the CV, result and email from the guest run. Runs nobody claims are deleted by a daily cleanup after 7 days. If you instead request a sign-in link or sign in yourself, your CV is kept until that link is used or expires (deleted within about an hour after expiry at the latest); signing in attaches it to your account.
When you sign in, we keep your master CV so you don't have to re-upload it for every job, plus your tailored results, including cover letters — until you delete them from the active database. Deletion is self-serve and takes one click; the backup retention described below still applies.
Cover letters and the posting excerpt. Up to the first 8,000 characters of the job posting are stored with the match and are deleted with it. Your contact details (name, email, phone and links) are masked before the letter is generated, so the model does not receive them. This masking covers your data, not the posting: anything else the excerpt contains, such as a recruiter's contact details, stays as written.
We never train AI models on your data and never sell it. We use Google Analytics only to count visits, sign-ups and purchases — it never receives your CV, job texts, email or name.

1. Who we are

maxcv.ai is built and operated by Coder AI (a brand of 2Dynamic Games sp. z o.o., Wadowicka 7, 30-347 Kraków, Poland, EU VAT PL5272716666). For anything related to this policy or your data, contact us at support@coderai.dev.

2. What we store, and for how long

Data	Who	Where	How long
CV + job text (guest use), with contact details masked and sealed in an encrypted vault	Guests	Our database (Cloudflare D1, guest runs), with the email address — only if you enter it — encrypted	Up to 7 days, then deleted by a daily cleanup; when you open the emailed link the run is moved to your account (rows below) and its CV, result and email are erased from the guest run. If you request a sign-in link yourself, your CV is kept until that link is used or expires (deleted within about an hour after expiry at the latest)
Master CV (structured data and the extracted CV text, with contact details replaced by placeholders; the real values are in an encrypted vault for that record)	Signed-in users	Our database (Cloudflare D1)	Until you delete it from the active database — Settings → "Delete stored CV" (`DELETE /api/cv`) or by deleting your account (`DELETE /api/account`)
Original uploaded file and generated PDFs	Everyone	Not stored by us. The file is held in memory while we read it; a PDF is generated when you download it, or for the one guest result email (where it stays in your mailbox)	Not kept after the request
CVs sent through the public MCP trial	AI agents and their users	Not saved in our database. A call log holds the IP address, client, tool, input lengths and outcome, not the content	Call log: up to 30 days
CV and job text sent to the web ATS test (`POST /api/score`)	Guests and signed-in users	Content is not saved in our database or your browser. It is processed for that request and goes to the AI providers in section 4 with contact details masked. One exception: an uploaded PDF goes whole, contact details included, to the model that reads its text (section 2.1). We keep a rate-limit counter keyed by IP address (signed in: by account) and a usage record with the time, operation, outcome and model, plus your account id when signed in, not the content or the IP address	Content: not kept after the request. IP counter: expires after about 2 hours and is removed by the next daily cleanup, so up to about 26 hours. Account counters: expire after up to about 8 days and are removed the same way, so up to about 9 days. Usage record: no fixed expiry; the account id is removed when you delete your account
Job descriptions sent from the Chrome extension	Extension users	Server-side hand-off store	~15 minutes, then they expire
Tailored CVs, interview kits & cover letters	Signed-in users	Our database (Cloudflare D1), masked, with an encrypted vault for each match	Until you delete them from the active database — per match (Delete in the match menu) or by deleting your account
Tailored CVs, interview kits & cover letters	Guests	Our database (Cloudflare D1, guest runs), masked, with an encrypted vault; not shown in your browser — only the score numbers are	Up to 7 days, then deleted by a daily cleanup — or until you open the emailed link, which moves them to your account
Job posting excerpt (up to the first 8,000 characters)	Guests and signed-in users	Stored with the match or guest run (Cloudflare D1)	Deleted with the match or guest run, on the schedules in the two rows above
Account data (email, stored encrypted; credit balance, passkey public keys, payment references)	Signed-in users	Our database (Cloudflare D1)	Until you delete your account from the active database. Payment records are the exception: they stay without the link to your account (section 6)

Deleting data removes it from the active database. Cloudflare D1 Time Travel is always on and may retain a recoverable earlier database state for up to 30 days on a Workers Paid plan or 7 days on a Workers Free plan. After that recovery window, those restore points expire under Cloudflare's retention rules. A database restore during the window may bring deleted records back; we must reapply affected deletion requests after any restore. See Cloudflare's Time Travel documentation.

We do not save CV text, structured CVs, filenames or tailored results in browser localStorage. A signed-in master CV and match history are loaded from your authenticated account; switching accounts or signing out clears the previous tab state. Provider processing is described below.

2.1 How contact details are protected

Masking. After the text of your CV is available, our server detects your name, email addresses, phone numbers and links using fixed rules, without any AI model. It replaces them with placeholders such as [EMAIL_1] before the models that analyze and tailor your CV. For well-known profile sites the site name stays visible, for example github.com/[LINK_1]. Your real details are put back in your result on our server.
Limits of masking. Detection is automatic and can miss things: an inflected surname, a first name on its own, some bare domains, or unusual phone formats. If your name is not detected locally, the first steps (content check, role pre-check and CV parsing) can see it. Please do not rely on masking alone for anything you would not want processed.
PDF uploads. To read a PDF we send the whole file, contact details included, through OpenRouter, with zero data retention required. This happens before masking. We no longer call OpenAI directly. A Word (.docx) file is read on our own server, with no AI model, and text you paste or upload as TXT goes straight to masking. Job postings are not masked.
Encryption at rest. Saved CVs and matches hold placeholders. The real contact details are in a separate AES-GCM encrypted vault for each record, tied to that record, and are decrypted only on demand, for example when you open your CV or download a result.
What masking is not. Your CV is not anonymized: the rest of its content, such as your employers and experience, stays readable to the AI providers in section 4.

3. What we never do

We never train AI models — ours or anyone else's — on your CVs, job descriptions or personal details.
We never sell or rent your data or share it with recruiters. Apart from legal obligations, sharing is limited to the providers described in section 4 for operating the service and, only with your marketing consent, measuring our ads. This consent-based measurement can send browser-hashed contact information to OpenAI for conversion matching, as explained in section 4.
We never send marketing email. The emails we send are transactional, such as sign-in links, the guest result email and the purchase confirmation.
We show no ads, and Google Analytics (see section 4) never receives your CV, job texts, email or name.

4. Processors we rely on

To provide the service, the following processors handle parts of your data under their own security commitments:

Cloudflare — hosting, database (D1), PDF rendering (Browser Rendering), bot protection (Turnstile) and cookieless, aggregate visit statistics (Cloudflare Web Analytics on all maxcv.ai pages, including sign-in token pages; no cookies or identifiers).
OpenRouter and the model providers it routes to — transient LLM processing of your CV (with contact details masked as described in section 2.1) and the job text to produce the tailored result and the cover letter. An uploaded PDF goes in full, contact details included, through OpenRouter for text extraction, currently to an OpenAI model hosted on Microsoft Azure. Every OpenRouter request, PDF extraction included, requires Zero Data Retention routing and denies data collection, and fails if no compliant endpoint is available. We do not call OpenAI directly. These request controls do not guarantee that every provider retains no data: retention also depends on account configuration and provider policies. For example, Google models on Vertex, which we can use as fallbacks and for reading job postings, may keep prompts flagged by Google's safety classifiers for up to 90 days for abuse monitoring, and OpenRouter says it screens requests for child sexual abuse material and may retain flagged content. See OpenRouter ZDR.
TypeSafe (Jev) — when enabled, processes masked CV text and job text to validate document content, assess requirement coverage and check tailored claims against the original CV. TypeSafe is called directly, not through OpenRouter, and does not retain this data.
Stripe — payment processing and tax calculation. At checkout Stripe collects your billing address and, if you enter a VAT number, that number and your business name. These records stay with Stripe after you delete your account (section 6). We never see or store your card number.
Mailgun (EU region) — sends our sign-in emails and the one guest result email. That email contains your first name, results and the PDF of your tailored CV, contact details included. After a purchase it also sends a confirmation to your account email (or, if we cannot read it, your Checkout email) with what you bought, the amount, the date and, if you gave it, your withdrawal consent.
Google Analytics (Google Ireland Ltd.) — aggregate usage statistics on maxcv.ai and maxcv.pl, including the CV landing/workspace (app screens are reported only by their generic name, never by match, CV or account id). Analytics scripts do not run on sign-in token pages, even when consent is granted. It sets first-party _ga cookies with a random identifier. Page addresses are reduced to the page path and campaign tags before they are sent, and no email, name, account id, CV or job content is ever shared. Browsers that send a Global Privacy Control signal are not tracked; you can also block it with any tracker blocker or Google's opt-out add-on. Not used in the Chrome extension.
OpenAI Measurement Pixel — after you grant marketing consent, measures completed account registrations on maxcv.ai and maxcv.pl to attribute them to our ChatGPT ads. Our registration event contains no manually supplied user fields, CV or job content. The Pixel's automatic advanced matching may detect supported contact information on the page, normalize it, hash it with SHA-256 in your browser and send the hashes to OpenAI for conversion matching; the raw contact values are not sent through this matching feature. The Pixel receives the website origin and uses first-party __oppref cookies (30 days after an ad click identifier is captured) and __obref cookies (365 days, a random browser reference). Browser restrictions may shorten these lifetimes. It does not load before marketing consent, on sign-in token pages, in the Chrome extension, or when Global Privacy Control is enabled. Withdraw marketing consent in Cookie settings to stop measurement and remove these cookies. Registrations completed without consent are not sent later.

5. Chrome extension permissions

The extension extracts job postings from job boards and sends them to the web app. It requires:

activeTab & scripting: it only reads the content of the current tab when you explicitly trigger it, to extract the job description. It does not track your browsing history or read other tabs.
host_permissions: it communicates only with our API (https://maxcv.ai/*) to submit job postings and get a link back into the web app.
storage: chrome.storage.local is used only to track processing status ("processing", "ready", "error") for the badge — no personal data.
notifications: to alert you when a job posting is processed and ready.

5.1 Limited Use Disclosure — MaxCV Chrome Extension

The MaxCV browser extension collects: the content of the job posting on the page you are viewing (posting text and HTML, the page's title and URL) from linkedin.com, indeed.com, glassdoor.com, pracuj.pl, nofluffjobs.com, justjoin.it, rocketjobs.pl, theprotocol.it, bulldogjob.pl, or another job page you explicitly invoke it on; and, if you are signed in, your maxcv.ai account e-mail address. Collection happens only after your click and your explicit in-extension consent.

Our use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:

Allowed use. We use this data only to provide and improve the extension's single, user-facing purpose: tailoring your CV to the job posting you asked us to process, and keeping that feature reliable (error diagnostics). The job-posting content the extension sends is processed transiently and is deleted from our servers automatically approximately 15 minutes after processing; when you tailor your CV to it, up to the first 8,000 characters are stored with the resulting match and are deleted with it. We do not use it for analytics profiles, market research, or training general-purpose AI models.
Allowed transfer. We transfer this data only: (a) to service providers processing it on our behalf and under our instructions to deliver the tailoring feature (for example, the AI model provider that performs the analysis, acting as our processor); (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition, or asset sale, after obtaining your explicit prior consent. We never sell this data.
Prohibited advertising. We do not use or transfer data obtained through the extension for any advertising purpose. This includes personalized, re-targeted, and interest-based advertising. We do not use it for ad measurement or ad targeting of any kind.
Prohibited human interaction. We do not allow humans to read data obtained through the extension, except: (a) with your explicit prior consent for specific data (for example, when you ask our support team to investigate a problem); (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) after the data has been aggregated and anonymized, for internal operations.

Access: your stored master CV is returned to you by GET /api/cv (it's what the "My CV" view shows).
Rectification: upload a new CV — it replaces the stored one.
Erasure: self-serve, immediate — "Delete stored CV" in Settings removes your master CV; deleting a match removes that tailored result; deleting your account removes your account data, including tailored results, credits and passkeys. Payment records are the exception: we keep the amount, currency, status and Stripe references without the link to your account, and we do not delete your records at Stripe, so your email, billing address, business name and VAT number are kept with Stripe as needed for payment, tax and accounting obligations.
Portability: your CV data is available to you as structured data via the app.
Complaint: you may lodge a complaint with your local data-protection authority; we'd appreciate the chance to resolve it first at support@coderai.dev.

The rules for using the service are in the Terms of Service. Paid plans, for reference: Free (1 tailoring without an account + 3 after sign-up), 30-pack for $9 (no expiry), and Unlimited for $39 / 30 days (€9 / €39 on maxcv.ai in Europe, including Poland; 39 zł / 99 zł on maxcv.pl regardless of country). Payment data is handled by Stripe as described above.

7. Changes & contact

We review this policy actively and post any updates on this page with a new "Last updated" date. Questions, requests or concerns: support@coderai.dev.

Coder AI is a brand of 2Dynamic Games sp. z o.o., Wadowicka 7, 30-347 Kraków, Poland · EU VAT: PL5272716666
support@coderai.dev · Contact us