Privacy and data ownership

Your data lives only on your computer

Resumes, jobs, profile, reminders and assistant conversations all live in SQLite databases under the local data directory (portable and source builds: backend/data; Windows installer: %APPDATA%\ResumeForge\data), on your own machine. ResumeForge has no account system, no analytics or telemetry and no “our cloud”: the app never sends your resume data to a server we run, so there is no “server breach” surface.

Datasets switch as a whole: campus and experienced-hire searches can each keep their own data without mixing; each is a separate database file, and copying that file after stopping the app is a backup.

AI features run only when you call them

AI features such as resume generation, match analysis and the assistant need you to enter a provider endpoint and API key in Settings. Calls happen the moment you press the button, and what is sent is limited to what that task needs (generating a resume sends the job JD and your profile, for example); nothing is uploaded in the background on your behalf.

The assistant reads a redacted profile by default: identifying fields such as name, phone and email plus the photo are not sent with your question, and four tools that touch sensitive information are not offered. Only if you explicitly turn on relaxed mode (off by default, and the interface lists exactly what it unlocks before you do) does the assistant see your full profile, the real values written by web form filling and past conversations — that is the only switch of its kind, and in either mode credentials such as API keys, global configuration and photo content are never sent to the model.

The provider key is stored on this machine (encrypted with system-level DPAPI on Windows) and stripped from backup packages by default. You use your own key and requests go straight from your computer to the provider you chose, never through any server of ours.

You can take all your data with you at any time

Under Settings → Data and export, you can export the current dataset (or every dataset) as a .zip backup package, which the app's own import restores exactly on another computer. The data is yours: migrate it, back it up, share it with whoever you decide.

The diagnostic package for troubleshooting (Settings → Updates and help → Help and diagnostics) likewise contains only redacted runtime events, system information and the tail of recent logs — no resume data and no keys. It exists to paste into a bug report, not to move data out.

Delete it completely, whenever you want

To delete one dataset: remove it in Settings → Data and export. To remove everything: quit the app and delete the data directory (backend/data) — for portable and source builds the app is the project directory, so deleting it is a clean uninstall; for the Windows installer use the system uninstaller. Neither leaves a cloud copy.

When the app goes online

A privacy promise has to be checkable. These are all the situations in which ResumeForge goes online; there are no other network requests:

• The model API: when you configure it and call it yourself (generation, analysis, assistant conversations).
• Assistant web search: when you explicitly ask it to look something up, it fetches public pages for that question.
• Job capture and applying: no job site is contacted by default; the site is only reached when you explicitly configure a capture task or click start yourself in the apply desk.
• Checking for updates: querying GitHub Releases and downloading the update package, with SHA-256 verification.
• Preparing the runtime on first launch: when Python or Node.js is missing locally, the official installer or portable build is downloaded and checked against the SHA-256 pinned in the repository.

Integrity of update packages

Every in-app update package carries a matching .sha256 attachment, verified byte by byte before installation, which blocks truncation or substitution in transit; the download page gives the same guidance. The updater only overwrites program files, never touches the data directory, and takes a snapshot first (the three most recent pre-update snapshots are kept).