Privacy Policy

Last updated: March 30, 2026

1. Data Storage

MyPDFCV is a client-side application. All resume data you create is stored exclusively in your browser's localStorage. We do not collect, transmit, or store your resume data on any server. We do collect anonymous usage analytics via PostHog (see section 8).

2. LinkedIn OAuth

If you choose to sign in with LinkedIn, we access only the following information through LinkedIn's OAuth API: your name, email address, headline, location, and profile photo. This data is used solely to pre-fill your resume and is stored only in your browser's localStorage. We do not retain your LinkedIn access token beyond the active session.

3. AI Processing

Our AI-powered text improvement feature runs entirely in your browser using open-source models (Xenova/flan-t5-small) via WebAssembly. No resume content is sent to external servers for AI processing. The AI model is downloaded once and cached locally in your browser.

4. Document Import

When you import a PDF or DOCX file, the document is processed entirely in your browser. We do not upload, transmit, or store your uploaded documents on any server. The file is read into memory, text is extracted to populate your resume fields, and the original file data is immediately discarded. No copy of your uploaded document is retained.

5. GDPR Compliance (EU/EEA Users)

If you are located in the European Union or European Economic Area, the following applies under the General Data Protection Regulation (GDPR):

  • Data controller: Wesley Ramalho. For inquiries, visit www.wesleyramalho.com/contact.
  • Legal basis: Consent. You choose to use the service and provide information voluntarily.
  • Data processed: Only the resume content you type or import. All data is stored in your browser's localStorage and is not transmitted to our servers.
  • No cross-border transfers of personal data: Your resume data is not transferred to any server. Anonymous usage analytics are sent to PostHog's servers in the United States but contain no personally identifiable information. The optional LinkedIn OAuth flow is governed by LinkedIn's own privacy policy.
  • Your rights: You have the right to access, rectify, erase, restrict processing, object to processing, and port your data. Since all data is stored locally in your browser, you can export as PDF (access & portability), edit directly (rectification), or clear localStorage (erasure).
  • No automated decision-making: We do not use your data for automated decision-making or profiling. The AI text improvement feature generates suggestions that you manually review and accept or reject.

6. CCPA Compliance (California Users)

If you are a California resident, the following applies under the California Consumer Privacy Act (CCPA):

  • We do not sell personal information. We do not share personal information with third parties for monetary or other valuable consideration.
  • We do not collect personal information on our servers. All resume data is stored in your browser's localStorage only. Anonymous usage analytics (no PII) are collected via PostHog.
  • Right to delete: You can delete all data at any time by clearing your browser's localStorage or removing individual resumes from the dashboard.
  • Right to know: The categories of information processed are limited to resume content you voluntarily create (name, contact details, work history, education, skills), stored locally only.

7. Children's Privacy

This service is not directed at children under 13 years of age (COPPA) or under 16 years of age (GDPR). We do not knowingly collect personal information from children. Since all data is stored locally in the user's browser and not transmitted to us, we have no means to identify the age of our users.

8. Analytics & Tracking

We use PostHog, a product analytics service, to collect anonymous usage data such as which features are used, pages visited, and general interaction patterns. No personally identifiable information (names, emails, resume content) is included in analytics events. All analytics profiles are anonymous, your IP address is not stored, and we respect the Do Not Track (DNT) browser setting. Analytics data is sent to PostHog's servers in the United States. You can disable analytics by enabling Do Not Track in your browser settings. We use localStorage for saving your resume data, theme preference, and PostHog's anonymous session data. See our Cookie Policy for more details.

9. Contact

For privacy-related inquiries, please visit www.wesleyramalho.com/contact.