1. Overview & Core Privacy Principles
Career OS is built with privacy-by-design principles. Your career history, work projects, compensation history, and personal contact information belong exclusively to you.
- Zero Data Monetization: We do not sell, rent, license, or monetize candidate data, resumes, or profile information to third parties or recruiters without explicit instruction.
- Strict Data Isolation: After the committed RLS migration is applied, resumes, workspace rows, and AI logs are readable only by the owning user. Admin reads require a service role key. Historical policies that used
OR true are removed in that migration.
- Right to Complete Erasure: Settings can export JSON and delete cloud rows for the signed-in user. Local IndexedDB purge is separate. Auth-user deletion requires a server service role. We do not promise deletion of model-provider logs held by OpenRouter, OpenCode, OpenAI, or iLovePDF.
2. Information We Collect
To deliver AI-assisted resume generation, ATS formatting, and job tracking, Career OS processes:
- Account Identifiers: Email address and unique authentication IDs from login (email/password, GitHub OAuth, or Google OAuth).
- Candidate Resume Data: Experience, titles, dates, achievements, education, certifications, and skills.
- Master Knowledge Base Records: Projects, evidence, claims, and imported LinkedIn work histories.
- THEA Interaction Logs: THEA prompts, reasoning traces, actions, model identifiers, latency, and token metrics for session persistence and diagnostics.
- Technical Telemetry: Essential logs, browser user-agent, error traces, and feature utilization.
3. How Your Information Is Used
- Generating, tailoring, and formatting ATS-compliant resumes in JSON, LaTeX, and PDF.
- Maintaining your Master Knowledge Base and LinkedIn import flows.
- Preserving multi-session THEA chat history.
- Evaluating ATS diagnostic readiness scores.
- Preventing abuse and securing the service.
4. AI Subprocessors & Inference Security
Career OS uses model providers (including OpenCode Zen, OpenRouter, and OpenAI) for generative drafting.
- Zero Training on User Data: Candidate resumes and prompts sent through official API routes are not used by those providers to train foundation models.
- Ephemeral Processing: In-flight prompt payloads are processed for the duration of inference.
5. Security & Storage Architecture
- Encryption in Transit & at Rest: TLS for web traffic; cloud databases encrypted at rest.
- Row Level Security (RLS): Owner-only policies are defined in
supabase/migrations/. Users cannot grant themselves admin via user_metadata.
- Local Fallbacks: The editor keeps IndexedDB/localStorage copies so you can work offline. That cache is not a substitute for cloud deletion.
- Telemetry: Optional analytics (and PostHog on some pages) run only after consent. Tracking does not store client IP.
6. Data Subject Rights & Contact
Under applicable privacy regulations (including GDPR and CCPA), you can access, rectify, export, and delete your personal data.
For privacy inquiries or erasure, use Settings → Export / Delete cloud account, email hello@kinetixsolutions.dev, or see Support.