Last updated June 2026 · plain-language summary first, full terms below
Skill extraction and the recruiter chat run on our own infrastructure. Your résumé and profile data are never sent to third-party AI providers or used to train any model.
Your profile stays private until you publish it. Once published, it's visible to anyone with your share link — and no one else.
Download your full profile as JSON or a formatted PDF whenever you like. Delete your account and we permanently remove your profile, skills, embeddings, files, and view logs.
Sign in with Google or GitHub over PKCE-secured OAuth. We never see or store a password.
Account data — your name, email, and avatar from the OAuth provider you sign in with (Google or GitHub). Profile content — résumés and documents you upload, or URLs you submit, plus the skills, experience, and projects extracted from them. Usage data — product events like profile creation or link shares, and aggregate analytics; we never log raw résumé text or scores to analytics. Technical data — IP address and request metadata used for security and rate limiting, plus a small set of strictly-necessary cookies for authentication. We do not use third-party advertising cookies.
We use your data to extract skills and build and host your profile and shareable link, and to power the recruiter chat on your public profile — grounded only in your own profile data. Skill extraction and the recruiter chat run on a self-hosted, local language model: your résumé and profile data are never sent to third-party AI providers, and are never used to train any model. Processing happens entirely on our own infrastructure.
We do not sell your data. A profile is private until you publish it; once published, it's visible to anyone with the share link. We use a small number of infrastructure processors — hosting, object storage, error monitoring, product analytics — under data-processing terms, and nothing beyond that.
Uploaded source files are deleted once your review package is confirmed. You can delete a profile or your account at any time; deletion permanently removes your profile, skills, embeddings, stored files, and view logs. OAuth uses PKCE, sessions can be revoked immediately, uploads are malware-scanned, and secrets are kept server-side — no system is perfectly secure, but we apply layered safeguards throughout.
If you're in the EEA or UK, you have the right to access a copy of the personal data we hold about you, correct inaccurate data (or edit your profile directly), request erasure under the right to be forgotten, receive your data in a portable, machine-readable format, restrict or object to certain processing, and withdraw consent at any time. Our legal bases are your consent and our legitimate interest in operating a secure service; you can also lodge a complaint with your local supervisory authority.
For privacy questions or to exercise any of the rights above, email privacy@skillshome.me. We’ll post any changes to this policy here and update the date at the top.