Last updated September 2026 · plain-language summary first, full terms below
Skill extraction and the recruiter chat run on our own infrastructure. Your résumé and profile data are never sent to third-party AI providers or used to train any model.
Your profile stays private until you publish it. Once published, it's visible to anyone with your share link — and no one else.
Download your full profile as JSON or a formatted PDF whenever you like. Delete your account and we permanently remove your profile, skills, embeddings, files, and view logs.
Sign in with Google or GitHub over PKCE-secured OAuth. We never see or store a password.
Account data — your name, email, and avatar from the OAuth provider you sign in with (Google or GitHub). Profile content — résumés and documents you upload, or URLs you submit, plus the skills, experience, and projects extracted from them. Usage data — product events like profile creation or link shares, and aggregate analytics; we never log raw résumé text or scores to analytics. Technical data — IP address and request metadata used for security and rate limiting, plus a small set of strictly-necessary cookies for authentication. We do not use third-party advertising cookies.
We use your data to extract skills and build and host your profile and shareable link, and to power the recruiter chat on your public profile — grounded only in your own profile data. Skill extraction and the recruiter chat run on a self-hosted, local language model: your résumé and profile data are never sent to third-party AI providers, and are never used to train any model. Processing happens entirely on our own infrastructure. Two features work differently, and we disclose them precisely: if you take a skills assessment, your submitted answers (not your résumé) are sent to OpenAI to generate grading and feedback; and if you request learning-resource suggestions for a skill gap, only the skill name and target proficiency level (never your résumé, profile, or any personal data) are sent to Anthropic to search for relevant courses and articles.
We do not sell your data. A profile is private until you publish it; once published, it's visible to anyone with the share link. We use a small number of infrastructure processors — hosting, object storage, error monitoring, product analytics — under data-processing terms, and nothing beyond that.
Uploaded source files are deleted once your review package is confirmed. You can delete a profile yourself at any time from your account settings. Full account deletion is handled by request today: email privacy@skillshome.me and we will erase your account, profile data, and published links within 30 days, and confirm by email once it is done; a self-serve account-deletion flow is in development. Our internal product activity log — events such as profile creation or link shares — keeps entries for up to 180 days, and administrative and security audit entries for up to 400 days; older entries are deleted automatically. OAuth uses PKCE, sessions can be revoked immediately, uploads are malware-scanned, and secrets are kept server-side — no system is perfectly secure, but we apply layered safeguards throughout.
If you're in the EEA or UK, you have the right to access a copy of the personal data we hold about you, correct inaccurate data (or edit your profile directly), request erasure under the right to be forgotten, receive your data in a portable, machine-readable format, restrict or object to certain processing, and withdraw consent at any time. Our legal bases are your consent and our legitimate interest in operating a secure service; you can also lodge a complaint with your local supervisory authority.
For privacy questions or to exercise any of the rights above, email privacy@skillshome.me. We’ll post any changes to this policy here and update the date at the top.