Resume Prune

Privacy Policy

Last updated: October 2, 2026

Resume Prune is operated by Jen Built It LLC, a US limited liability company organized in Illinois. Throughout this policy, "we," "us," and "our" refer to Jen Built It LLC. "Resume Prune," "the Service," or "the app" refer to the website at resumeprune.com and its subdomains.

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the rights you have. We've tried to keep it plain English. If anything is unclear, email privacy@jenbuiltit.com and we'll explain.

1. Who we are

Resume Prune is owned and operated by:

Jen Built It LLC
10800 S Lloyd Drive
Worth, IL 60482
United States
privacy@jenbuiltit.com

Jen Built It LLC is the "data controller" under EU and UK GDPR. The same entity is the "business" under California law.

2. What we collect

2.1 Free sample (no account required)

• Email address you submit on the Try it page so we can email you the rendered sample. We don't store the address itself. We store a one-way hash of it and the part after the @ (the email domain), which we use to enforce the free-sample limits.
• Resume text you paste or upload, and the job description you paste, for the duration of one request.
• Rendered output (the pruned resume + cover letter we generated), stored behind a private, unguessable link so you can revisit it. A daily cleanup job deletes the stored copy 30 days after it was made, and the link stops working then.
• Hashed IP address and the date of each free sample, used for rate-limiting and abuse prevention.

2.2 Pro / Sprint account

• Email address and a password hash (we use PBKDF2 with 100,000 iterations; the plaintext password never touches our database).
• Resume text you upload, and the structured version our system generates from it.
• Tweak history: each job description you've worked on plus the tailored resume + cover letter we produced.
• Usage counters: how many tweaks you've made this billing period.
• Subscription metadata: your Stripe customer ID, subscription ID, status, and billing-event log. We do not store your card number, Stripe does that.
• Profile fields you choose to set: target role, target industry.
• Email-verification status and account-creation date.

2.3 Automatically collected

• Cloudflare edge logs: request URL, timestamp, your IP, user agent, and response status. Held by Cloudflare under Cloudflare's privacy policy. We don't store these ourselves. They're operational.
• Rate-limit records: to block abuse, we log each request to sensitive actions (like logging in, signing up, or generating a sample) with a timestamp and a key. For most actions the key is a one-way hash of your IP address, never the address itself. For some it's your account ID or a hashed email. A daily cleanup job deletes these records once they're more than 2 days old.
• Sign-in security log: when someone logs in, fails a login, changes or resets a password, or deletes an account, our server writes one line with the type of event, the time, a one-way hash of the IP address, and either the account ID or a one-way hash of the email typed in. It never holds a password, a raw email, or a raw IP. These lines sit in Cloudflare's Workers Logs, which keeps them for up to 7 days.
• Auth session cookie: one cookie named rp_session (HttpOnly, Secure, SameSite=Lax). Holds a signed JWT. Used only to keep you logged in.
• Feedback widget: if you're logged in and press Send on the in-app feedback widget, we receive your message, the type you picked (bug, idea, or other), the page URL you sent it from, your browser's user-agent string, and your email only if you typed it in. See n8n and Airtable in Section 4.

3. Why we collect it (purposes and legal basis)

For visitors in the EU, UK, or anywhere else with GDPR-style law: each thing we collect maps to a specific legal basis.

We do not use your data for any automated decision-making that produces legal or similarly significant effects (GDPR Article 22). The AI helps you write; it does not judge you, score you, or decide anything about you.

4. Who else handles your data

We use a small number of service providers to run Resume Prune. This list covers each one, what it gets, and why.

Anthropic does not train its models on your resume. Our use of the Claude API is governed by the Anthropic Commercial Terms of Service, which prohibit training on customer inputs.

We do not sell your personal information to anyone. We do not share it with advertisers. We do not allow third parties to use your data for their own purposes.

5. International data transfers

Jen Built It LLC and the providers listed above are US-based companies. If you're in the EU, UK, or Switzerland, your data is transferred to the United States for processing. The third-party providers' own privacy policies, linked in Section 4, explain how they protect data they receive from outside the US.

6. How long we keep it

• Free-sample rendered output: deleted by a daily cleanup job 30 days after it was made. If you create an account with the same email and later delete it, your free samples are deleted along with it.
• Free-sample records (hashed email, email domain, hashed IP, date): kept so the free-sample limits (counted over 30 days) work, then deleted by the same daily job once they're 35 days old, or right away when you delete an account with that email.
• Rate-limit records: deleted by a daily cleanup job once they're more than 2 days old.
• Email verification codes and password-reset links: deleted when used, or by the daily cleanup job 7 days after they expire.
• Sign-in security log: kept by Cloudflare Workers Logs for up to 7 days, then deleted automatically.
• Account email, password hash, profile, stored resume, tweak history, gap fills, published resume pages, and payment events log: until you delete your account. When you do, they're deleted from our database right away.
• Stripe's records: Stripe keeps its own record of your payments under its own privacy policy.
• Email-opt-out records: kept indefinitely (in hashed form) so we honor your opt-out even if you sign up again later.
• Cloudflare edge logs: held by Cloudflare under its own retention policy. We don't store our own copy.
• Database restore history: our database host keeps an automatic restore history for up to 30 days (Cloudflare D1 Time Travel), so deleted data can stay in that history until it rolls off.

7. Your rights

Depending on where you live, you have some or all of these rights:

• Access, request a copy of everything we hold about you (GDPR Article 15; CCPA/CPRA "right to know"). Available right now: log in and click "Download my data" on your Account page.
• Rectification / correction, fix anything that's wrong. Available now: edit your profile fields, re-upload your resume.
• Deletion / erasure, have us delete your account and everything tied to it (GDPR Article 17; CCPA "right to delete"). Available now: the Delete Account button on the Account page.
• Portability, receive your data in a machine-readable format (GDPR Article 20). The same JSON export covers this.
• Object / restrict, tell us to stop using your data for a specific purpose (e.g. unsubscribe from product updates while keeping your account active). Available now: any marketing email has a one-click unsubscribe link.
• Withdraw consent, at any time, with no effect on the lawfulness of processing done before withdrawal.
• Lodge a complaint, you can complain to your local data protection authority (in the EU/UK) or your state attorney general (in the US). We'd appreciate the chance to fix the issue first, email privacy@jenbuiltit.com.

8. How to exercise your rights

The fastest path for most rights is the self-serve tools in your Account page. If you can't access those (e.g. you used the free sample but didn't create an account), email privacy@jenbuiltit.com from the email address you used.

We will respond within 30 days for GDPR requests and within 45 days for CCPA requests, in line with the legal deadlines. We may ask one or two questions to verify the request is really from you (so someone else can't request your data).

We won't charge you, retaliate, or change the price of the service because you exercised these rights.

9. Cookies, browser storage, and Do Not Track

Resume Prune sets one cookie: rp_session. It holds your signed login JWT. It's HttpOnly, Secure, and SameSite=Lax. It's strictly necessary to keep you logged in, so under EU ePrivacy rules it does not require consent.

Resume Prune also saves a few small items in your browser's local storage. They stay on your device, and they're needed for the app to work the way you'd expect:

• rp_try_resume: on the free Try it page, a copy of the resume you pasted, so you don't have to paste it again next time. It clears itself after 30 days, and we never read it from there. The Forget it link under the resume box deletes it.
• rp_aff_ref: the referral code from an affiliate link, if you arrived through one. It's sent with your checkout so the right affiliate gets credit. A companion key, rp_aff_ref_at, records when you clicked, and both are dropped 60 days after your last affiliate link click.
• rp_pending_plan: the plan you picked (Sprint or Pro) before creating an account, so checkout can pick up where you left off after you sign up or log in. It's removed once you head to checkout.
• rp_tour_done: remembers that you've finished or skipped the welcome tour, so it doesn't show again.
• rp_pdf_…, rp_pub_…, rp_questdone_…, rp_questhide_…: small flags (ending in your account ID) that remember you've downloaded a PDF, published a resume link, finished the first-week checklist, or hidden it, so the dashboard doesn't celebrate the same thing twice.

We do not set marketing cookies. We do not use Google Analytics or third-party tracking pixels. We use Cloudflare Web Analytics, which is cookieless. There is no consent banner because there are no non-essential cookies to consent to.

Do Not Track. Some browsers can send a "Do Not Track" signal. Resume Prune doesn't use advertising or tracking tools that follow you across other websites, so it works the same whether or not your browser sends that signal. We don't let any third party collect information about your activity on Resume Prune to track you across other sites over time.

10. Children

Resume Prune is not intended for users under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us their data, email privacy@jenbuiltit.com and we will delete it.

11. How we protect your data

We follow standard security practices for a small SaaS:

• All traffic is encrypted in transit (HTTPS with HSTS).
• All data is encrypted at rest by Cloudflare (D1) and Stripe (payment data).
• Passwords are hashed with PBKDF2 (100,000 iterations, per-user salt). The plaintext is never stored or logged.
• Sessions can be globally invalidated on demand (every JWT carries a token version we can bump).
• We rate-limit all public endpoints and have automated rules for abusive traffic.
• We run a security regression scanner on every deploy that blocks common vulnerabilities from shipping.
• Access to production secrets is limited to the LLC owner; secrets are stored in Cloudflare's secret store, never in source code.

No system is perfectly secure. If we discover a personal-data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware (as GDPR Article 33 requires) and notify affected users without undue delay if the breach is likely to cause significant harm.

12. California residents (CCPA / CPRA)

If you live in California, you have additional rights:

• Right to know what personal information we've collected about you in the previous 12 months, same as our GDPR access right, fulfilled by the "Download my data" export.
• Right to delete, same as our deletion process.
• Right to correct inaccurate information, edit your profile or contact us.
• Right to opt out of "sale" or "sharing" of personal information, Do Not Sell or Share My Personal Information. (We do not sell or share personal information for cross-context behavioral advertising. This link is provided because California law requires us to provide it.)
• Right to non-discrimination, we won't charge you a different price or deny service for exercising any of these rights.

Categories of personal information we collect (CCPA labels)

• Identifiers: name (from resume), email, account ID, hashed IP.
• Customer records: payment metadata, email address.
• Commercial information: subscription history.
• Internet activity: pages visited within the app, feedback widget submissions.
• Professional or employment information: the resume content you upload.
• Inferences: none, we do not build profiles of you for ad targeting or any other purpose.

We do not collect: geolocation (beyond country-level from your IP), biometrics, genetic data, health information, sensitive demographic information, government IDs, or precise location.

Sources of personal information

Directly from you (the resume + email you submit), and from automated logging by Cloudflare when you visit the site.

Categories of third parties data is shared with

Service providers only, see Section 4. We do not share data with advertisers, data brokers, or analytics partners.

13. Changes to this policy

We update this policy when we change the way we handle data. The "Last updated" date at the top reflects the most recent revision. For material changes (new processor, new data category, new purpose), we will notify account holders by email at least 14 days before the change takes effect, and post a banner on the site.

For non-material changes (typo fixes, clarifications), we will just update the document and revise the date.

14. Contact

Questions about this policy, requests for your data, or anything privacy-related:

Jen Built It LLC
Attn: Privacy
10800 S Lloyd Drive
Worth, IL 60482
United States
privacy@jenbuiltit.com

We aim to reply within five business days for general questions and within the legal deadline for formal rights requests (30 days GDPR / 45 days CCPA).