Privacy and data handling
This page describes what this app actually does with your data. The app’s frontend code is served unminified from this domain, so every statement below can be checked against the running source.
What is sent, and where
- Your job posting, resume, and optional notes are sent over HTTPS to SkillSafe’s API (
api.skillsafe.ai) to generate the rewrite, and to its text-extraction endpoint when you upload a PDF or Word file. That is the only server this app talks to. - If you import a job posting by link, the fetch goes through the same API; the target site sees SkillSafe’s fetcher, not your browser.
- The page loads no third-party scripts, no ad trackers, and no analytics beyond the host platform’s. The browser’s content-security policy, visible in the response headers, restricts connections to SkillSafe domains.
What is stored, and for how long
- By default, results live in your own browser (localStorage). Clearing your browser data removes them.
- If you sign in, your run history additionally syncs to your SkillSafe account (capped at roughly 1 MB) so it follows you across devices. Deleting a run in the History panel deletes the server copy too; deletes can be undone briefly, then the data records are gone and only a small tombstone marker remains so other devices drop their copies.
- Guest use requires no account. A guest token is minted for your browser; it expires on its own.
What never leaves your device
- PDF and Word exports are generated in your browser — the export code makes no network requests. The finished files are never uploaded anywhere by this app.
- Your in-place edits to the document exist only in your browser (and in your synced history if signed in).
What this app cannot promise
- Model inference runs on SkillSafe’s platform using the AI provider you select; retention and training policies at the platform and provider level are governed by SkillSafe and its providers, not by this app. If your employment history is highly sensitive, treat that boundary as the one that matters.
- This page is a factual description of the app’s behavior, maintained by its publisher. It is not a substitute for the platform’s own policies.
Checking these claims
All frontend source is served from this domain unminified: the sync and deletion logic is in /cloud.js, the export code in /pdf.js and /docx.js, and the API calls in /sdk.js and /app.js. The API tutorial documents the same endpoints for scripted use.