Privacy
The CV editor processes your text in your browser. It does not upload CVs, send them to an AI model, or store them in a site account or database.
Editing and saving
Your CV and optional job notes are held in memory while the page is open. Reloading or closing the page can discard unsaved changes, unless you turn on “Keep this draft on this device”.
That switch is off until you turn it on. While it is on, the editor keeps your draft, including your job notes, in this browser’s own storage (localStorage) on this device, and updates it as you type, so it is still there when you come back; the cover letter builder can copy your name and contact from it when you ask. It is never sent to us or anyone else. Turning the switch off, or choosing “Clear from this device”, deletes it. On a shared or public computer, leave it off or clear it when you finish. The only other things the site keeps in browser storage are your light or dark theme, if you choose one, and your cookie choice, if you make one.
“Save draft” saves a draft file (.json) to your device containing both your CV and job notes. The notes are left out of the Word, text and print files. “Open draft” reads a file you choose on your device; it does not upload it. Word, PDF and text files are created on your device; making a PDF downloads its fonts from this site, and nothing you typed is sent. Where your phone or browser offers it, “Share PDF” hands the file to your device’s own share menu, and the app you choose sends it; it does not pass through us. A photo you add in the editor is cropped and resized on your device and kept only in your draft and the files you make; it is never uploaded. These files contain your personal information. Store and share them carefully, especially on a shared computer.
A browser or operating system may independently provide form suggestions, downloads history, print services or device backup. Those features are controlled by your own settings.
Analytics and cookie choices
We use Plausible and Google Analytics to understand which pages and tools are useful. Measurement includes page visits and actions such as choosing a template or downloading a file.
Tool events use fixed action categories. They do not include CV text, names, email addresses, job notes, draft contents or filenames. We send the page address without its query string or fragment.
Plausible counts every visit without cookies. It may receive browser and device information and a referring page.
Its reports are aggregate: page visits, referring pages, time spent and scrolling. It also receives your IP address.
Google Analytics is run by Google, which receives the page address, the actions we measure on this site and browser and device information, and sets cookies that tell repeat visits apart. Its advertising features are off.
In the European Union, Iceland, Liechtenstein, Norway, the United Kingdom and Switzerland, and whenever we cannot tell which country a visit comes from, Google Analytics loads only after you choose Accept on the bar at the bottom of the page. Decline loads nothing from Google. Your choice is kept in this browser for six months, then the bar asks again.
Elsewhere, Google Analytics loads with each page unless you choose Decline. Cloudflare, which delivers our pages, tells your browser which country the visit comes from.
Wherever you are, Cookie choices at the bottom of any page, or the button below, changes your choice. Decline stops Google Analytics on this site in this browser and deletes its analytics cookies. If analytics was running, the page reloads to apply your choice. Decline holds on every page; outside the countries above it is kept until you change it.
If you are in the UK, the EU or the EEA
This site is written for UK job applicants, so most readers are covered by the UK GDPR. We rely on legitimate interests to run Plausible’s aggregate, cookieless measurement of which templates and guides are useful. Google Analytics sets cookies, so in the UK, the EU and the EEA it loads only after you choose Accept, and Cookie choices lets you withdraw that at any time.
This site and our own copy of Plausible run on a server we rent in Germany, inside the EEA. Google LLC, which runs Google Analytics, receives connection information, including your IP address, when Google Analytics loads, and may process it in any country where Google or its subprocessors have facilities. Standard contractual clauses cover the transfers our providers operate under.
You can ask what we hold about you, ask for it to be deleted, or object to this measurement. We hold no account, no mailing list, no CV and no identifier for you, so unless you have sent us a report the practical answer is usually that there is nothing to return. Your CV text is the thing we most deliberately never receive. Use the contact page and we will answer.
If a display advertising network is ever added to this site, it will bring its own vendors and its own consent request, and this page will say so before that happens.
The other companies involved
Cloudflare routes and protects the domain, runs the security check on our contact form and keeps reports sent through it. Discord holds a copy of each report in a private channel our team reads. Plausible Analytics, our own copy, measures page visits. Google Analytics measures page visits and template actions when it is allowed to load, as above. Nobody else is involved: there is no advertising network, no affiliate network, no email provider, no comment system, no embedded video and no font service, because the typefaces are served from this domain.
The careers services we link to, such as the National Careers Service, Acas and Nacro, are ordinary links to public guidance. We earn nothing from them, and they learn nothing about you from us beyond the fact that you followed a link.
Our hosting service receives ordinary connection information needed to serve pages, such as your IP address and the requested address.
Contact messages
The contact form sends your report, your reply address, your name if you give one, and any page or source you add through Cloudflare, which runs an automatic security check that never asks you to solve anything.
We keep each report in our contact inbox at Cloudflare for 12 months, then it is deleted automatically, and a copy goes to a private Discord channel our team reads. We use your reply address only to answer you, never for marketing. To see or delete a report you sent, ask through the same form and we will delete both copies.
Cloudflare Turnstile checks for automated submissions and receives browser and connection information. Do not include passwords, payment details or other sensitive personal information in a report.
Do not submit your CV, identity documents or referee details in a contact report. Describe a problem using a fictional example.
Privacy or rights questions
Use Contact for a privacy or rights request when the form is available. There are no user accounts or server-side CV records to retrieve or delete.
Updated