Privacy Policy & Data Security

Last updated: July 30, 2026

100% Client-Side WebAssembly Architecture: Your uploaded resume and target job description are parsed directly inside your local browser instance (via PDF.js & Mammoth.js). No raw document files or personal contact details are ever uploaded to or stored on our servers.

1. WebAssembly Memory-Only Parsing Flow

When you drag and drop a PDF or Word document into ResumeMetric, text extraction occurs client-side using JavaScript and WebAssembly compiled binaries inside your browser's sandboxed memory. Once text extraction finishes, document binary buffers are immediately freed from memory upon tab closure.

2. PII (Personally Identifiable Information) Redaction

Prior to passing text for semantic AI match scoring, our engine automatically strips email addresses, phone numbers, and street address patterns locally. This ensures your private contact details are never transmitted over API endpoints.

3. Zero Server Storage & Database Retention

We operate zero databases, user account systems, or cloud storage buckets for candidate documents. We do not retain, build profiles from, share, or monetize candidate resume data under any circumstances.

4. Essential Session Cookies

We set a single hardened security cookie (__Host-ats_session) configured with HttpOnly, Secure, SameSite=Strict, and a 24-hour expiration. This cookie is used strictly for rate-limiting protection to prevent API abuse.

5. Third-Party Analytics & Contact

We use privacy-first Cloudflare Web Analytics to monitor aggregate traffic statistics (page views, browser types) without tracking individual visitors or using invasive tracking pixels. For privacy inquiries, technical audits, or data requests, open an issue on our official GitHub Repository.