Privacy Policy

Last updated: 2026-07-02

Recanon ("zmresume," "we," "us") operates the zmresume résumé platform. This policy explains what we collect, how we use it, and the choices you have. Questions: mo@recanon.com.

1. Information we collect

Account & identity. When you sign up we store your name, email address, and (if you sign in with Google or GitHub) your profile image. We record whether your email is verified. If you sign in with Google or GitHub, we receive and store the OAuth tokens needed to authenticate you.

Résumé content. The information you add to your Full Source résumé and its variations — work history, projects, skills, education, and anything else you enter or import. If you import a file (PDF, DOCX, or pasted text), we process its contents to build your résumé.

Optional integration tokens. If you connect a GitHub personal access token to display live data (such as commit counts), we store it encrypted at rest.

Usage & security logs. We log request metadata — IP address, browser user-agent, and referring page — to operate and secure the service and prevent abuse. A viewer's IP address is used only for security and abuse-prevention: access is restricted to authorized security personnel, it is not shown to résumé owners or other users, and it is never sold or shared. When someone views one of your public or shared variations, your view analytics show you the view — the access method, referring page, and (for signed-in viewers) their email — but not the viewer's IP address. Each login session also stores its IP address and user-agent.

Access requests. If someone requests access to a private résumé, we collect the email, name, company, purpose, and message they provide, along with their IP address, and send it to you.

Security telemetry. We collect limited security data such as content-security-policy violation reports and rate-limiting signals to protect the service.

2. How we use your information

To provide the service (host your résumé, render variations, manage sharing and access); to authenticate you and secure your account; to send you transactional email; to power AI features you invoke; to show you analytics about who viewed your shared résumés; and to protect the platform from abuse. We do not sell your personal information, and we do not use your résumé content for advertising.

3. AI processing

zmresume uses Anthropic's Claude models to parse imported résumés, refine and tailor variations, and power the in-app assistant. When you use these features, the relevant résumé content is sent to the AI provider (Anthropic, accessed directly or via the Vercel AI Gateway) to generate the result. This processing happens only when you invoke an AI feature. The AI provider processes this content under its own terms; we do not use your résumé content to train AI models or for advertising, and it is sent only to produce the output you requested. Avoid pasting secrets (like access tokens) into the assistant, as your conversation is saved to your account.

4. Service providers (subprocessors)

We share data with vendors who process it on our behalf, only to run the service:

If you use GitHub live-data fields, we fetch from the GitHub API using your token. If you use NitroType live-data fields, we fetch your typing stats through our own NitroType integration, governed by its own NitroType integration terms (forthcoming). Both fire only when you configure those fields.

5. What is public, and what is private

Your Full Source résumé is never public. A variation becomes viewable by others only when you create an active share for it — a public link, an email invite, a passphrase, or a trusted link — and you can revoke any share at any time. When a variation is shared, its content and live edits are transmitted in real time to people viewing it (including anonymous visitors of a public link). Your variations' internal nicknames are never shown publicly.

6. Cookies

We use cookies that are strictly necessary to run the service: a session cookie to keep you signed in, and a visitor cookie (zmr_vis) that remembers when a browser has unlocked a passphrase- or link-protected résumé (retained up to two years). We do not use third-party advertising or cross-site tracking cookies.

7. Retention & deletion

We keep your data for as long as your account is active. Deleted résumés and items are removed from view immediately and purged thereafter. From your account settings you can export your résumé, variations, and account data as JSON at any time, and permanently delete your account — deletion is confirmed by email, permanently erases your data, and cannot be undone.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise them, contact mo@recanon.com.

9. Children

zmresume is not directed to children under 13, and we do not knowingly collect their data.

10. Changes

We may update this policy; we'll revise the "last updated" date and, for material changes, provide notice.

11. Contact

Recanon — contact mo@recanon.com.