Privacy Policy

1. Who we are

CareerKit ("we", "us", "our") operates the free career tools at carrerkit.io. This policy explains exactly what data we handle when you use the site. By using CareerKit you agree to the practices described here.

2. What you type into the tools

To generate a result, the text you enter into a tool (for example resume text, a job description, or a description of an accomplishment) is sent to Google's Gemini API to produce the output you see. We do not save that text to our own database, and we don't attach it to any identity — there is no account to attach it to.

Google processes that input under its own terms and privacy policy. We use Gemini on a standard developer tier; treat anything you paste as being processed by a third-party AI provider, and avoid pasting information you wouldn't want processed by Google. Once the response is returned to your browser, it lives only in your browser tab — close it and it's gone unless you copied it out.

3. What we log (and for how long)

Because there are no accounts, the only thing we record to run the service is a minimal rate-limit log. Each time a tool is used we store:

• your IP address
• which tool was used
• a timestamp

We use this only to enforce the free per-IP daily limits and to see which tools are popular in aggregate. We do not store the content you entered alongside it. These logs are automatically deleted after 90 days. They're held in our database provider, Supabase.

4. Analytics & error monitoring

• Google Analytics — measures aggregate, anonymous usage (page views, which tools get used, device/browser). It sets cookies and receives your IP as part of standard web analytics. We never send it your resume content or any text you enter.
• Vercel Speed Insights — anonymous page-performance metrics only. No personal data.
• Sentry — collects technical error reports (what failed and where) so we can find and fix bugs. It is not used to store or analyse the text you enter into tools.
• Cloudflare Turnstile— a privacy-friendly bot check that runs when you use a tool, so automated abuse can't exhaust the free limits for everyone. It receives your IP and basic browser signals to tell humans from bots; it does not track you across sites and never receives the text you enter. It may be off unless bot protection is currently enabled.

5. Who we share data with

We do not sell your data. The only third parties involved are the infrastructure providers that make the site work:

• Google (Gemini API) — processes the text you enter to generate results
• Google Analytics — aggregate usage analytics
• Vercel — hosting, edge network, and performance metrics
• Supabase — the database holding the 90-day rate-limit logs
• Sentry — error monitoring
• Cloudflare — Turnstile bot protection on the tools

6. What we don't do

• We don't sell your data — to recruiters, data brokers, or anyone else.
• We don't share your resume or inputs with employers or recruiters.
• We don't build shadow profiles, fingerprint you, or enrich your data from other sources.
• We don't embed tracking pixels in anything you generate or export.
• We don't run retargeting ads (no Meta pixel, no LinkedIn Insight tag).

7. Cookies

We use analytics cookies set by Google Analytics. We don't use advertising or cross-site tracking cookies, and there are no login/session cookies because there are no accounts. You can block analytics cookies with a browser extension such as uBlock Origin or via the Google Analytics Opt-out.

8. Your rights

We hold almost no personal data about you — no account, no stored resume content — so there is very little to access, correct, or delete. The main personal data we touch is your IP in the rate-limit log, which is deleted automatically within 90 days. If you have a question or a specific request, email us at [email protected] and we'll help.

9. Children's privacy

CareerKit is not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we'll remove it.

10. Security

The site is served entirely over HTTPS. No method of transmission over the internet is 100% secure, so we can't guarantee absolute security — but by design we hold very little about you in the first place.

11. Changes to this policy

We may update this policy from time to time. Changes are reflected by updating the "Last updated" date above. Continued use of the site after a change means you accept the updated policy.

12. Contact

Questions about this Privacy Policy? Email [email protected] — we read every message.