Privacy Policy — RocketCV

RocketCV (“we”) is an invite-only TomorrowTools product operated for authenticated users. This page describes what we store and how to export or delete it.

What we collect

Account identity (email, name, auth tokens) for sign-in and allowlisting.
Resume text, job descriptions, analysis outputs, tailored drafts, session history, and optional Google Drive tokens you connect.
Durable recovery job records and bounded memory snapshots used to resume long AI operations.
Content you submit may be sent to the configured AI provider (default: local OpenClaw; remote only if the operator enables it).

How we use it

To provide ATS analysis, tailoring, PDF export, and related coaching features. Scores are coaching heuristics, not validated hiring predictions.

Storage and encryption

Product data is stored in SQLite files encrypted at rest with an operator key (DATA_AT_REST_KEY, SQLCipher-class page encryption). The database file is not readable as plaintext SQLite without that key. Protect the key like a production secret; losing it means losing access to the data. Android session tokens use EncryptedSharedPreferences (Keystore-backed). Content sent to a remote AI provider is subject to that provider’s controls.

Retention

Default: data remains until you export/delete it or an operator purges the host database. There is no separate marketing use of resume content. Operators may later configure automatic expiry of recovery snapshots; until then, deletion is user- or operator-driven.

Export and deletion

Signed-in users can download a ZIP of account-owned product data from Profile → Settings → Export (GET /api/account/export). Password hashes and Drive refresh tokens are omitted from exports. Erasure is available from Profile → Settings → Delete account (DELETE /api/account), which removes resumes, ATS sessions, recovery jobs, and memory snapshots. Browser drafts in local storage must be cleared in the browser separately.

Self-host / zero-egress

When self-hosting, set a local AI base URL and keep AI_ALLOW_REMOTE=false so prompts stay on your network. Use your own AUTH_SECRET and provider keys (BYOK). See the project README.

Contact

Support: [email protected]. Admin: [email protected]. Info: [email protected]. Pages: Support · Contact.