Privacy Policy

1. Who we are (Data Controller)

CrushingDigital, operator of More Than My Resume, is the data controller responsible for your personal information. You can contact us with any privacy question at team@morethanmyresume.com.

2. Information we collect

We collect the following categories of personal data:

• Account data — email address, password hash, display name, role (developer or business), and authentication identifiers from GitHub or LinkedIn when you sign in via OAuth.
• Developer profile data — bio, country, timezone, years of experience, desired rate, resume uploads, and work preferences.
• GitHub repository data — when you connect GitHub, we analyze public repositories you authorize to extract programming languages, commit patterns, and skill evidence. We store derived skill data and per-commit quality scores; we do not retain full source code.
• Business / employer data — company name, logo, job listings, skill requirements, and applicant notes.
• Application data — jobs you apply to, messages you send, and evidence votes.
• Waitlist data — the email address you submit to join our launch waitlist.
• Usage & device data — IP address, browser type, pages visited, and timestamps, collected via server logs and cookies.

3. How we use your data

We process personal data for the following purposes:

• To create and manage your account and authenticate your sessions.
• To match developers with relevant jobs and show businesses ranked applicants.
• To analyze connected GitHub repositories and produce skill-evidence profiles.
• To send transactional emails (application updates, messages, password resets, job expiry).
• To operate, secure, and improve the Service, including fraud prevention and debugging.
• To comply with legal obligations and enforce our Terms of Service.

4. Legal bases (GDPR)

We rely on the following lawful bases under GDPR:

• Contract — to provide the Service you've signed up for.
• Legitimate interests — to secure the platform, prevent abuse, and improve product quality.
• Consent — for optional features like GitHub analysis, marketing emails, and non-essential cookies. You can withdraw consent at any time.
• Legal obligation — when we must retain or disclose data to comply with applicable law.

5. How we share your data

We do not sell your personal data. We share data only with the following categories of recipients:

• Businesses you apply to — when you submit an application, the employer receives your profile, skill evidence, and any message you send.
• Service providers (processors) — Supabase (database & auth), Modal.com (code analysis), OpenAI (LLM scoring of code quality), SendGrid (email), and Vercel (hosting). Each processes data under contract on our behalf.
• Legal and safety — authorities or courts when required by law, and to protect the rights, property, or safety of our users or the public.
• Corporate transactions — a successor entity in the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections.

6. International transfers

Our infrastructure is hosted in the United States. If you access the Service from outside the US, your data will be transferred and processed in the US. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.

7. Data retention

We keep account data for as long as your account is active. If you delete your account, we erase or anonymize personal data within 30 days, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Aggregated, non-identifying analytics data may be retained indefinitely.

8. Your rights

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Restriction — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing relies on your consent.
• CCPA/CPRA (California residents) — the right to know what personal information we collect, the right to delete it, the right to correct it, the right to opt out of "sale" or "sharing" (we do not sell or share personal information for cross-context behavioral advertising), and the right not to be discriminated against for exercising these rights.

To exercise any of these rights, email team@morethanmyresume.com. We respond within 30 days. You may also lodge a complaint with your local data protection authority.

9. Cookies

We use strictly necessary cookies for authentication and session management, and local storage for theme preferences. We do not use third-party advertising or cross-site tracking cookies.

10. Security

We use row-level security on our database, encrypted connections (TLS) for data in transit, and hashed credentials for authentication. No system is fully secure, however, and we cannot guarantee absolute security.

11. Children

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can remove it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you by email or in-product notice.

13. Contact us

Questions or requests? Email team@morethanmyresume.com.