Cipher

Cipher Privacy Policy

(Last Updated August 2026)

Overview. This Privacy Policy explains how Cipher (“Cipher,” “we,” or “us”) collects, uses, shares, and protects personal data when you use our website, web application, and subscription services (together, the “Services”). Read this Policy together with our Terms of Service. If we do not define a capitalized term here, it has the meaning the Terms of Service gives it.

Adults only. Our Services are for individual consumers age 18 and older only. We do not knowingly collect personal data from anyone younger than 18. If we learn that we have collected personal data from someone younger than 18, we will delete it.

Categories of personal data we collect. Depending on how you use the Services, we collect:

  • Account and contact information: your name, email address, password (or Google sign-in credentials), phone number, location, and profile links.
  • Billing information: your chosen plan and billing email. We do not receive your payment card number. Our payment processor, Stripe, collects that directly.
  • Career and application content: resumes and other files you upload (including theses and publications); the work history, education, and skills we extract from them; your Career Record (the typed conversations, reflections, and narrative you build with us); employment-gap explanations; Career Intent information; job descriptions you paste for scoring or tailoring; saved score reports; notes about a connection at a company; and self-reported outcome information and notes.
  • Communications: messages you send us, including through our contact form, and your email address if you elect to join our waitlist.
  • Usage and technical data: information about how you use the Services and technical error data, which we collect automatically through our analytics and error-monitoring tools. Sensitive personal data. Some of the content above (like your uploaded files, Career Record, and gap explanations) may reveal sensitive personal data you have provided, such as health, disability, immigration, or protected-class information. We do not screen this information out of your uploads or free-text entries before we process it. By submitting this content, you consent to our processing of it as described in this Policy. We do not sell sensitive personal data, or any other personal data.

Consumer health data. If content you submit reveals information about a physical or mental health condition, diagnosis, or status, we treat it as consumer health data under applicable law and apply additional safeguards. Only employees and contractors bound by a confidentiality obligation may access such data. Our service providers handle it under written data processing agreements. We do not use geofencing around health-related facilities, and we do not sell consumer health data, or any other personal data (see “Targeted advertising and sale of personal data” below).

How we use personal data. We use personal data to:

  • provide and operate the Services, including building your Career Record and master resume, generating tailored resumes, and calculating fit scores;
  • power AI Features, which involves sending relevant content to our AI service providers to provide the Services you request (see “AI Processing” below);
  • manage your account and process payments;
  • respond to support requests and contact-form messages;
  • send service communications and, where you have not opted out, marketing emails;
  • maintain, secure, and improve the Services, including through product analytics and error monitoring;
  • develop de-identified, aggregate insights about outcomes (see “How we learn from outcomes” below); and
  • comply with the law, enforce our Terms of Service, and protect against fraud and security threats. We do not use personal data, including your Career Record, to train large language models, whether ours or that of any third party.

Marketing communications. If you subscribe to our marketing emails, we will send you product updates, tips, and promotional content. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by emailing hello@cipherresume.ai. Unsubscribing from marketing emails does not affect service communications related to your account, subscription, or security.

AI Processing. When you use AI Features, we send relevant content (like resume text, Career Record entries, and job descriptions) to our third-party AI providers, currently Anthropic and Google Gemini, to generate outputs for you. If one provider is unavailable, we may process content with the other for reliability. We process this in real time to produce your own results.

How we learn from outcomes and usage. With your consent, which you may turn on or off anytime in settings, we use de-identified, aggregate patterns drawn from two categories of data (not your personally identifiable individual records) improve the Services. The first is outcome data, which is information you report about application results, such as whether a tailored resume produced an interview. The second is product-usage patterns, which is information about how members interact with the Services, such as how members select evidence from their Career Record or sequence the steps of building a resume. We study usage patterns to understand how the product is used and to inform future features. We rebuild these patterns nightly from currently opted-in records. Opting out, closing your account, or deleting an outcome removes your contribution from the next nightly rebuild. We take reasonable measures to ensure this data cannot be associated with you. We publicly commit to using it only in de-identified form. We do not attempt to re-identify it. We contractually require anyone we share it with to make the same or more protective commitments. We do not draw conclusions from groups smaller than fifty (50) people, to avoid inadvertently identifying any individual. We never sell this data, and we do not tie it to your individual profile when we use it outside Cipher, such as in published research or marketing.

Targeted advertising and sale of personal data. We do not sell personal data. We do not currently use personal data for targeted advertising (advertising selected based on your activity across unrelated websites or apps over time). If that changes, we will update this Policy and provide the disclosures and opt-out choices required by law, including support for an opt-out preference signal such as the Global Privacy Control, before we do.

Sharing personal data. We do not sell personal data. To the extent we share personal data, we do so only with:

  • service providers who process it on our behalf to operate the Services, including Supabase (hosting, database, sign-in, file storage), Vercel (application hosting and content delivery), Stripe (payments), Resend (email), PostHog (product analytics), Sentry (error monitoring), Anthropic and Google (AI Processing), and Google (sign-in, if you choose to sign in with Google);
  • a buyer or successor, if we are involved in a merger, acquisition, or sale of assets; and
  • others, if required by law, to protect rights and safety, or to enforce our Terms of Service. Data retention. We keep personal data for as long as your account is active, including while paused. While your account is paused, billing stops and you keep access to your Career Record, your master resume, and your resume library, so you can view and download them at any time and reactivate later with your work intact. If you close your account, we permanently delete your account, your data, and your uploaded files from our active database and file storage right away. Deletion is immediate and cannot be undone. We keep rolling daily backups of our database for seven days, so no backup containing your data survives more than seven days after deletion. Uploaded files are not included in those database backups. We also remove your personal data from our analytics and email tools; we currently do this manually as part of processing your request, within the response time described under “How to exercise your rights.” Our error-monitoring tool does not support deleting an individual person’s records on request. We limit what is sent to it, remove what we can, and any remaining diagnostic data expires automatically under that provider’s retention schedule, which is currently no longer than thirty days. Records of emails we have already sent you may also remain with our email provider under its own retention schedule, which is currently thirty days. If you have written to us through our contact form, we keep that message and the contact details you sent with it as a record of the correspondence, and deleting your account does not remove it. We keep waitlist email addresses until you ask us to delete them.

We retain financial transaction records (like payment and billing history) for as long as required by applicable law and our payment processor’s compliance obligations, even after account closure, typically up to seven years. Residual personal data may also persist briefly in third-party operational systems subject to those providers’ own retention schedules and technical limitations.

We do not intend any of the foregoing statements in this section to limit or modify your deletion rights under applicable law, which you may review in the “Your privacy rights” and “How to exercise your rights” sections of this Policy.

Data security. We use administrative, technical, and physical safeguards to protect personal data, scaled to its volume and sensitivity. No system is completely secure, and we cannot guarantee absolute security.

International transfers. Cipher is based in the United States and our Services are directed at U.S. residents. We process personal data in the United States. Some of our service providers, including our AI processing providers, Anthropic and Google, may process personal data on infrastructure located outside the United States. By using the Services, you acknowledge that your personal data may be transferred to and processed in countries whose data protection laws may differ from those of your country of residence. Where we transfer personal data outside the United States to our service providers, we do so under contractual or other arrangements designed to protect your personal data.

Your privacy rights. Subject to certain exceptions, you have the right to:

  • confirm whether we are processing your personal data and access it, including any inferences we have drawn about you;
  • correct inaccurate personal data;
  • delete personal data we have collected about you;
  • obtain a copy of your personal data in a portable format; and
  • opt out of profiling that we use to make decisions that have a legal or similarly significant effect on you, if applicable. (Our fit scores and similar features are self-assessment tools you control. We do not use them to make decisions about you, and we do not share them with employers or other third parties.) We do not sell personal data, so there is no list of third parties to provide for that purpose. We will not deny you the Services, charge you a different price, or provide a different level of quality because you exercise any of these rights.

State-specific privacy rights. Depending on the state where you reside, you may have additional or different privacy rights under applicable state law. We honor the privacy rights that apply to you based on your state of residence. If you have questions about rights that may apply to you specifically, email us at hello@cipherresume.ai and tell us your state of residence. California residents should note that, in addition to the rights described above, they may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), including the right to limit the use and disclosure of sensitive personal information, the right to know about third parties to whom personal information was disclosed for direct marketing purposes (California’s “Shine the Light” law), and the right to receive disclosures regarding any Do Not Track signals the Services recognize.

How to exercise your rights. You may submit a request by emailing hello@cipherresume.ai . You do not need to create a new account to submit a request, but we may ask you to use your existing account to verify your identity. We respond within 45 days of receiving a verifiable request, and may extend that period by another 45 days for complex or numerous requests, in which case we will tell you why. We provide this service free of charge once per 12-month period. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or decline to act, and we will explain why.

With respect to deletion, note that in addition to the request procedure described above you can delete your account (and associated Career Record and resume library) from Settings → “delete my account”.

Appeals. If we decline to act on your request, we will tell you why and how to appeal. You can appeal by emailing hello@cipherresume.ai within a reasonable time. We respond to your appeal within 60 days, in writing, with our reasons. If we deny your appeal, we will tell you how to file a complaint with the applicable regulatory authority.

Authorized agents. You may have someone else, including a technology such as a browser-based tool, act as your authorized agent and submit a request on your behalf. We verify the agent’s authority and your identity using commercially reasonable efforts, which may include asking the agent for proof of your authorization, such as a signed permission or power of attorney, and contacting you directly to confirm the request, particularly for requests other than opt-outs.

Cookies and similar technologies. We use cookies and similar technologies to operate and improve the Services. A cookie is a small text file placed on your device when you visit our site. We currently use two categories of these technologies:

  • Strictly necessary. These are required for the Services to function. They include session and authentication cookies that keep you logged in and security cookies that help protect your account. You cannot opt out of these without stopping use of the Services.
  • Analytics. We use analytics tools, currently PostHog, to understand how users interact with the Services so we can improve them. These tools collect information such as pages visited, features used, and errors encountered. They do not identify you by name or contact information. We do not currently use advertising or targeting cookies.

Most browsers let you control cookies through their settings. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you disable or refuse cookies, some parts of the Services may not function properly. To learn how to manage cookies in your browser, visit your browser’s help documentation.

Third-party links and services. Our Services may contain links to third-party websites, services, or platforms, for example, job boards from which you source job descriptions, or LinkedIn. This Policy does not cover those third parties. We are not responsible for the privacy practices of any third-party site or service, and we encourage you to review their privacy policies before providing any personal data to them.

Changes to this Policy. We may update this Policy from time to time. The date at the top shows when we last updated it. If we make a material change to how we use personal data we already collected, we will notify affected users and give them a reasonable opportunity to withdraw consent before the change applies to their previously collected data.

Contact us. Questions about this Policy or your personal data: hello@cipherresume.ai.