Privacy

Last updated 13 October 2026. Questions or requests: armaan.nas3@gmail.com.

Gradfit helps students tailor CVs and cover letters to job ads. In short: we keep your account, how many things you've made, and your payments. We don't keep your CV.

What we keep

• Your account: your name, email address and profile picture from Google when you sign in.
• Usage counts: when you ran an ATS check, tailored a CV or wrote a cover letter, so free limits and fair use work. Not what was in them.
• Payments: the date, amount and Stripe's payment reference. Stripe handles your card; we never see card details.
• A sign-in cookie that keeps you signed in for up to 30 days. No advertising or tracking cookies.

What we don't keep

Your CV, the details you type, your GitHub projects and the job ads pass through our server to be written up and are then discarded: they aren't saved in our database or logs. Your drafts are saved in your own browser (local storage) so a refresh doesn't lose them; "Start again" removes them.

Who else is involved

• Google: "Sign in with Google", and the Gemini API, which writes your CV, cover letter and ATS check. Your text is sent to Gemini to generate the answer. Gradfit uses Google's paid Gemini service, whose terms say Google doesn't use what you send to improve its products; Google keeps it for a limited time only to detect misuse and meet legal requirements.
• Stripe: takes payments for Pro.
• Railway: hosts Gradfit's server and database.
• GitHub: if you enter a GitHub username, your browser reads your public repositories from GitHub. If you click "Connect GitHub", you choose which repositories (including private ones) to share with the Gradfit GitHub app, read-only; Gradfit reads their names, descriptions and READMEs once, holds them for up to 15 minutes until your page collects them, and doesn't keep them or the access GitHub gave it. You can remove the app any time in GitHub → Settings → Applications.
• PostHog (EU servers): anonymous statistics and screen recordings of how people use the site, so we can see where it's confusing. Your CV, everything you type, the documents Gradfit writes and your account details are hidden from recordings, and no cookies are used.
• Overleaf: only if you click "Open in Overleaf", your browser sends that LaTeX file to Overleaf.
• Job boards: we read public job listings; if you paste a job link, our server fetches that one page.

Why we use your data

To provide the service you asked for (our contract with you), to keep it working and stop abuse (our legitimate interests), and to keep payment records the law requires (legal obligation).

How long

Your account and usage counts are kept until you ask us to delete them. Payment records are kept for six years, as UK tax law requires.

Your rights

You can delete your account and usage history yourself at any time: account menu (your picture, top right) → "Delete my account and data". You can also ask for a copy of your data, ask us to correct or delete it, or object to how we use it: email armaan.nas3@gmail.com. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).