DearKyro — Privacy Policy
Last updated: October 1, 2026
Effective: October 1, 2026
This Privacy Policy explains what data DearKyro ("we", "us", "our") collects, how we use it, and the choices you have. It applies to dearkyro.com and all related services (the "Service").
By using DearKyro, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
1. Summary
We collect only what we need to run the Service: your email, your uploaded resume, job descriptions you paste, and the analyses we generate.
- We do NOT sell your data.
- We do NOT use your resume or job descriptions to train AI models.
- We do NOT share your individual data with employers or recruiters.
- You can delete your account and data at any time.
2. What We Collect
2.1 Account Information
- Email address (required to sign in)
- Display name (if you provide one)
- Sign-in method (email one-time code or Google)
- Account creation date, last login, last analysis time
2.2 Content You Provide
- Resumes you upload (PDF, Word, or pasted text)
- Job descriptions you paste
- Company name and position (if you provide them, or as extracted from the JD)
- Application tracker data: status changes, notes, interview rounds, deadlines you set
2.3 Generated Content
- Analysis reports (match score, gap diagnosis, STAR rewrites, coach notes)
- Rewritten resumes and downloadable Word files
- Application timeline events (e.g., "Moved to OA on Oct 5", "Interview — Round 2")
2.4 Payment Information
If you pay for a plan, Stripe processes your card and billing details. We do NOT store your card number or CVV.
We store: payment status, plan type, amount, currency, and Stripe transaction ID
2.5 Technical Data
- IP address (used to detect abuse; not stored permanently)
- Browser type and device type (for compatibility)
- Pages you visit on dearkyro.com (aggregated for analytics)
2.6 Communication Data
- Which emails we've sent you (so we don't send duplicates)
- Your email notification preferences (application reminders, re-engagement reminders)
3. How We Use Your Data
We use your data only for the following purposes:
- To provide the Service — analyze your resume against JDs, generate reports, produce a Word resume, track your applications, send reminders
- To authenticate you — send sign-in codes, verify your identity
- To process payments — via Stripe
- To send emails — transactional (report ready, payment confirmation) and optional (application reminders, re-engagement reminders)
- To detect and prevent abuse — rate limiting, account deduplication, fair-use enforcement
- To improve the Service — using aggregated, anonymized usage data only
- To comply with legal obligations
We do NOT use your resume or job description content to train AI models, and we do NOT sell your data to anyone.
4. Third-Party Providers
To deliver the Service, we work with the following third parties:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database and file storage | Account data, resumes, analyses, tracker data |
| Stripe | Payment processing | Email, payment amount, billing details |
| Anthropic (Claude) | AI analysis | Resume text and JD text (transient; not stored) |
| DeepSeek | AI analysis | Resume text and JD text (transient; not stored) |
| Cloudflare Workers | Application infrastructure | Request data (routing only) |
| Lovable email service | Outbound emails | Email address, email content |
These providers process your data only on our instructions and under their own data protection terms.
We do NOT share your individual data with:
- Employers or recruiters
- Advertisers
- Data brokers
- Any other party, except where legally required
5. Data Retention
- Account data: retained until you delete your account
- Analyses and reports: retained for 120 days from creation, then automatically deleted
- Resumes: retained until you delete them (max 5 at a time) or delete your account
- Shared report links: valid for 120 days from creation
- Payment records: retained as required by tax and accounting law (typically 7 years)
- Email logs: retained for 12 months for support and abuse prevention
- Technical logs: retained for up to 30 days
When you delete your account, we remove all personal data within 30 days, except records we are legally required to keep (e.g., payment records). If you choose "Delete my data" without deleting the account, we retain your email and account creation date to identify returning users, and hash your email to prevent re-registration abuse.
6. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: request a copy of the data we hold about you
- Correction: request corrections to inaccurate data
- Deletion: request deletion of your account and data
- Portability: request an export of your data in a machine-readable format
- Restriction: request that we limit processing of your data
- Objection: object to certain types of processing
- Withdraw consent: at any time, where consent was the basis for processing
To exercise any of these rights, email us at support@dearkyro.com. We respond within 30 days.
Deleting your account: You can delete your account directly from Account settings. This removes your resume, analyses, tracker data, and personal information. Email and payment records are retained as required by law.
7. Cookies and Tracking
DearKyro uses minimal cookies and local storage:
- Authentication cookies: to keep you signed in
- Admin session cookies: for admin-only access (httpOnly)
- Local preferences: e.g., your last selected tab
We do NOT use third-party advertising cookies. We do NOT track you across other websites.
If you use Google Sign-In, Google may set cookies per its own policies.
8. Security
We take reasonable measures to protect your data:
- All traffic is encrypted in transit (HTTPS/TLS)
- Data is encrypted at rest
- Passwords for admin access use constant-time comparison
- Sensitive secrets are stored server-side only, never in the browser
No system is 100% secure. If we become aware of a data breach affecting you, we will notify you as required by law.
9. International Data Transfers
Our servers and third-party providers may process data in countries outside your own (including the United States, Singapore, and China). Where required, we rely on appropriate safeguards such as standard contractual clauses.
By using DearKyro, you consent to the transfer of your data to these locations.
10. Children
DearKyro is not intended for users under 16 (or the minimum legal age in your jurisdiction). If we learn that we have collected data from a child under this age, we will delete it promptly. If you believe a child has used the Service, contact us.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do:
- We update the "Last updated" date at the top
- We notify registered users by email for material changes
- Continued use after changes means you accept the updated policy
12. Contact
For privacy questions, data requests, or concerns:
Email: support@dearkyro.com
Or use the contact link in the footer.
If you are in the EU/UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
By using DearKyro, you acknowledge that you have read and understood this Privacy Policy.