Privacy notice

Last updated: October 13, 2026. This notice covers ResumeUpShift’s website, resume and cover-letter tools, optional AI assistance and job research.

Who operates this service

ResumeUpShift is operated by SecurePath Technologies. For privacy questions or requests, contact info@securepath.tech.

What stays on your device

Resume and letter editing, keyword comparison, the ATS resume checker, PDF, Word (.docx) and text export and ordinary PDF, DOCX and TXT text extraction run in your browser. Selecting a file for local import does not upload the original file. We do not receive locally entered application content unless you choose a feature that sends it, such as AI organization, coaching or OCR.

Downloaded PDFs, Word documents, text files and project files stay wherever you save them. Project files contain your application data in readable JSON. Keep them somewhere appropriate for personal information.

What optional AI receives

• Coaching, bullet rewrites and letter drafts: selected resume content, the pasted job description or selected public job excerpts, and answers you provide. Structured name, email, phone, website and location fields are omitted from these requests. Free-text sections can still contain personal information.
• AI import organization: the extracted text you approve. This can include names, contact details, employers, dates and other information in the original document. Review and redact that text before sending it.
• Scanned PDF OCR: locally rendered page images, up to six pages, sent after separate OCR consent to the SecurePath GLM-4-OCR endpoint. Images can contain all the personal information visible on the page. Optional AI organization of the recognized text requires a separate choice.

These requests pass through our backend to the SecurePath model gateway. The gateway retains prompts and responses for 90 days. Submitted transcripts, including text extracted by OCR, may be used by SecurePath Technologies to improve and train models. Do not send content you do not want used for those purposes. You can use the local tools without AI. The 90-day log policy does not promise that any trained model will forget information learned from a transcript. Its documentation says inline image payloads are stripped from logs, but recognized text and other prompt content may remain. Do not send government identifiers, passwords, bank information or other unnecessary sensitive information. We do not promise that model responses are accurate or that stopping a browser request stops work already running upstream.

Job research and external websites

Research sends the role and location you enter to our private SearXNG service and its configured search engines. Do not put personal information into those search fields. The research service fetches a limited sample of public employer postings; it does not send your resume to those employers. Selected excerpts are sent to the model only when you request coaching with consent. Clicking a source link visits that external website, whose privacy practices apply independently.

Browser storage and cookies

“Save on this device” is optional. It stores an unencrypted recovery copy in this browser’s localStorage until you clear it, browser storage is cleared or the browser evicts it. Turning saving off stops future saves; use “Clear saved copy” to remove the stored copy. That action does not remove downloaded files, the application still open in memory or information already sent to AI. The previous-application restore copy lasts only in the current page session.

Other people with access to your browser profile may be able to read saved work. Avoid local saving on shared devices. This release does not use advertising cookies, analytics cookies or an account/session cookie for resume AI access; our analytics is cookieless. Hosting or security infrastructure may process ordinary request information as described below.

Technical information and abuse prevention

Web requests necessarily expose technical information to the hosting infrastructure, such as IP address, requested URL, time, browser information and error status. Infrastructure access/security logs may retain this information. Do not put resume text or other personal information in URLs.

The production API uses a keyed hash of the client IP for shared request limits. This is pseudonymous information, not proof of anonymity. Temporary queue and active-request records support capacity controls. The application does not intentionally store resumes, letters, OCR images or model conversations in Redis; gateway logs are separate from Redis.

How long information is kept

• Local copies: until you delete the download or clear browser storage; in-memory drafts last for the page session.
• Public job results and evidence: about one hour in the shared server cache.
• Request controls: pending/active leases last a few minutes; hourly counter keys expire about two hours after their last update. Expired sorted-set records may remain until later request cleanup. Infrastructure backups can have separate retention.
• Gateway text logs: 90 days.
• Hosting/security logs: 90 days.
• Analytics: aggregated statistics for up to 24 months; the analytics service does not store IP addresses.

These periods describe log retention, not a guarantee that prior model training can be reversed. Contact us about deletion requests or questions about model-improvement use.

Access and sharing

Information sent to server-side features is processed by the operator’s hosting, search and AI infrastructure to provide those features and protect availability. Authorized administrators or service providers may be able to access operational logs. Search engines receive research queries, and websites you open receive ordinary visit data. Our self-hosted analytics receives page views only, never your resume or letter content, and no advertising integration is active. Nothing you enter is sent to an advertiser.

Our infrastructure may process information outside your country. Contact us if you need processing-location details before using AI. No regional data-residency commitment is offered by this service.

Your choices and privacy requests

You can use the local tools without AI, decline OCR, redact extracted text, leave browser saving off and download your own project copy. Choosing not to send future requests does not retract information already processed. To request access, correction or deletion of server-held information, or ask about other rights available where you live, contact the operator using the address above. Include the approximate time and feature involved; do not send a full resume unless it is necessary. There is no user account, and we may need proportionate information to locate a record or verify a request. Some local-only information is not available to us.

Analytics

We use Umami, a self-hosted analytics tool that runs on our own servers and is loaded from this website, not from a third party. It sets no cookies, does not track you across other websites and uses no advertising identifiers. It records the page viewed, the referring website, your browser, operating system and device type, and an approximate country derived from your IP address at the time of the request. The analytics service does not store IP addresses. Query strings and URL fragments (the parts of an address after “?” or “#”) are not collected, and browsers that send a Do Not Track signal are not counted. Analytics never receives resumes, letters, uploaded files, job searches or AI conversations. Analytics data is not sold or shared with advertisers or other third parties. Aggregated statistics are kept for up to 24 months.

Advertising

We have applied to Google AdSense. Ads are not shown on this site yet, and no ad scripts or advertising cookies are in use today. If ads are enabled, Google and its partners may use cookies or similar technologies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and/or other sites on the Internet. You can opt out of personalized advertising in Google Ads Settings, and learn more about how Google uses cookies in advertising.

Before personalized ads or advertising cookies are used, visitors in the European Economic Area, the United Kingdom and Switzerland will be asked for consent through a Google-certified consent management platform. Visitors in US states with applicable privacy laws will be offered the opt-out those laws provide. Ads will not be placed inside the tools where you edit your own documents, files or finances, and content you enter into the tools is never shared with advertisers.

When ads are enabled, they will be clearly labeled and limited to public information pages, away from document-editing controls. Resume content, uploaded files and AI conversations must not be included in ad targeting or analytics events. You can also read how Google uses information from sites that use its services.

Document and AI limitations

AI can invent details and OCR can misread text. Review every claim, name, date and number. Keyword comparison is not an ATS score or assessment of your ability. The ATS resume checker’s formatting checks are rules of thumb, not a real applicant tracking system. PDF and Word templates use real text in one column, but compatibility with every hiring system is not guaranteed. Current PDF fonts support Western European text; plain-text export preserves broader Unicode. Review exported files before submitting them. Sample resumes and illustrations are fictional.

Updates and contact

We will revise this notice when the service’s data practices change and update the date above. New optional features will describe their data use before you choose to send content. Questions: info@securepath.tech.