This policy explains what the FirstCV app (“the app”) does with information, why, who else is involved, and what choices you have. FirstCV is published by AIMakeHub (“we”, “us”). Questions? Write to [email protected].
The short version
No account. Your resumes are created and stored on your device. We do not receive them. The only exception is the resume details an AI action needs, if you choose to use AI (see AI writing features).
AI is optional. Nothing is sent until you agree in the app and tap an AI action. Then the details that action needs (education, experience, projects, skills, summary, target role and any job posting you paste) go through our server to Replicate, which uses AI models from Anthropic and Meta to write the result and deletes your details after one hour. They are never used to train AI. Your name, e-mail address, phone number, postal address, links and photo are never sent. You can withdraw in Settings → AI data sharing.
Ads. To export a PDF with a free template you watch one short rewarded ad from Google AdMob, or you go Premium instead. Ads are personalised only if you allow tracking.
Services we use. Google Firebase (usage analytics, crash reports and an anonymous ID for the AI tools) and RevenueCat (purchases).
No selling. We do not sell your resume content or contact details, and we never use them for advertising.
1. What stays on your device
When you build a resume, everything you enter is stored in the app’s private storage on your iPhone. We have no access to it:
your name, e-mail address, phone number, address and links;
education, work experience, projects and awards, skills, languages, certificates and references;
an optional profile photo (you pick it with Apple’s photo picker, so the app only sees the photo you select);
your design choices and app settings.
This information stays until you delete the resume or delete the app. The PDF is created on your device and goes only where you send it with the iOS share sheet (Mail, Messages, Files, AirDrop and so on); we never receive it. If you use iCloud Backup or a computer backup, the app’s data can be part of those backups, which you and Apple manage. Please do not add other people’s details, such as a reference, unless they agreed.
2. What we process, why and who handles it
These are the cases in which information leaves your device. The optional AI writing features have their own section, section 3.
Purchases
What
Whether Premium is active, App Store transaction details, a random anonymous RevenueCat ID, your country, app version and device type, and the IP address of your request. We also give RevenueCat the random Firebase app-instance ID so that purchases can be matched with usage events. We never see your payment card or Apple ID.
Why
To unlock Premium, restore purchases, prevent fraud and keep accounting records.
Who
Apple (App Store payments) and RevenueCat, Inc.
Kept
As long as needed to manage the purchase and to meet legal and accounting duties.
Ads (Google AdMob)
When
When you choose to watch the rewarded ad to export a PDF with a free template, and in the background while that ad is being loaded.
What
AdMob receives your IP address (so it can tell your approximate location), device and operating-system information, app information, how you interact with the ad and diagnostics. If you allow tracking, it also receives the advertising identifier. Where the law requires consent, ads are requested only after you have answered Google’s consent form.
Why
To show the rewarded ad that supports free exports, to measure ads and to prevent fraud.
Who
Google (AdMob and the User Messaging Platform).
Kept
As described in Google’s policies.
Usage analytics (Google Analytics for Firebase)
What
Events about how the app is used, for example: welcome screen finished, a resume section saved (the section name), a template opened (the template name), an export started or completed (template name, whether it is Premium, file size), a paywall shown (where), a purchase or restore result, an AI action used or failed (the tool and an error category) and the ad outcome. Plus automatic data: a random app-instance ID, device model, operating-system and app version, language, approximate location from your IP address (country or region) and your plan (free or Premium). Events never contain the text of your resume.
Why
To understand which features are used, find problems and improve the app.
Who
Google (Firebase).
Kept
Up to 14 months.
Crash and error reports (Firebase Crashlytics)
What
Crash logs and error records: technical stack traces, device model, operating-system and app version, memory and storage state, and a random installation ID. Errors from the AI tools are recorded as error codes, not as your text.
Why
To find and fix crashes and failures.
Who
Google (Firebase).
Kept
90 days, according to Google’s published retention for Crashlytics.
Contacting us
What
Your e-mail address and the message you send. If you use Help & contact in the app’s Settings, the subject line also includes the app and iOS version.
Why
To answer you and keep a record of your request.
Kept
As long as needed to handle the request and keep that record.
3. AI writing features
FirstCV can draft your summary, proofread it, match your resume to a job posting and write a cover letter (the Summary, Fix, Optimize and Cover Letter tools in the AI Hub). These features are optional and part of Premium. Before the first AI request the app shows a “Before AI writes for you” screen that explains what is sent and who receives it. Nothing is sent unless you choose Agree and continue and then tap an AI action. The app may also ask our server whether the AI service is available; that request contains no resume content.
What is sent
Only these resume details: education (school, degree, subject, GPA and dates), work experience (organisation, role, dates and details), projects and awards, skills, your summary and your target role. Optimize and Cover Letter also send the job posting you paste; Fix sends only your summary. Each request also names the language of your resume, so the answer is written in it.
Never sent
Your name, e-mail address, phone number, postal address, links (such as LinkedIn, GitHub or a website) and photo. Languages, certificates and references are not sent either. Text you type into a field that is sent goes as written, so please keep other personal details out of those fields.
To whom
Our server, a Google Firebase Cloud Function in the United States, drops anything outside the list above and forwards the request to Replicate, an AI platform in the United States. Replicate runs the AI model that writes the answer, and our server returns the answer to your device. The model is currently Anthropic’s Claude Haiku 4.5; if it is unavailable, Meta’s Llama 3 70B is used instead. Anthropic, which provides the Claude model to Replicate, may also process the request to run it. Replicate runs Llama on its own servers, so Meta does not receive your data.
Why
Only to write the text you asked for (a summary, corrections, job-posting suggestions or a cover letter) and return it to your device. It is not used for advertising or profiling.
Training
Your details and the AI’s answers are never used to train AI models. FirstCV does not train on them, Replicate’s terms allow it to use them only to provide its service, and Replicate states that the Claude model’s inputs and outputs are not used for training.
Kept
FirstCV does not store your resume details or the AI’s answer beyond the request. Replicate automatically deletes the request, the answer and their logs one hour after the request, and states that the Claude model’s inputs and outputs are not retained. To enforce daily limits and prevent abuse, our server keeps a daily request counter for each anonymous ID (see below) and deletes it after 30 days. Our cloud provider keeps short-lived technical logs, such as the time, size and error status of a request.
Anonymous ID
The first time you run an AI action, the app creates an anonymous Firebase Authentication ID, which our server requires before it accepts a request. It has no name, e-mail address or password and is not connected to your resumes.
Your choice
AI is optional: every other feature works without it. The app asks for your agreement before the first AI request, and again if what is sent, or who receives it, changes. You can withdraw it at any time in the app’s Settings → AI data sharing; after that nothing more is sent unless you agree again.
4. Ads, tracking and consent
The first time you open the template screen (the way to export), before any ad is requested, the app may show Google’s consent form (in the EEA, the UK and other places where the law requires it) and Apple’s App Tracking Transparency prompt. The Apple prompt asks whether the app may track you across apps and websites owned by other companies. If you have Premium, ads are not shown and the app does not ask.
If you allow tracking, AdMob can use the advertising identifier to personalise and measure ads.
If you decline, the advertising identifier is not shared and ads are not personalised with it. Free export still works.
Where the consent form is required, the app requests ads only if your choices allow it. If they do not, your export simply continues without an ad.
You can change your tracking choice at any time in iPhone Settings → Privacy & Security → Tracking. You can manage Google’s ad personalisation at myadcenter.google.com. To see Google’s consent form again, delete and reinstall the app or contact us.
5. Legal bases (EEA and UK)
If the GDPR or the UK GDPR applies to you, we rely on:
Providing the app you asked for, for purchases and restoring them, and exports.
Your consent, for the AI writing features and for the advertising identifier, personalised ads and Google’s consent form where it is shown. You can withdraw consent at any time (see section 3 and section 4); this does not affect what happened before.
Our legitimate interests, for crash reports, usage analytics, security and abuse prevention (including the AI daily limits) and improving the app, balanced against your rights.
Legal obligations, for tax and accounting records of purchases.
6. Who receives data
We use these service providers. Their own policies explain how they handle data:
Replicate (runs the AI models that write the AI text, only after you agree in the app): Privacy Policy and data retention. The models come from Anthropic (Claude: Privacy Policy) and Meta (Llama, which Replicate runs on its own servers, so Meta does not receive your data).
RevenueCat (purchase and subscription status): Privacy Policy.
We do not sell your resume content or contact details and we do not share them with advertisers. We may disclose information if the law requires it, or to protect our rights, our users or the service.
7. International transfers
These providers operate worldwide, mostly in the United States. If you are in the EEA, the UK or Switzerland, your data may therefore be processed outside those regions. Our providers rely on safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
8. How long we keep data
Resumes, photo and settings: on your device until you delete them or delete the app. We do not hold them.
AI requests and results: not stored by us. Replicate deletes them one hour after the request; our cloud provider keeps the limited technical logs described in section 3.
AI usage counters: a daily request count per anonymous ID, deleted after 30 days.
Anonymous AI ID: until it is deleted. Firebase removes deleted IDs from its systems within 180 days.
Usage analytics: up to 14 months.
Crash reports: 90 days.
Purchase records: as long as needed to manage the purchase and to meet legal and accounting duties.
Messages to us: as long as needed to handle your request and keep a record of it.
9. Security
Data in transit between the app, our server and the providers is encrypted. Our AI service requires a Firebase Authentication sign-in (the anonymous one) for every request and enforces daily request limits, and the token we use for Replicate is kept in Google’s Secret Manager on the server, never inside the app. No system is perfectly secure, and your resumes live on your phone, so keep your device updated and protected with a passcode.
10. Your choices and rights
On your device: edit or delete any resume in the app, use Settings → Delete my data to remove every resume and photo, or delete the app to remove all of its data from your iPhone. Files you exported or shared stay wherever you saved or sent them.
AI data sharing: withdraw your agreement at any time in the app’s Settings → AI data sharing. Nothing more is sent after that.
Your legal rights: depending on where you live (for example the EEA and UK under the GDPR, California under the CCPA/CPRA, or Türkiye under KVKK) you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it, to withdraw consent and to complain to your data protection authority. We do not discriminate against you for using these rights.
To use a right, write to [email protected] with the subject “Privacy request”. We aim to answer within 30 days. Most of your data lives only on your device, where you control it. The data held by us and our providers (analytics, crash reports, the anonymous AI ID with its usage counters and purchase records) is not linked to your name or e-mail address, so we may not be able to find it unless you can help identify it. Where we can, we will delete it or explain why we cannot.
11. Children
FirstCV is a resume tool for students and job seekers. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has given us personal information, contact us and we will delete it. In some countries the age at which you can consent to data processing is higher than 13 (up to 16); if that applies to you, please use the app together with a parent or guardian.
12. Changes to this policy
We may update this policy, for example when the app gets new features or uses new services. The new version will appear on this page with a new effective date. If a change is significant, we will also tell you in the app or in the release notes before it applies.