Privacy

We store your resume and what we measured from it. We do not sell it, we do not train models on it, and we do not send applications anywhere on your behalf. Delete your account and the files go with it.

• Your account. Email address, an optional name, and either a password hash (scrypt — we never store the password) or a Google account id if you sign in that way.
• Your resume. The file you upload, the text extracted from it, and the contact details read off its header. A resume commonly contains your phone number, address, education and employment history; whatever is in yours is in ours.
• What we measured. Readiness scores, findings, the rebuilt PDFs, and any job description you paste in.
• Operational records. Sign-in events, rate-limit counters, and errors. IP addresses appear in rate-limit keys and are not kept as a browsing history.
• Anonymous page activity. A random first-party browser id, the page path and time of a visit, plus an optional campaign label or referring website hostname. We do not store IP addresses, a full referrer URL, search terms or advertising click identifiers.

We do not use advertising trackers, and there is no third-party analytics script on this site.

The score is computed entirely on our own server by a deterministic program. No model is involved and nothing leaves the machine.

Rewriting and the written review DO send resume text to a language model provider — currently Groq, Google Gemini, Cerebras, Mistral, OpenRouter or xAI, whichever the deployment has configured. Before any text leaves the server we strip email addresses, phone numbers and long identity numbers from it. Those providers receive your skills and experience; they do not receive your contact details.

Your name is not stripped, because a rewrite has to keep it and no name detector is reliable enough to remove it without mangling ordinary resume text. If that matters to you, do not use the rewrite feature — the readiness report works without it.

Until you delete it. Deleting a resume removes the row, the uploaded file and every rebuilt PDF made from it. Deleting your account removes everything above.

Operational records — sign-in events and error reports — are kept separately for security and debugging, and are not linked to your resume content.

You can see everything we hold from your account page, correct it by re-uploading, and delete it at any time without asking us. Under India’s Digital Personal Data Protection Act 2023 — and under the GDPR if you are in the EU — you may also request a copy or a correction by email, and we will respond within 30 days.

Sessions are signed cookies, revocable on sign-out. Passwords are hashed with scrypt. Uploaded files are stored outside the web root and served only through a route that checks you own them. Rendering runs with JavaScript disabled and no network access.

No system is perfect. If you find a problem, tell us before you tell anyone else and we will fix it.

Grindly is not intended for anyone under 16, and we do not knowingly hold data about them.

If we change how your data is handled in a way that matters, we will update the date at the top and say what changed.