Skip to content
JSON Resume
Sign inSign upDashboard

Privacy policy

What jsonresume.org keeps about you, why, who helps us run it, how long it's kept, and how to see, change or delete it.

Last updated 7 November 2026.

JSON Resume is an open-source project, and jsonresume.org is run by its maintainers. This policy covers jsonresume.org, its API and its MCP server (the connection that lets apps such as ChatGPT and Claude use your account). We keep only what the site needs to work, we don't sell data, and we don't show ads.

What we keep, and why

Your account. Your email address, your username, and your password stored as a one-way hash (never the password itself). If you sign in with GitHub: your GitHub user id, login and avatar URL, and the GitHub access token GitHub gives us, encrypted, with the permissions you granted (your profile, your email and, if you allow it, your gists). We use these to sign you in and to read and save your resume gist.

Your resume. The resume you save here, or a copy of your resume.json gist, refreshed when your page is visited. Your resume is published at jsonresume.org/@username once your account is confirmed: it's meant to be public, so don't put anything in it you wouldn't share. If you keep a public resume.json gist on GitHub, its page at jsonresume.org/@your-github-login works without an account. Public resumes are listed in Explore, where anyone can search them by name, headline, place and skills; an account can take its resume out.

Who reads your resume. When someone views a resume page, we record the page or format read, the theme, the time, how long the page was visible and how far down it was read, the site they came from, their country (from Cloudflare), and their device type and browser. Visitors are counted with a hash that changes every day. We don't set cookies for this and don't store IP addresses. These numbers are shown only to the resume's owner. Owners viewing their own page aren't counted.

How the site is used. To learn which pages and features help people, the site (not resume pages) sends page views, clicks and errors to PostHog, with your country (from Cloudflare). When you're signed in, these, and what you do with your account through the site, the API or an app (signing up, saving your resume, making a key, which MCP tool an app called), are tied to your account's id and username, never your email or resume. PostHog runs here without cookies or anything stored in your browser: like our resume statistics, it counts visitors with a hash that changes every day. It doesn't record your screen, and it sends nothing when your browser asks sites not to track you (Do Not Track). Deleting your account doesn't reach into PostHog's history; email us and we'll delete it there too.

Jobs. Job posts come from public Hacker News "Who is hiring?" threads. When you use jobs matched to your resume, the text of your resume is sent to OpenAI to make an embedding (a list of numbers describing it), which we keep, keyed by a hash of that text, so we don't need to send it again. We also keep what you mark about jobs (interested, maybe, applied, not for me) and any note you add.

Apps and keys. For each app you connect (MCP clients such as ChatGPT or Claude) and each API key you make: its name, when it was made and last used, and a one-way hash of the key or token. We never keep keys or tokens in a form we could read back.

Signing in. A cookie keeps you signed in, another tells the site you are (so it can show the right buttons), and a short-lived one protects signing in with GitHub. No tracking or advertising cookies.

Server logs. Our servers log requests, including IP addresses, for security and to find problems. These logs are kept for at most 30 days.

Who helps us run it

  • OVH hosts our server and database, in Canada.
  • Cloudflare carries traffic to the site and stores our database backups.
  • GitHub signs you in when you choose it, and holds your gist.
  • OpenAI reads job posts to tidy them, and makes embeddings of resumes for matching. OpenAI doesn't use API data to train its models.
  • Resend sends account emails (confirming your address, resetting your password).
  • PostHog counts how the site is used, in the United States.

They process data only to provide those services to us.

How long we keep it

Your account and everything in it are kept until you delete your account. Deleting it (in Settings) removes your account, saved resume, reader statistics, job marks, keys and connected apps at once, and frees your username. Accounts whose email address is never confirmed are deleted after 7 days. Database backups are kept for 30 days, so deleted data is gone from them within 30 days too. Copies of gist resumes shown without an account are refreshed from GitHub and go when the gist goes.

Your choices

  • See and download your resume at any time (/@username.pdf, .docx, .json, .yaml, .txt or .rendercv), and edit it in the editor.
  • Take your resume out of Explore, the public search of resumes, in Settings. Your page stays public either way.
  • Disconnect apps and revoke API keys in Settings.
  • Revoke our GitHub access in your GitHub settings, under Applications.
  • Delete your account in Settings.
  • Ask what we hold about you, or anything else about privacy, by email at thomasalwyndavis@gmail.com. For questions that needn't be private, GitHub or Discord work too.

Children

jsonresume.org isn't meant for children under 13, and we don't knowingly collect their data.

Changes

When this policy changes, we'll update it here and change the date at the top. The history of every change is in our public repository.