Privacy Policy

The short version

• If you are signed out, your resumes and job applications are kept in your browser’s local storage only. They are not uploaded to Folio’s servers.
• If you are signed in, your resumes and job applications are saved to your account in Folio’s database, which Neon hosts, so they appear on any device you sign in on. A copy is also kept in each browser you use. You can delete them from your account yourself (see “Your choices and rights”).
• The text of your resume is never sent to any AI service.
• If you choose “Continue with Google”, Google tells us your name and email address (and your profile picture, if it has one) and confirms the email is yours. We do not receive or store a password for that sign-in, and we do not get access to your Google contacts, mail or files.
• You need an account to buy or use the paid PDF and Word downloads, and to keep your resumes across devices. An account stores your name, email, a scrambled (hashed) password, your plan and your download credits, plus your saved resumes and applications.
• Payments are handled by Dodo Payments. Folio never sees or stores your card number.
• Folio does not use advertising or analytics trackers, and does not sell your personal data.

What is kept in your browser

These are saved in your browser’s local storage on this device. While you are signed out, they do not leave your device and Folio’s servers do not receive them:

• your resumes and the drafts you are working on, including anything you import or paste;
• your application tracker (the jobs you add on the Applications page);
• your choice of light or dark theme and your language;
• the name of the local library your resumes are filed under (this can be an email address you typed), and whether you have seen the first-time welcome screen;
• a small record of what has been saved to your account (resume and application IDs and edit times), once you have signed in.

Your theme, your language and the welcome-screen choice always stay in your browser. When you sign in, your resumes and application tracker are also saved to your account (see the next section), and the browser keeps its copy so Folio works offline.

When you import a resume file or paste text, it is read by your browser, on your device; the file itself is never uploaded. Once you create a resume from it and you are signed in, the resume is saved to your account like any other. Folio’s checks, scoring and job matching run in your browser. If you stay signed out, clearing this site’s data deletes all of the above and we cannot recover it for you, so sign in or download a JSON backup if you want a copy that survives that.

What our servers store if you make an account

When you create an account and sign in, Folio’s database keeps:

• Account details: your name, your email address and, if you sign up with email, your password in hashed form (we cannot read your password). If you sign in with Google instead, we store the name, email address and profile picture link Google gives us, plus Google’s identifier for you and the sign-in tokens it issues (kept encrypted), and no password. If the same email address already has a Folio account, the Google sign-in is added to that account instead of creating a second one.
• Sign-in sessions: a record for each time you sign in, with a session token, when it started and expires, the IP address and the browser/device description (user agent) it came from. This is used to keep you signed in and to protect your account.
• Your resumes and job applications: everything you put in them, such as your name, contact details, photo, work history, education, skills, any pasted job post and your notes, together with when each was last edited. This is stored only if you are signed in, so you can open them on any device. A resume or application you delete is marked as deleted so that the deletion reaches your other devices, and its contents are emptied at that time.
• Shared resume links (only if you turn one on): a copy of the resume that is shown on the page, a secret random address, whether your phone number and city are hidden, and when it was made and last updated. The copy leaves out your resume’s title, any job post, your notes and your cover letter. Anyone who has the address can read that copy without signing in, and it is marked “noindex” so search engines are asked to skip it. Turning sharing off, making a new address, deleting the resume or choosing “Delete my saved resumes and applications” ends the old address at once and deletes the stored copy.
• Your plan: whether you have a subscription and when it runs to, how many one-time download credits you have, and when your 24-hour download pass ends, if you have one running.
• Payment references: the customer and subscription ID that Dodo Payments gave your purchase, so we can match payments and manage your plan. We do not store card details.
• Processed payment notifications: the ID and type of each notification Dodo sends us, so a payment is never counted twice. These do not contain your name or email.

We use this only to run your account, keep your resumes and applications available on your devices, unlock paid downloads, take payments, stop abuse and answer your questions. We do not use it for advertising, we do not read your resumes except where needed to fix a problem you ask us about or where the law requires it, and we do not share them.

Companies that handle data for Folio

We use a small number of providers. They process data on our behalf, under their own terms and privacy notices:

• Vercel hosts the website. Like any host, it handles the requests made to the site, including your IP address and browser details, and keeps server logs.
• Google, only if you choose to sign in with it. It checks who you are and tells us your name and email address; it follows its own privacy notice and can see that you signed in to Folio.
• Neon hosts the database where the account data above is stored, including the resumes and job applications of signed-in users.
• Groq, only when you use AI writing help (rewrites, summaries, tailoring or cover letters). See “Your resume and AI” below.
• Jooble, Adzuna and Careerjet, only when you use Jobs. See “Job search” below.
• Dodo Payments processes payments and is the merchant of record. It collects your payment details, billing details and email, works out tax, sends receipts and runs the page where you manage or cancel a subscription. Dodo is responsible for that data under its own privacy notice.

The “Created with Grok” badge on some pages is loaded as a script from grok.com, so that service can see your IP address and browser details when a page loads. We do not give it your resume or account details.

We do not sell your personal data, and we do not share it with anyone else except where the law requires it.

Your resume and AI

Parsing, scoring and job matching are done by code running in your browser. Your resume is not sent to any AI service unless you ask for AI writing help, and Folio does not use your resume to train anything.

AI writing help. When you are signed in and ask for AI help, Folio sends only the text needed for that request to Groq, which runs the AI model and sends back suggestions: for “Improve with AI”, one bullet and its job title; for “Improve this section”, the bullets of that one entry and its title; for “Suggest edits with AI” in Tailor (paid), the job post you pasted plus your headline, skills and bullets; for “Draft with AI” on the cover letter (paid), your resume details as listed for the summary below, plus the company, role, tone and any job post you pasted in Tailor; for “Write my summary”, your headline, job titles, companies, dates, bullets, projects, education, skills, certifications and current summary. Your name, email, phone, city, links and photo are never sent. We ask Groq not to keep this text (zero data retention), and it does not use API data to train its models. Folio does not store the text you send or the suggestions; we only count how many AI rewrites and summaries each account uses per day, to apply daily limits. Suggestions only replace your text if you choose “Use this”, and the AI is told never to add numbers or facts you didn’t write. Check every suggestion before you use it.

Job search

When you search on the Jobs page, Folio asks job search engines, Jooble, Adzuna and Careerjet, for matching ads. Each gets the words you searched for and the place and country you chose. Careerjet also gets your IP address and browser details, because it requires them for every search; Jooble and Adzuna do not. Your resume, name and email are never sent. Suggested searches are made from your resume inside your browser; only a suggestion you tap is sent, as a search.

We count how many searches each account makes per day, to apply daily limits, and keep the job ads a search returned for a short time (minutes for Careerjet, a few hours for Jooble and Adzuna) so the same search is quicker. That copy holds only the public job ads and the search words, not who searched. When you tap Apply, you go to the job's page on Jooble, Adzuna or Careerjet and then to the employer's or job site's own page, which follow their own privacy notices. Jobs you save are stored with your other applications.

Cookies and local storage

• Sign-in cookie: when you sign in, Folio sets a secure session cookie so you stay signed in, plus a short-lived cookie (about five minutes) that caches your session. They are needed for the site to work and are removed when you sign out or they expire.
• Local storage: used for your resumes, theme, language, application tracker and sync record, as described above.
• Payment page: Dodo Payments may set its own cookies on its checkout and billing pages. See Dodo’s privacy notice.

Folio does not set advertising cookies and does not use analytics or tracking tools.

How long we keep things

• Resumes and other browser data: in your browser, until you clear it. If you are signed out, we hold no copy.
• Resumes and applications saved to your account: until you delete them (or delete your account). Deleted items stay only as an empty marker until your account is removed; “Delete my saved resumes and applications” on the Resumes page removes the rows completely.
• Account details, plan and credits: for as long as your account exists.
• Sign-in sessions: until they expire (a session lasts for a limited time after sign-in) or you sign out, and they are removed when an account is deleted.
• Payment records: Dodo Payments keeps its own records of purchases, for as long as it and the law require, such as for tax and accounting. We may keep the payment references on your account for the same reasons.

Your choices and rights

You can ask us to:

• tell you what account data we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and the data tied to it, including your saved resumes and applications.

To do any of these, get in touch through the Contact page, and write from or give the email address on your account so we can check it is you. You can delete your saved resumes and applications yourself, any time, with the “Delete my saved resumes and applications” button under “Your data” on the Resumes page. That removes them from our database for good. To delete the whole account (name, email, sign-in records and plan), use “Delete my account” in the same place; it also cancels an active subscription. You can still ask us to do it. Deleting your account ends your plan and any unused credits, and does not by itself refund a payment (see our Refund and Cancellation Policy). Data that Dodo Payments holds as a merchant of record is handled under its own privacy notice, and you can also contact Dodo about it. Depending on where you live, you may have more rights, such as objecting to processing or complaining to your local data protection authority.

You can also remove everything stored in your browser yourself by clearing this site’s data, and you can sign out at any time. Copies in a browser are separate from the copies in your account, so delete both if you want everything gone.

Children

Folio is not meant for anyone under 16. Please do not create an account if you are under 16. If you think a child has given us personal data, get in touch through the Contact page and we will delete it.

Where data is processed

Vercel, Neon and Dodo Payments run services in several countries, so your account data may be processed in a country other than the one you live in. We choose providers that protect data under their own policies and agreements, but the privacy laws there may differ from yours.

Security

Passwords are stored hashed, connections to the site use HTTPS, and payments never pass through our own servers. No system is perfectly secure, so please use a password you do not use anywhere else.

Changes to this policy

If we change how we handle data, we will update this page and the “Last updated” date above. If the change is important we will say so on the site or by email.

Contact

Questions about privacy, or want to use your rights? Please get in touch through the Contact page.