Privacy Policy
Last updated 3 September 2026 — added "Where your data lives"
CVTonic is a CV builder for iPhone, made by Attila Isci. This page explains what the app collects, where it goes, and how to get rid of it. It is written to be read, not to be survived.
The short version
- Your CV is yours. If you are not signed in, it never leaves your phone.
- Signing in syncs it so you do not lose it when you change phone.
- We do not sell your data, we do not show ads, and we do not track you across other apps or websites.
- We do not train any AI model on your CV.
What the app collects
Your CV content
Everything you type into the app: your name, contact details, work history, education, skills, links, projects and anything you add to a custom section. Job descriptions you paste in to match a CV against a role are part of this too, and so is a cover letter and everything you answer to set one up: the company, the role, the hiring manager's name if you know it, and why you want the job. All of it is your content, and you decide whether it stays on the phone or is saved to an account.
Account details
If you create an account, we store your email address and which method you used to sign in (Apple, Google or email). Sign in with Apple can hide your real address behind a relay address, and that works here.
Subscription status
Whether you have an active CVTonic PRO subscription. Apple processes the payment. We never see your card, and we never receive one.
Diagnostics
Crash reports, and anonymous product events such as which screen you opened, which template you picked, and your CV score as a number. These carry no words from your CV.
Where it goes
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Accounts, CV storage, sync | Your email address and your CV content, once you have an account |
| OpenAI | AI review, bullet rewriting, summary writing, cover letters (PRO) | A stripped copy of your CV, only at the moment you ask. A cover letter also sends the job details you filled in |
| Gotenberg on Railway | Renders the PDF for the PRO templates | The finished page as HTML. It is converted and discarded, not stored |
| RevenueCat | Keeps track of whether the subscription is active | Your account identifier and the purchase state |
| Sentry | Crash reports | The crash, and your account identifier. Personal data collection is switched off |
| PostHog | Product analytics | Event names and numbers. No CV content |
| Apple | Payments, Sign in with Apple | Handled entirely by Apple under Apple's own privacy policy |
| Sign in with Google | Handled by Google under Google's own privacy policy |
These companies process data on our behalf. They are not allowed to use your CV for their own purposes.
Where your data lives
Our servers are in the United States: the database runs on Supabase in the eastern US, and OpenAI, Sentry, PostHog and RevenueCat are US companies processing data there too. If you use CVTonic from the EU, the UK, Turkey or anywhere else, saving to an account means your data crosses a border.
For EU and UK users this is an international transfer under the GDPR. Each of these providers commits to standard contractual clauses for such transfers, and we only send them what the table above says, for the purpose it says. Nothing in this section changes the rest of the policy: if you never sign in, your CV never leaves your phone and none of this applies to it.
Four things worth being specific about
What OpenAI actually sees. When you ask for an AI review, a rewritten bullet or a written summary, the app sends a plain-text version of your CV: your name, headline, city, summary, roles, dates, bullets and the skills you listed. It deliberately leaves out your email address, your phone number and every internal identifier. A model that never sees a phone number cannot repeat one back to you.
A cover letter sends a little more, and only then. Writing one also sends the job details you filled in — the company, the role, the hiring manager's name if you typed one, the lines you chose to lead with, and why you said you want the job. If you pasted a job description it goes too, shortened to fit. That posting is the one thing here that reaches OpenAI only for a letter: matching your CV against a pasted role is arithmetic that happens on your phone, and no model is asked about it. If you would rather not send a hiring manager's name, leave that field empty — the letter opens with "Dear Hiring Manager" instead.
Free exports never leave your phone. The free template is rendered by iOS itself. No CV is uploaded to produce it. Only the PRO templates go through our renderer, and even then the page is converted and thrown away.
Crash reports are not a back door. Sentry runs with personal data collection disabled and performance tracing off. It receives the error and your account identifier, not the contents of the screen you were on.
Analytics carry numbers, not sentences. A typical event says that a template called "sharp" was previewed and the score was 74. It does not carry your name, your employer, or a single line of your CV.
What we do not do
- No advertising, and no advertising identifier. The app does not request permission to track you, because it has nothing to track you with.
- No selling or sharing of personal data with anyone for their own use.
- No training of AI models on your CV. We reach OpenAI through their API, and under their API policy that content is not used to train their models.
How long we keep it
Your CV stays until you delete it. Crash reports and analytics events age out on the providers' own retention schedules, which are measured in months, not years. Delete your account and the CV data goes with it, immediately, not on a queue.
Deleting your data
There are two situations, and the app has a control for each.
If you are signed in
Settings, then DANGER ZONE, Delete account. This removes your resumes and your score history along with the account itself. It is a double confirmation, because it cannot be undone.
If you are not signed in
Your CV was only ever on this phone, so there is no account to close. Settings, then DANGER ZONE, Delete my data. It clears the drafts from the device and puts the app back to how it was the first time you opened it.
Your rights
Wherever you live, you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. In most cases the two controls above are faster than writing to us, but write anyway if you would rather. If you are in the UK, the EU or Turkey, you also have the right to complain to your local data protection authority.
Children
CVTonic is rated 4+ and contains nothing unsuitable for any age, but it is a tool for people looking for work and it is not directed at children under 13. We do not knowingly collect data from them.
Terms of use
CVTonic PRO is sold under Apple's standard licence agreement, the Apple Standard End User License Agreement. Subscriptions renew until you cancel them, and you cancel in your App Store settings rather than here.
Credits
The city and country lists in the app come from GeoNames, used under CC BY 4.0.
Changes
If this policy changes in a way that affects what happens to your CV, we will update the date at the top and say what changed. We will not quietly widen it.
Contact
Questions, requests or complaints: hello@cvtonic.app. A person reads it.