FirePath

Privacy Policy

Last updated: August 19, 2026

FirePath ('we', 'us', or 'our') is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our resume builder service.

Information We Collect

Account Information

When you create an account we collect your name, email address, and, if you sign in via OAuth, a profile photo from your chosen provider (GitHub or Google). Passwords are hashed using bcrypt and never stored in plain text.

Resume Data

All resume content you create (work history, skills, contact details, references, notes, and similar information) is stored so you can access it across devices. You own your data at all times.

We may access and use your data as necessary to operate, improve, debug, and secure the service, and to comply with applicable legal obligations. We do not sell your resume data or use it for advertising.

Usage Data

We may collect basic server-side logs (IP address, request timestamps, error traces) for security and debugging purposes. These logs are retained for a maximum of 30 days.

How We Use Your Information

  • To provide and maintain the service
  • To send transactional emails (verification, password reset)
  • To provide support and resolve account, billing, and technical issues
  • To investigate abuse, fraud, suspicious activity, and security incidents
  • To improve and debug the application
  • To comply with legal obligations

AI Processing

Several features use third-party AI models to draft and analyse resume content. When you use them, the relevant text is sent to Anthropic or to Google (Gemini API) to generate a response. Both providers process data on servers in the United States.

We limit what these features send. The writing and analysis tools (bullet builder, summary, cover letter, skills, and keyword scans) send only the section text you are working on together with the job context you supply. They do not send your name, email address, phone number, or street address.

The one exception is resume upload. When you upload an existing resume for us to import, the full text of that document is sent for extraction, and that text includes whatever contact details the document contains. Extracting those fields is the purpose of the feature. If you would rather not send them, you can enter your resume manually instead.

These providers act as processors on our behalf under their API terms. They do not use your content to train their models, and we do not use your content to train any model of our own.

Service Providers

We do not sell, trade, or rent your personal information to third parties. We share data with the following providers, each only to the extent needed for the purpose shown, and each bound by confidentiality obligations under their terms of service.

  • Anthropic: AI writing and resume analysis (United States)
  • Google (Gemini API): AI writing assistance (United States)
  • Stripe: Payment processing (United States)
  • Resend: Transactional and marketing email delivery (United States)
  • Supabase: Managed database hosting
  • DigitalOcean: Application and file hosting

If you choose to share a resume publicly or send exported files yourself, the information included in that resume may be visible to the people who receive the link or file.

International Transfers

Some of the providers listed above process data outside Canada, including in the United States. Data held outside your country may be accessible to that country's courts and law enforcement under its own laws. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses as the transfer safeguard.

Cookies

We use HTTP-only session cookies for authentication. These are required for the service to function and cannot be disabled without logging out. Advertising measurement tools, described in the next section, may also set their own cookies when they are active.

Analytics and Advertising Measurement

We use a self-hosted analytics tool (Umami) to understand how the site is used. It does not use cookies and does not follow you across other websites.

When we run advertising campaigns, we may use the Meta Pixel and Google tags on our site. These tools can set cookies and may share limited information about your visit with Meta and Google, such as the pages you viewed and whether you created an account or purchased a plan, so we can measure whether our ads work. We may also send Meta a server-side record of a completed purchase; when we do, personal identifiers such as your email address are hashed before they are sent.

Your resume content is never shared with advertising platforms. You can limit this measurement with browser settings or extensions that block these tools; the service works normally without them.

Data Retention

Your account and resume data are retained for as long as your account is active. You may delete your account at any time from the Settings page, which will permanently remove all associated data within 30 days.

Contact submissions are retained for as long as reasonably necessary to respond, follow up, and keep support records, after which they may be deleted or anonymized.

Legal Bases for Processing

Where the UK or EU General Data Protection Regulation applies to you, we process your personal data on these bases: to perform our contract with you (operating your account, storing and rendering your resumes, and processing payments); on our legitimate interests (securing the service, preventing fraud and abuse, debugging, and measuring our advertising where you have not opted out); with your consent (advertising and analytics cookies where consent is requested, and optional emails such as job alerts); and to comply with legal obligations (tax and accounting records).

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a portable copy of your personal data, to withdraw consent you previously gave, and to object to or restrict certain processing. You can delete your account and all associated data yourself from the Settings page. For anything else, contact us at the address below and we will respond within 30 days.

Exercising these rights costs nothing and we will not restrict your access to the service for asking. If you believe we have handled your data improperly, you may also complain to your local data protection authority: the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the UK Information Commissioner's Office, or your EU member state supervisory authority.

Security

We implement security measures including encrypted connections (HTTPS), hashed passwords, short-lived authentication tokens stored in HTTP-only cookies, access controls, and audit logging for sensitive administrative actions. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or a notice on the site. Continued use of the service after changes constitutes acceptance of the updated policy.

Who We Are, and How to Reach Us

FirePath is operated from Ontario, Canada. We are the controller responsible for the personal data described in this policy.

If you have questions about this Privacy Policy, or want to exercise any of the rights described above, contact us at team@firepathresume.com.