Privacy Policy
Last Updated: November 2, 2026
The short version: CVisto does not require an account. Your resumes, cover letters, photos and personal details are stored on your device. Your resume text leaves your device only when you use an AI writing feature, and only after you have given explicit permission. We use anonymous usage statistics (which you can turn off) to improve the App. We do not sell your data, we do not show ads, and we do not track you across other apps or websites.
This Privacy Policy explains what information CVisto ("the App", "we", "us") handles, how it is used, who it is shared with, how long it is kept, and how you can control or delete it. CVisto is developed and operated by Tuğberk Tabak, an independent developer based in Türkiye, who is the data controller for the processing described here.
1. Information Stored Only on Your Device
To build your resumes and cover letters, you may enter information such as your name, job title, email address, phone number, address, links, work experience, education, skills, languages, certificates, a profile photo and the text of your cover letters.
All of this content is stored locally on your device. It is not uploaded to our servers and we cannot see it. This also applies to:
- Resume import: PDF files, scanned paper resumes (camera) and LinkedIn data export files that you choose to import are read and processed on your device.
- Profile photos: photos you select from your library or take with the camera are processed (for example cropped or background-adjusted) on your device.
- ATS check: the resume score and the suggestions in the ATS report are calculated on your device.
- On-device AI: on supported devices some writing suggestions are generated by Apple's on-device models (Apple Intelligence). This processing happens on your device and your text is not sent to us.
- Exported files: PDFs and images you export or share are created on your device and sent only where you choose (for example Mail, Files or AirDrop).
The App asks for access to your photo library (to select or save images) and your camera (to scan a printed resume or take a photo) only when you use those features. You can change these permissions at any time in your device Settings. The App can also send local notifications (for example reminders) if you allow them; these are scheduled on your device.
2. Information We Collect
CVisto collects only the minimum information required to run subscriptions and the AI writing service:
| Data | Why | Where |
|---|---|---|
| Random anonymous user ID (generated by the App on first launch) | Links your subscription and AI credit balance to your installation. It is not linked to your name, email or Apple ID. | Supabase, RevenueCat |
| Technical information: device model (e.g. "iPhone"), app version, region/country setting, last time the App was opened | Operating the service, troubleshooting and understanding which app versions are in use. | Supabase |
| Subscription information: subscription status, plan (weekly/yearly), trial status, product ID, purchase and expiry dates, anonymous transaction identifiers | Unlocking Pro features, validating purchases and managing AI credits. | RevenueCat, Supabase |
| AI usage records: which AI feature was used, credits used, time, status, number of tokens processed | Counting AI credits, preventing abuse and keeping the service reliable. These records do not contain your resume text or the AI's response. | Supabase |
| Anonymous usage statistics: app events (for example app opened, screen viewed, resume exported, AI feature used), session information, app version, device model, OS version, language, approximate region (country/city derived from IP address, the IP address itself is not stored), and a random app-instance identifier | Understanding how the App is used, finding problems and improving features. Never contains your resume or letter content, name, email or phone number. You can turn this off at any time (see section 4). | Google (Firebase Analytics) |
| Resume / letter text you send to AI (only with your permission, see section 3) | Generating the text you asked for. | Passed through Supabase to Anthropic; not stored by us |
We do not collect your name, email address, phone number, precise location, contacts, browsing history, advertising identifier (IDFA) or payment card details.
3. AI Writing Features and Third-Party AI (Anthropic Claude)
CVisto Pro includes cloud AI writing features, such as writing a professional summary, improving bullet points, writing cover letters and emails, reviewing a full resume and cleaning up imported resumes. These features are powered by Claude, an AI model provided by Anthropic PBC (a third-party AI service).
We ask before anything is sent
The first time you use a cloud AI feature, the App shows a permission prompt explaining that your resume text will be sent to Anthropic's Claude AI. Nothing is sent unless you tap "Continue". If you choose "Cancel", nothing is shared and you can keep using the rest of the App.
What is sent
Only the content needed for the feature you selected, for example the text of your resume (which may include your name, job history, education and skills), the job title or company you are applying to, the bullet points you want to improve, or the notes you typed. Your profile photo is never sent. Content is sent only when you tap an AI button; nothing is sent in the background.
How it is sent and handled
- Your request travels over an encrypted (HTTPS/TLS) connection to our server function hosted on Supabase, which forwards it to Anthropic and returns the result to your device.
- We do not store the text you send or the text the AI returns. Only the usage record described in section 2 is kept.
- Anthropic processes the content under its commercial API terms. Under those terms, Anthropic does not use data received through its API to train its models, and it keeps such data only for a limited period (for example for safety and abuse monitoring), as described in Anthropic's Privacy Policy and Commercial Terms.
Withdrawing permission
You can withdraw your permission at any time in Settings → "Send resume text to AI" inside the App. After you turn it off, no further content is sent to the AI service. If you use an AI feature again later, the App will ask for your permission again.
About AI output
AI-generated text can be inaccurate or incomplete. Always review it before using it in a resume or application. See our Terms of Use for details.
4. Third-Party Service Providers
CVisto uses a small number of service providers that are strictly necessary for the App to work:
- Apple (App Store / In-App Purchase): processes all payments. We never receive your payment card or billing details. Apple Privacy Policy
- RevenueCat, Inc.: validates purchases and manages subscription status using the anonymous user ID. RevenueCat Privacy Policy
- Supabase, Inc.: hosts our database (anonymous user ID, technical and subscription information, AI usage records) and the server function that connects to the AI service. Supabase Privacy Policy
- Anthropic PBC: provides the Claude AI model used for cloud AI writing features, only with your permission (see section 3). Anthropic Privacy Policy
- Google LLC (Firebase Analytics): collects the anonymous usage statistics described in section 2. Firebase Privacy and Security · Google Privacy Policy · How Google uses data from apps
Anonymous usage statistics (Firebase Analytics)
We use Firebase Analytics only to count and understand app events. We have configured it so that:
- the advertising identifier (IDFA) is not collected, and the App does not request App Tracking Transparency permission because it does not track you;
- ad storage, ad user data and ad personalization are disabled, and the data is not linked to Google advertising services;
- the anonymous user ID used for subscriptions is not sent to Firebase, and no resume or letter content is ever included in events.
How to opt out: turn off Settings → "Share anonymous usage data" in the App. After you turn it off, no usage statistics are sent.
These providers process data only on our behalf and for the purposes described in this policy. Each of them is bound by its own privacy and security commitments, which provide the same or equal protection of user data as described in this Privacy Policy and as required by Apple's App Store Review Guidelines.
CVisto does not use advertising SDKs or advertising networks, and does not track you across apps and websites owned by other companies. Apart from the anonymous Firebase Analytics statistics described above, the App contains no other analytics or tracking tools. We never sell or rent your personal data, and we do not use it for advertising, marketing profiles or data brokering.
5. International Data Transfers
Data handled by our service providers may be processed on servers located outside your country:
- Supabase: our database and server function are hosted in the Asia-Pacific (Sydney, Australia) region (ap-southeast-2).
- Anthropic, RevenueCat and Google (Firebase Analytics) process data primarily in the United States.
- Apple processes payments under its own policies and infrastructure.
Where required by law (for example under the GDPR or KVKK), these transfers rely on appropriate safeguards such as the providers' standard contractual clauses and data processing agreements.
6. Legal Bases (GDPR / KVKK)
If you are in the European Economic Area, the United Kingdom or Türkiye, we process data on the following bases:
- Performance of a contract: providing the App, validating subscriptions and counting AI credits.
- Consent: sending your resume text to the third-party AI service. You can withdraw consent at any time as described in section 3.
- Legitimate interests: keeping the service secure and reliable, preventing abuse, and understanding how the App is used through anonymous usage statistics, which you can turn off at any time.
7. Data Retention and Deletion
- Data on your device stays until you delete it. You can delete any resume, cover letter or photo inside the App at any time. Deleting the App removes all locally stored data from your device. If your device backups (such as iCloud Backup) are enabled, a copy may also exist in your own backup, which is controlled by you and Apple.
- Resume text sent to AI is not stored by us. Anthropic retains API data only for the limited period described in its policies.
- Anonymous usage statistics are kept by Firebase Analytics for up to 14 months and then deleted automatically. Because they are not linked to you, the easiest way to reset them is to turn off "Share anonymous usage data" or reinstall the App, which creates a new random app-instance identifier.
- Anonymous user ID, technical, subscription and AI usage records are kept while you use the App and for as long as needed for subscription management, accounting and legal obligations, after which they are deleted or anonymised.
How to request deletion: because CVisto has no accounts, the data we hold is linked only to your anonymous user ID. To request deletion, email us at tugberktabak@yahoo.com with the subject "Data deletion request" and include the User ID shown in the App's Settings screen. We will delete the related records within 30 days. Records that we are legally required to keep (for example for tax purposes) will be kept only as long as required. Deleting data does not cancel a subscription; subscriptions are managed in your Apple ID settings.
8. Your Rights
Depending on where you live (including under the GDPR, UK GDPR, Turkish Personal Data Protection Law No. 6698 (KVKK) and US state privacy laws such as the CCPA/CPRA), you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate data;
- request deletion of your data;
- restrict or object to certain processing;
- withdraw consent at any time, without affecting processing done before withdrawal;
- lodge a complaint with your local data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).
To exercise any of these rights, contact us using the email address below. We do not discriminate against you for exercising your rights.
9. Data Security
All communication between the App and our servers uses encrypted HTTPS connections. API keys for the AI service are stored on the server and are never shipped in the App. Access to our database is restricted. Because most of your information stays on your device, its security also depends on your device; we recommend using a passcode, Face ID or Touch ID. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.
10. Children's Privacy
CVisto is a tool for creating job application documents and is not directed to children under the age of 13 (or the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to This Privacy Policy
We may update this Privacy Policy when the App changes or when the law requires it. The "Last Updated" date at the top shows when it was last changed. If the changes are significant, for example if we start sharing data with a new third party, we will inform you in the App and ask for your permission where required.
12. Contact
If you have any questions about this Privacy Policy or your data, please contact:
Tuğberk Tabak (CVisto)
tugberktabak@yahoo.com