Privacy Policy

Last updated 23 October 2026

Your CV is personal. We collect as little as we can, never store your CV file, and never sell your data. This page explains what we keep, why, for how long, and who helps us.

Who we are

Ido Levit, trading as CVArcade ("we", "us"), Tel Aviv, Israel, is the controller of the personal data described here. Contact: hello@cvarcade.com.

What we collect and why

Your CV file

• We read your file in memory, once, to build your draft. We never store the file.
• To read it, we send it to Anthropic's Claude AI through Vercel AI Gateway. A PDF is sent as the file itself; for a Word file or pasted text, we send the text. If Anthropic is unavailable, the Gateway may route the same request to Claude on Amazon Bedrock or Google Vertex AI instead.
• Every request is sent with zero data retention: the AI provider processes it to answer and doesn't store it. We use your CV only to build your draft, and never to train AI models.
• We don't log CV text.
• If you upload a PDF, your browser keeps it in memory so the editor can show it next to your draft. It isn't uploaded again, and it's gone when you reload the page.

Your draft

• The AI fills in your name, headline, location, summary, entries (jobs, education, projects and so on), skills, languages, interests, links and, if your CV has one, your email address. We store this as a draft in our database (Neon), along with your template choices.
• There is no phone number field. The AI is told to leave out phone numbers, street addresses, dates of birth and age, ID and passport numbers, nationality, visa status, religion, health, family details and photos. We then check its output and remove any phone numbers, street addresses, birth dates, ID numbers and email addresses other than yours that slipped through. Please don't add sensitive details like these yourself.
• For each line the AI writes, we keep a short quote from your CV showing where it came from, so you can check it. We delete these quotes after 7 days.
• Your draft is reached through a private link with a secret token. We store only a hash of the token, not the token itself.

Your published game

• When you publish, your game and a plain-text version become public at cvarcade.com/g/<your-link>. Anyone with the link can see them. We ask search engines not to list them.
• When someone shares your link, apps like WhatsApp, LinkedIn and Slack show a preview picture with your name, your headline and, on some games, your current or most recent job (where, or your title, and its dates). We draw that picture on our own servers from your published game; nobody else receives your details to make it. Those apps may keep their own copy of a preview after you change, unpublish or delete your game.
• Your email address appears on your published game only if it's in your details. You can remove it in the editor before you publish.
• We keep your last 5 published versions.

Visit statistics

• When someone opens a published game, we add one to a counter for that game and that day: a visit, and if they press Play, open Contact or click a link out, those too. We also count text-version views. The page shows the game's owner only these totals, never who visited.
• Along with a visit we count the website the visitor came from (just its name, such as linkedin.com, never the address), their country, and the short source tag at the end of a link if the owner added one (such as ?from=linkedin). The owner sees a place only once at least 3 visitors came from it; smaller ones are grouped as "Other".
• To count each visitor once a day, we use the keyed IP hash described under "Security and abuse prevention" below. It is never stored with the counts, and the counts can't be traced back to a person. The owner's own visits aren't counted.
• Our host, Vercel, also counts page views with Vercel Web Analytics on our pages and published games, to show us how the site is used. It sets no cookie and stores nothing on your device, and it doesn't follow you across websites. It isn't used on private draft links, checkout or account pages.

Your account (Clerk)

You only need an account to publish and to use your account. Sign-in is run by Clerk. Clerk holds your email address, and if you sign in with Google, your Google name and profile picture. It also records the IP address and browser of each sign-in session. We don't keep our own copy of your email; we ask Clerk for it when we need it (your account page, your data export, the "your game is live" email). If your Clerk account is deleted, Clerk tells us and we delete the games and drafts in your account the same way Delete everything does.

Payments (Dodo Payments)

• Dodo Payments is our reseller and Merchant of Record. It collects your payment and billing details directly on its own checkout page; we never see your card number. Dodo Payments is a separate controller of that data and uses it under its Privacy Policy, for example for payment, fraud checks, tax and disputes.
• When you start a checkout, we send Dodo Payments your account email so the checkout is filled in for you, and a reference to your game.
• Dodo Payments tells us when a payment, a refund or a dispute happens. Its notices can include details such as your name and email. We keep a record of each payment: its ID, the amount, the currency, the status and the dates.

Email (Resend)

When your game goes live, we email you a confirmation at your account email, sent through Resend. If a payment goes through but your game needs one more step, we email you about that too. We don't send marketing email, and the emails have no tracking pixels.

Security and abuse prevention

• To limit how many CVs one person can read per day, how many error reports we accept, and to count a visit to a published game once a day, we store your IP address only as a keyed hash, for 2 days.
• When you upload a CV, Vercel BotID runs a check in your browser to tell people from bots.
• Our host, Vercel, keeps standard request logs, which include IP addresses, for a limited time.
• If a page or game hits an error in your browser, it sends us a short technical report: the error message, whether it was a game or one of our pages, and where in our code it happened. Before we log it, we remove quoted text, links, email addresses and long codes, which is where your details would appear. It's kept in our host's logs for a limited time.

Legal bases

• Contract: reading your CV, keeping your draft, publishing your game, your account, payments and service emails. We need these to give you the service you ask for.
• Legitimate interests: security, rate limits, bot checks, request logs and error reports, which keep the service safe and working; and visit statistics, which help owners see how their game is doing and help us improve the service. You can object (see your rights below).
• Legal obligation: payment records we must keep for tax.

How long we keep it

When you delete everything, payment records stay for tax, but they are no longer linked to you or your game. Dodo Payments keeps its own records of your purchase under its Privacy Policy; ask it directly to use your rights there.

Who helps us

These companies process data for us, only to run CVArcade:

• Vercel: hosting, request logs, bot checks, website analytics, and the AI Gateway that routes CV reading.
• Neon: our database.
• Anthropic: the AI that reads your CV, with Amazon Web Services (Bedrock) and Google (Vertex AI) as fallback routes, all with zero data retention.
• Clerk: sign-in and accounts.
• Resend: sending our emails.
• ImprovMX: forwards the email you send us.
• Google (Gmail): the mailbox where the email you send us (reports, refund and privacy requests) is kept.

Dodo Payments sells your purchase to you as Merchant of Record, handling checkout, payment, tax and refunds. It is a separate controller of your payment data, not a company acting for us; see its Privacy Policy.

We don't sell or rent your data, and we don't show ads.

International transfers

We're based in Israel, and most of the companies above process data in the United States. Where data leaves the EU, the UK or Israel, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, as each provider offers. Dodo Payments processes payment data in the United States and India and through its UK group company, and relies on the European Commission's Standard Contractual Clauses with the UK Addendum.

Your rights

Under the GDPR, the UK GDPR and Israel's Protection of Privacy Law, you have the right to:

• Access and portability: get a copy of your data. Use Export in your account to download everything we hold about you as a JSON file.
• Erasure: use Delete everything in your account. It deletes your games and drafts, takes any live game offline, and deletes your Clerk account if you have one.
• Rectification: fix your details in the editor at any time.
• Restriction and objection: ask us to limit or stop processing your data.
• Complaint: complain to your data protection authority, or in Israel to the Privacy Protection Authority.

If you never signed in, open your account in the same browser you used: Export and Delete everything work there for that browser's drafts. For anything else, email hello@cvarcade.com. To protect your data, we'll ask you to sign in with the email address the request is about. We answer within one month.

Cookies and storage on your device

We use only what the service needs to work. No advertising and no tracking cookies. Our visit statistics and website analytics set no cookies and store nothing on your device.

• __Host-sid: a random token that lets this browser edit the drafts it created. We store only its hash. It lasts 30 days and renews while you keep using CVArcade.
• cvarcade:draft and cvarcade:drafts in your browser's local storage: the private links of your recent drafts, so you can get back to them. They're sent to us only when you open a draft.
• cvarcade:reload-note:… in your browser's session storage: one fixed status line of ours (for example "Discarded your changes.", or the date of the version you loaded), kept across a page reload and removed when the editor next opens it.
• Clerk sets its own sign-in cookies on cvarcade.com and clerk.cvarcade.com when you sign in.
• At checkout you leave cvarcade.com for Dodo Payments' checkout page, which sets its own cookies under its Cookie Policy.

Security

All traffic is encrypted with HTTPS. Secret tokens are stored only as hashes, IP addresses only as keyed hashes, and payment details stay with Dodo Payments. Access to our systems is limited and protected. No system is perfectly secure, but if a breach affects you, we'll tell you and the authorities as the law requires.

Children

CVArcade isn't for anyone under 16. If you believe a child has given us their data, email hello@cvarcade.com and we'll delete it.

Changes

We'll post any update here and change the date at the top. If a change matters, we'll email account holders before it takes effect.

Contact

Questions or requests about your data: hello@cvarcade.com.