Privacy Policy

WyrdFold (“we”, “us”) is operated by Daniel Joffe, 1245 N Kings Rd #27 West Hollywood CA 90069. This policy explains what personal data we process when you use WyrdFold and the choices you have. For any privacy question, contact us at privacy@wyrdfold.com.

We collect the following categories of personal data to operate the service:

• Account data — your email address. We use magic-link sign-in, so we do not store a password.
• Authentication data — sign-in tokens and session identifiers used to keep you logged in and to secure your account.
• Uploaded files — the resumes you upload (PDF or DOCX), including work history, education, skills, and contact details.
• Derived experience documents — structured profiles extracted from your resumes to power our matching engine.
• Conversation transcripts — your interactions with our AI assistant during the job-search process.
• Generated outputs — tailored resumes, cover letters, and match scores produced for you.
• Match analysis — the fit score for a role, the per-axis breakdown behind it (skills, seniority, domain, title), and a written explanation of the result. This is generated about your career history, shown to you in the app, and never shared with employers.
• Job interactions and application history — roles you save, hide, or give feedback on; the targets you follow; your pipeline stage for a role and when it changed; and a record of which job alerts we have already sent, so we do not send them twice.
• Preferences — your job-alert and notification settings, and the filters and score thresholds you set on your lists.
• Usage & device data — IP address, browser type, pages visited, timestamps, and feature interactions, used to operate and improve the service.
• Billing data — your subscription status and a Stripe customer reference. Payment card details go to Stripe rather than being stored by WyrdFold.
• AI provider keys — only if you run a self-hosted WyrdFold and supply your own, in which case they are stored encrypted. Not applicable to the hosted service, which does not offer this.

We use your data to match you to relevant roles, score how well they fit, generate tailored applications from your real experience, send you the job alerts you ask for, operate and secure the service, and — if you subscribe — manage billing. We do not use your career data to train our own models, and we do not sell it. Improving the service is not the same as training a model on you: when we say we improve WyrdFold, we mean noticing that people abandon a particular step, or that a page is slow. Your resume and career history are not training data.

To score matches and draft applications, the relevant parts of your profile and the job text are sent to third-party large-language-model providers (“AI providers”) through OpenRouter, a service that routes requests to them. Only the information necessary to complete your request is sent. We have configured our OpenRouter account for Zero-Data-Retention across all model groups and have opted out of provider training. In practice that means requests are routed only to providers offering zero-retention processing, and not to providers that would train on the content.

We should be precise about the limits of that, because it is a configuration rather than a promise we can make on another company’s behalf. It governs the content of requests. OpenRouter still keeps its own record of each request — timing, model, token counts, cost — so that we can be billed, and a provider may hold content transiently while it is serving the request. We do not control these third parties’ policies, and they can change independently of our settings. What we control is the configuration above, and we will update this page if it changes.

Bring-your-own-key (BYOK) is not currently offered on the hosted service, so AI features here always run on our provider account. A self-hosted WyrdFold can be configured with its own AI provider key, in which case data goes directly from that deployment to the provider and we neither receive nor process it.

We rely on the following sub-processors to run WyrdFold:

• Supabase — database, authentication, and file storage.
• Vercel and Railway — application and API hosting.
• OpenRouter and the AI model providers it routes to — matching and document generation.
• Stripe — subscription payments.
• Voyage AI — text embeddings used for matching. Receives job postings, role labels, and extracts of your experience profile — job titles, employers, dates, skills, and accomplishments — which are turned into numeric vectors so we can compare them to roles. Your name, email, phone number, address, and profile links are not part of those extracts, and no account identifier is sent with them.
• Brave Search and Firecrawl — discovering and fetching public job postings. These receive job URLs and role-keyword search queries (for example a job title plus a careers-site filter). They are not sent your resume, your profile, or your identity.
• Sentry — error monitoring.

WyrdFold does not make automated decisions that have legal or similarly significant effects on you. All AI-generated content — including match scores, resumes, and cover letters — is provided as a draft for your review and editing before any submission or use. You retain full control over the final content you choose to share with employers.

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Running the service (matching, generation, account) — performance of our contract with you.
• Billing and receipts — performance of our contract.
• Security, fraud prevention, and service reliability — our legitimate interests. Those interests are: keeping the service secure, preventing abuse and fraud, keeping it reliable and improving it, and protecting our legal rights. We balance them against your rights, and you can object (see below).
• Tax, accounting, and responding to lawful requests — compliance with a legal obligation.
• Analytics — your consent, where required.
• Optional job-alert emails — your consent.

We share your data with the categories of recipient below, and we do not sell it. Those categories are: the sub-processors listed above; recipients you direct us to (for example, exporting a document), and where required by law — such as in response to a court order, subpoena, or a fraud investigation.

If WyrdFold is acquired, merged, or sells assets, your data may transfer as part of that transaction. We do not sell your personal data, and we do not use your personal information for cross-context behavioral advertising.

We keep your data for as long as your account is active. You can delete your account and the data associated with it at any time from Settings → Delete account. Indicative retention periods:

• when you delete your account via Settings, all data associated with it is removed from our database immediately;
• backups that may still contain the data are cycled out within 30 days;
• billing records are retained for up to 7 years where required by law.

Those periods describe our database and backups. Deletion does not travel instantly through every third party: Stripe keeps payment records for its own legal and accounting obligations, hosting and error-monitoring providers cycle their logs on their own schedules, and AI providers process under the arrangement described above. We delete what is ours and instruct our processors accordingly; we cannot reach into another company’s systems and erase a log by hand.

Deletion covers Your Content (your profile and experience data and any resumes you upload), Generated Content, saved jobs and pipeline history, notification settings, and your account itself. Before deleting, you can download all of it from Settings → Export my data — the export covers the same records the deletion removes.

Generated Content — the resumes and cover letters WyrdFold produces for you — is yours, as set out in our Terms of Service. Deleting your account removes our copies, not any copy you have downloaded or already sent.

Deleting your account also cancels any active subscription, so billing stops — see our Terms of Service for what that means for the period you have already paid for.

Depending on where you live — for example under the GDPR (EEA/UK) or the CCPA/CPRA (California) — you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data (“erasure”).
• Port your data — receive it in a structured, machine-readable format. The in-app export produces exactly this.
• Restrict processing in certain circumstances, for example while a correction request is being resolved.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time where we rely on it, such as job alerts. Withdrawing consent does not affect processing that already happened while consent was in place.
• Complain to your local data-protection authority.

You can do most of this yourself in Settings — export, correction, and deletion are all self-service — or contact us at privacy@wyrdfold.com. We do not charge for these requests or treat you differently for making one.

This section is our notice to California residents under the CCPA/CPRA. It restates, in the form that law expects, what the rest of this policy already describes.

What we collect and where it comes from. The categories are listed under Information we collect above: identifiers (email, account and session identifiers, IP address), professional and employment information (your resumes, derived profile, and match analysis), internet activity (pages visited, feature interactions), commercial information (subscription status), and the content you create in the product. Most of it comes directly from you; the rest is generated by the service as you use it, or received from Stripe in the case of subscription status.

Why we collect it. To provide the service you asked for — matching, scoring, and document generation — plus billing, security and fraud prevention, service reliability, and legal compliance. These are the business and commercial purposes for which we collect each category.

Who receives it. The sub-processors listed above, plus the categories of recipient under How we share data.

How long we keep it. See Data retention and deletion.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising — as those terms are defined by the CCPA/CPRA. We have not done so in the preceding 12 months, and we do not knowingly sell or share the personal information of anyone under 16.

Your rights and how to use them. You have the rights to know, access, delete, correct, and to non-discrimination for exercising them. Deletion, correction, and export are self-service in Settings; otherwise email privacy@wyrdfold.com. Emailing from the address on your account is the usual way we verify a request, and we may ask for other information reasonably necessary to confirm your identity — for example if you no longer have access to that inbox. We generally respond within 45 days, or within the period required by applicable law, and where permitted we may extend and will tell you if we do. An authorized agent may act for you with your written permission and verification of your identity.

Appeals. If we deny a request you make under California privacy law, you may appeal by replying to our decision or emailing privacy@wyrdfold.com with “appeal” in the subject. We will review it and tell you the outcome, and our reasons, within the time the law allows.

We use only the cookies the service needs to function. We do not use advertising or cross-site tracking cookies, and we do not run an analytics or session-recording script in your browser.

• Essential & authentication — to keep you signed in and to secure the service. These are required for WyrdFold to work.

Our error monitoring (Sentry) runs on the server only. It records errors our API hits so we can fix them; it sets nothing in your browser and does not track you between sites.

Company logos on job listings are images loaded directly by your browser from Brandfetch and DuckDuckGo, addressed by the employer’s web domain. Those providers therefore see your IP address, your browser type, and which company’s logo was requested. We send them no account identifier and no referring page, they set no cookies we use, and we store no images ourselves — only the employer domain the link is built from. If a logo does not load, the listing falls back to a plain initials tile.

You can control cookies through your browser. WyrdFold does not currently respond to browser “Do Not Track” signals.

We operate from the United States, and our sub-processors are primarily US-based, so if you are outside the US your data is transferred there and processed there. Where the law requires a transfer mechanism, we rely on appropriate safeguards such as the Standard Contractual Clauses or, where a provider is certified, the EU–US Data Privacy Framework.

We protect your data with technical and organizational safeguards, including encryption in transit, access controls, and least-privilege permissions. Because sign-in is a magic link, we encourage you to protect access to your email account, since it is used to authenticate you. No system is perfectly secure, but we work to keep your data safe. If a security incident affects your personal information, we will provide notifications where required by applicable law.

WyrdFold is not intended for anyone under 18, and we do not knowingly collect data from children.

We may update this policy as the service evolves. We will post the new version here and update the effective date, and will notify you of material changes where required.

Questions about your privacy? Email privacy@wyrdfold.com (privacy) or legal@wyrdfold.com (legal), or write to Daniel Joffe, 1245 N Kings Rd #27 West Hollywood CA 90069.