Privacy Policy
Effective date: October 3, 2026
This policy explains what HoneDraft (“we”, “us”) collects when you use honedraft.com, why, and what you can do about it.
The short version
- Your resume is saved to your account. Once you create an account, your resumes are stored with it on our servers, so you can open them on any device. Before that, your work stays only in the browser tab you're using. Uploaded files are read once to get the text, then discarded.
- AI providers process your text only to do the work. They don't use it to train their models.
- We never see your card number. Payments go through Whop.
- We never sell your data. We measure our ads with the Whop Pixel, Google Analytics and the Meta Pixel, and you can turn that off any time under Your privacy choices.
- You're in control. Delete your resumes or your whole account at any time, or email support@honedraft.com and we'll delete what we hold.
What we collect and why
We collect only what we need to run HoneDraft, take payment and answer you.
| What | When | Why |
|---|---|---|
| Resume text and your chat answers | When you upload, paste or describe your experience | To score, rewrite and tailor your resume, and to keep it in your account |
| Job descriptions you paste | When you tailor a resume | To match your resume to the job |
| Username and password | When you create an account | To sign you in. We never see your password; Clerk stores it in scrambled form |
| Email address | When you create an account, start a trial, buy a plan or contact us | To confirm your account, reset your password, and send receipts, trial and renewal reminders, and replies |
| Plan and payment details from Whop (plan, amount, dates, trial status, membership ID) | When you start a trial, buy, renew, cancel or get a refund | To give you the right access and handle billing |
| Messages you send us | When you use the contact form or email support | To reply and fix problems |
| Usage events (for example “score viewed” or “checkout started”) with the page, your device type, your country and region, and the ad or link that brought you on your first and most recent visit | As you use the site | To see which parts of HoneDraft and which ads work |
| Your answers about your job search: career stage, and optionally how soon you want a new job and how you heard about us | On the first onboarding screen | To understand who HoneDraft helps and which audiences to reach. Never shared with ad platforms |
| Ad measurement: the pages you visit on honedraft.com, the ad that brought you, browser IDs from Whop, Google and Meta, your IP address and device details, your email address when you create an account, and when you start a trial or are charged, the plan and amount | While ad measurement is on (see Cookies) | To see which ads work and show them to people likely to find HoneDraft useful |
| IP address and basic device information | On every request | To keep the site secure, limit abuse and fix errors |
We don't ask for sensitive details such as your age, health, race or religion. Please leave them out of your resume unless you choose to include them.
Where your data lives
Your resumes are kept with your account. Here's where each kind of data lives.
- With your account. Your resumes and tailored versions are stored with your account on our servers (Upstash), and your sign-in details with Clerk. Only you can open them, when you're signed in.
- In a browser tab, before you have an account. Work you do before creating an account is kept in that browser tab only. Closing the tab deletes it, and we can't recover it.
- In your browser. Your plan status and a few settings are stored in your browser's local storage on your device.
- Passing through our servers. When you score, rewrite or tailor, your text goes through our servers to our AI provider and back. We don't save it there.
- Kept on our side. We keep your account's resumes, receipts and plan records, messages you send us, short-lived counters that stop spam and duplicate emails, and server logs.
- Where. HoneDraft is run from the United States. Our providers mainly process data in the United States and may use other countries too. If you use HoneDraft from outside the US, your data is transferred to the US.
Who we share it with
We share data only with the service providers that run HoneDraft for us. Except for advertising (see below), they may use it only to provide their service to us.
| Provider | What they do for us | What they receive |
|---|---|---|
| Vercel | Hosts the website and our servers | Requests to the site, IP address, server logs |
| OpenAI | Scores and rewrites your resume (main AI provider) | The resume text, answers and job descriptions needed for each task |
| Anthropic | Backup AI provider if OpenAI is unavailable | The same as OpenAI, only when used |
| Clerk | Runs sign-up and sign-in | Your username, email address, a scrambled (hashed) copy of your password, and the IP address and browser of each sign-in |
| Whop | Takes payments and manages plans and free trials | Your card and billing details (entered in Whop's secure payment form inside HoneDraft's checkout; HoneDraft never sees them), email, purchase and trial history, and the ad campaign that brought you, if any |
| Whop (ads) | Runs and measures our ads | The pages you visit on honedraft.com, the ad that brought you, device and browser details, and your email address when you create an account or start a plan |
| Google (Firebase and Google Analytics) | Measures visits and our ads | The pages you visit, a random ID for your browser (the _ga cookies), device and browser details, your IP address (which Google uses to estimate your location), your HoneDraft account ID (not your name or email), and these events: sign-up, your first resume score, trial start, and each charge with its amount |
| Meta (Facebook and Instagram) | Shows and measures our ads | Through Whop, the ad measurement information above. Directly, through the Meta Pixel and Meta's Conversions API: the pages you visit, browser IDs (the _fbp and _fbc cookies), your IP address and device details, and these events: sign-up, your first resume score, accepting your first three fixes, opening checkout, trial start, subscription, and each charge with its amount. Your email address and account ID are sent hashed (scrambled), never in plain text |
| Resend | Sends receipts, trial and renewal reminders, and contact form messages | Your email address and the content of those emails |
| PostHog | Product analytics: shows us which parts of HoneDraft and which ads work | Usage events, a random visitor ID, the page, device type, country and region, the ad that brought you, and once you sign up your job-search answers. Never your resume text, job descriptions, name, email or phone number |
| Upstash | Stores your resumes, and short-lived counters that block spam and duplicate emails | Your resumes and tailored versions; IP or email address for rate limits (deleted after 1 hour); payment and membership IDs (deleted after 90 days) |
| ImprovMX and Google (Gmail) | Deliver and store email sent to support@honedraft.com | Your emails to us and our replies |
- AI providers. They don't use your content to train their models. They may keep it for a limited time to monitor abuse, under their own policies.
- When the law requires it. We may share information if required by law, or to protect HoneDraft, our users or the public from harm or fraud.
- If HoneDraft is sold or merged, your data may move to the new owner, still covered by this policy. We'll tell you first.
- Advertising. We use the Whop Pixel, Google Analytics and the Meta Pixel to measure our ads. They share the pages you visit here, the ad that brought you and, when you create an account or start a plan, your email address with Whop, Google and Meta (Google never gets your email; Meta gets it hashed), so they can measure our ads and find people like our customers. When you start a trial or are charged, our server tells Google and Meta too, with the amount, using browser details saved at checkout. We don't sell your data or share it with data brokers. You can opt out any time under Your privacy choices.
Cookies and analytics
These are the cookies and browser storage HoneDraft uses.
- Sign-in cookies. When you sign in, Clerk sets essential cookies that keep you signed in (up to 7 days), and we set one that remembers which purchase is yours. Signing out removes them.
- Browser storage. We use your browser's session storage to hold work you do before creating an account (in that tab only), and local storage for your settings and the campaign tags of the ad or link that brought you on your first and most recent visit (kept for 90 days, or only for your visit while ad measurement is off for you).
- Usage events and analytics. When you do something like view your score, the event goes to PostHog through honedraft.com, with the page, your device type and the ad that brought you. PostHog sets a cookie (its name starts with ph_) and keeps an ID in local storage to recognize your browser between visits. If you visit from the UK, the European Union, Switzerland or Quebec, it keeps nothing in your browser unless you choose Accept on our cookie notice. We never send resume text, job descriptions, names, emails or phone numbers.
- Checkout. Whop's payment form, which appears inside HoneDraft's checkout, may set its own cookies, covered by Whop's privacy policy.
- Ad measurement. The Whop Pixel (cookies starting with _w, such as _wuid), Google Analytics (_ga and _ga_*) and the Meta Pixel (_fbp and _fbc) set cookies that recognize your browser, so we can tell which ads bring visitors, sign-ups and purchases. None of them run if your browser sends a Global Privacy Control signal, or after you turn them off under Your privacy choices (also linked at the bottom of our homepage). If you visit from the UK, the European Union, Switzerland or Quebec, they stay off unless you choose Accept on our cookie notice.
If we add other analytics or advertising tools, we'll update this policy first.
How long we keep data
We keep data only as long as we need it, then delete it.
| Data | How long |
|---|---|
| Your account and its resumes | Until you delete them, or your account, from your Account page |
| Work in a browser tab before you create an account | Until you close the tab |
| Settings in your browser | Until you clear your browser data |
| Text sent for AI processing | Not stored by us; AI providers keep it only briefly, under their own policies |
| Server logs | Up to 30 days |
| Usage events (PostHog) | Up to 24 months |
| Ad attribution and job-search answers saved with your account | Until you delete your account |
| Ad measurement data | Kept by Whop, Google and Meta under their own policies |
| Browser details saved at checkout or sign-up for ad events (IP address, device, and Google and Meta browser IDs) | 90 days |
| Anti-spam and duplicate-email counters | 1 hour to 90 days, depending on the counter |
| Messages you send us | 2 years after our last exchange |
| Receipts and payment records | As long as tax law requires, usually up to 7 years |
Your choices and rights
You can see, fix, download or delete your data, wherever you live.
- Delete in the app. Delete any resume from My resumes, or your account and everything in it from your Account page. Deleting your account also deletes your usage history in PostHog.
- Download. Your resume text is always visible in the editor, where you can copy it. A finished PDF download is part of the paid plans and their free trial.
- Ask us. Email support@honedraft.com to get a copy of what we hold about you, correct it, or delete it. We'll reply within 30 days, and we may need to confirm it's you first.
- Opt out of ad measurement. Use Your privacy choices at any time, or turn on Global Privacy Control in your browser. We treat either as a request not to share your information for advertising: the Whop Pixel, Google Analytics and the Meta Pixel stop, and once your account knows your choice, our server stops telling Google and Meta about your trial and charges.
- Emails. Trial emails, receipts and renewal reminders are part of a trial or paid plan, so they stop when it ends. We don't send marketing email without your consent, and every marketing email will include an unsubscribe link.
- Legal bases (UK and EU). We use your data to provide the service you ask for, to keep HoneDraft secure and working (our legitimate interests), to meet legal duties such as keeping tax records, and, for analytics cookies and ad measurement, with your consent, which you can withdraw at any time under Your privacy choices. Usage events without cookies rely on our legitimate interest in improving HoneDraft.
- Complaints. If you're unhappy with how we handle your data, email us first. You can also contact your local data protection or consumer protection authority.
We'll never treat you differently for using these rights.
Security, children, changes and contact
- Security. All traffic to HoneDraft is encrypted (HTTPS). Only the people who run HoneDraft can reach our systems, and only to run and support the service. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.
- Children. HoneDraft is for people 16 and older. We don't knowingly collect data from children under 13. If you think a child has used HoneDraft, email us and we'll delete their data.
- Changes. If we make an important change to this policy, we'll post it here with a new effective date and email paying customers before it takes effect.
- Contact. Questions or requests: support@honedraft.com. HoneDraft is based in New York, USA.
This policy works alongside our Terms of Service.