Privacy Policy for Resume Roast

Effective: 11 November 2026 · Last updated: 11 November 2026

Introduction

This Privacy Policy explains how TUTOS APP S.A.S. ("we", "our", or "us") handles your information when you use the Resume Roast mobile application (the "App"), which provides an AI-generated review and optional rewrite of a resume/CV you submit. The App is available for Android (Google Play) and iPhone (App Store); this policy covers both and points out where they differ.

By using the App, you agree to the practices described in this policy.

This policy is our personal data processing policy (Política de Tratamiento de la Información) under Colombian Law 1581 of 2012 and Decree 1074 of 2015 (chapter 25, which incorporated Decree 1377 of 2013).

• No accounts, no sign-up. We never ask for an email, a password or a login.
• No advertising and no sharing of data with advertisers.
• No third-party analytics, and no tracking across other companies' apps or websites.
• We never sell personal data.

Data Controller

The App belongs to TUTOS APP S.A.S., which publishes it in the app stores under the "Tutos App" brand. TUTOS APP S.A.S. is the controller (Responsable del Tratamiento) of your personal data:

• Legal name: TUTOS APP S.A.S.
• Tax ID (NIT): 902.125.524-7
• Commercial registry: Cámara de Comercio de Medellín para Antioquia, registration no. 862649-12
• Registered address: Carrera 44 # 17C Sur - 40, Apto 1308, Medellín, Antioquia, Colombia
• Phone: +57 350 495 8312
• Contact and data-protection email: hola@tutosapp.co

Requests, queries and complaints about personal data are handled by the legal representative of TUTOS APP S.A.S., through the email above.

Database validity period: the databases remain in force for as long as TUTOS APP S.A.S. operates the App and the purpose that justified the processing exists; each item is kept only for the periods stated in this policy (see "Data Retention").

Information We Handle

Your Resume Content

• The text you paste, or the text the App extracts on your own device from a file you choose (PDF or document), or from an image using on-device text recognition (OCR).
• If you also enter a target role or paste a job posting to tailor the resume, that text is handled the same way.
• This content may include personal information you decide to include: name, email address, phone number, postal address, work history, education and languages. You control what you submit.
• We do not ask for sensitive data (for example about health, ethnic origin, religious beliefs or political opinions) or for data about minors. Including it in your resume is optional; if you do, it is handled like the rest of the text, only to generate the result.

Device Identifier

• Android: the App uses the device's ANDROID_ID, or a random code created on first launch when that is unavailable.
• iPhone: the App creates a random code (starting with ios-) and keeps it in the device Keychain, set to stay out of backups. It is not an Apple or advertising identifier. Unlike the rest of the App's local data, the Keychain keeps this code even if you delete the App.
• On both platforms the identifier is sent to our server and is the key to your credit wallet: without it we could not tell how many analyses you have left, credit your purchases, or prevent free credits from being claimed repeatedly.
• This identifier is stored permanently on our server, associated only with a credit balance. It is not linked to your name, your email or your resume content, and it is not shared with anyone.

Integrity Check

When the wallet is first created, the App proves it is the genuine copy, to prevent abuse of the free credits:

• Android: the App requests a Play Integrity token from Google and sends it to our server, which checks it. It is not stored.
• iPhone: the App uses Apple's App Attest. Our server issues a one-time challenge (valid for five minutes); the device creates a cryptographic key of its own for the App, Apple certifies that key, and the App sends our server the key's identifier and the signed attestation. The server verifies the attestation and discards it; it keeps the key identifier and its public key with your wallet. The challenge is deleted once used, or replaced when a new one is requested. None of this contains information about you or your resume.

Purchases

• Android: in-app purchases (credit packs) are processed by Google Play Billing. We receive and store the product identifier and the purchase token.
• iPhone: purchases are processed by Apple's App Store (StoreKit 2). The App sends our server the transaction signed by Apple; the server verifies Apple's signature and stores the transaction identifier, the product identifier and the environment (production or test). The full signed transaction is not stored.
• On both platforms the purchase record is kept together with your device identifier, the number of credits and the date, in order to grant the credits and make sure a single purchase cannot be redeemed twice.
• We do not receive or store your payment card details, your Apple ID or your Google account.

Language Preference

• The language you want the review in, which you can pick manually or let the App detect from your resume's own language. It is sent with the request and is not stored.

Feature Interest

• When you tap a feature that is not available yet, the App sends an anonymous signal with that feature's name, so we know which features people want most. It does not include your device identifier or your resume content.

Your Consent Before the AI Is Used

Before your first analysis, the App explains what is sent (your resume text and, if you enter them, the target role and job posting), to whom (our server and the AI model Claude, by Anthropic) and why, with a link to this policy. Nothing is sent until you agree.

• If you decline, you can keep using the App, but not the AI review and rewrite features.
• Your choice is stored on your device only. If we change what is sent, to whom, or why, we will ask you again.

How Your Resume Is Processed

When you request a review or a rewrite, the resume text is sent over an encrypted connection (HTTPS) to our backend (Google Cloud / Firebase Functions), which forwards it to our AI provider (Anthropic, Claude model) to generate the result that is returned to your device.

• We do not store your resume text on our servers. It is processed ephemerally: used in memory solely to answer that specific request, and never written to a database or to our server logs.
• Our AI provider processes the text to generate the output under its API terms, and may keep it for a limited time for trust and safety purposes. Anthropic does not use data submitted through its API to train its models by default.

Reporting a Result

If a review or rewrite seems offensive, inaccurate or otherwise wrong, you can use "Report this result". The App sends nothing to our server: it opens your email app with a prepared message to hola@tutosapp.co containing the reason you pick, the result type, a local result identifier, the App version and the platform (Android or iOS). It does not include your resume or the result.

• It is only sent if you send it from your email. When you do, we receive your email address and anything you choose to add to the message, and we use them only to review the report and, if needed, reply to you.

What Never Leaves Your Device

• The photo you add to your resume. The PDF is generated entirely on your phone; the image is kept in the App's internal storage and is never uploaded anywhere.
• The generated PDFs and the score image for sharing, which only leave the device if you choose to save or share them.
• Text recognition (OCR) and file reading, which run locally.
• Your history (score, verdict, breakdown and, if you asked for one, the rewrite), your preferences, your AI consent choice and, on iPhone, the work in progress the App saves so it can be restored if the system closes it. All of this is stored only in the App's internal storage.

Uninstalling the App or clearing its data removes all of this local information (on iPhone the Keychain identifier is kept, as explained above). Note that your credit balance is not local: it lives on our server, tied to your device identifier, precisely so it is not lost on reinstall.

How We Use Your Information

• To generate the AI review and optional rewrite of your resume, once you consent.
• To display and store your results locally so you can revisit them.
• To manage your credit balance and process purchases.
• To prevent abuse of the free credits and fraud.
• To review results you report to us and reply to you.
• To decide which features to build, from anonymous interest signals.

Third-Party Services

• Google Cloud / Firebase — hosts our backend (us-central1 region) and the credit wallet and purchase database.
• Anthropic — provides the AI model (Claude) that generates the review/rewrite. It is the only third party that receives your resume content.
• Google Play Billing and Google Play Integrity (Android) — process purchases and verify that the App is genuine.
• Apple App Store / StoreKit and Apple App Attest (iPhone) — process purchases and verify that the App is genuine.
• Your email provider — only if you send a report, under its own terms.

International Data Transfers

The providers that process data on our behalf are outside Colombia: our backend and database are hosted on Google Cloud / Firebase, us-central1 region (United States), and your resume content is sent to Anthropic, a company based in the United States. The Google and Apple services that process purchases and verify the App's integrity also operate outside Colombia. These transfers happen with your authorization (for your resume, the one you give on the consent screen described above), only for the purposes in this policy, and in accordance with Law 1581 of 2012 and Decree 1074 of 2015.

Data Retention

Data Security

• All communication between the App, our server and the AI provider is encrypted using HTTPS/TLS.
• We do not retain resume text on our servers after generating a result.
• The AI provider key and processing happen server-side; the App never contacts the AI vendor directly.
• iPhone purchases are only credited when Apple's signature is valid.

Your Rights

As the owner of your personal data, and under article 8 of Colombian Law 1581 of 2012, you have the right to:

• Know, update and correct your personal data, including data that is partial, inaccurate, incomplete, fragmented or misleading.
• Request proof of the authorization you gave us, except where the law does not require it.
• Be informed, on request, of how we have used your data.
• Revoke your authorization and/or request deletion of your data, except where a legal or contractual duty requires us to keep it.
• Access free of charge the personal data we process.
• File complaints with the Superintendencia de Industria y Comercio (SIC), Colombia's data-protection authority, for breaches of data-protection law, once you have completed the query or claim process with us.

How to Exercise Them

• Access: your results and credits are visible within the App.
• Local deletion: use "Clear history" in the App, or clear the App's data / uninstall it.
• Server-side deletion: you can ask us to delete your device identifier, your credit balance, your App Attest data and your purchase records by writing to hola@tutosapp.co. The request is handled as a claim, within the time limits below. Deleting the wallet also deletes any credit balance you hold.
• Because we do not retain your resume text, there is no server-side copy of it to delete.
• For any other right, write to the same email.

Queries

You can ask about the personal information we hold about you by writing to hola@tutosapp.co. We will answer within ten (10) business days of receipt. If we cannot answer within that time, we will tell you before it expires why, and when we will answer, which will be no later than five (5) business days after the first deadline.

Claims

If you believe your information should be corrected, updated or deleted, if you want to revoke your authorization, or if you notice an alleged breach of the law, you can file a claim by writing to hola@tutosapp.co with your identification, a description of the facts behind the claim, the address or email where you want the answer, any documents you want to rely on, and information that lets us locate your data in our systems.

• If the claim is incomplete, we will ask you to complete it within five (5) business days of receipt. If two (2) months pass after that request without you providing the missing information, we will treat the claim as withdrawn.
• If we are not the right party to resolve it, we will forward it to whoever is within two (2) business days and let you know.
• Once we receive a complete claim, we will flag the affected data as "claim in progress" (reclamo en trámite) within two (2) business days.
• We will answer within fifteen (15) business days from the day after receipt. If that is not possible, we will tell you before it expires why, and when we will answer, which will be no later than eight (8) business days after the first deadline.

Children's Privacy

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date above. If a change affects what is sent to the AI, the App will ask for your consent again. If a substantial change affects who the controller is or the purposes of processing, we will tell you before applying it.

This policy takes effect on 11 November 2026.

Compliance

• Colombian Law 1581 of 2012 and Decree 1074 of 2015 (chapter 25) on personal data protection
• Google Play Store and Apple App Store requirements
• General Data Protection Regulation (GDPR) principles
• California Consumer Privacy Act (CCPA) where applicable