Privacy Policy

Last updated: August 20, 2026

Who operates DraftShelf

DraftShelf is an independently operated resume-building tool, not a company. Any question about this policy or your data can be sent to ariadaikalam1234@gmail.com.

What we collect

DraftShelf is a resume-building tool. What it collects follows directly from what it does:

• Account information - your email address, used for sign-in and account-related email (confirmation, password reset, security notifications). If you sign in with a password, it's handled entirely by our authentication provider (Supabase Auth) and stored only as a salted hash - we never see or store your plain-text password. If you sign in with Google, GitHub, or LinkedIn instead, we receive only your email address and basic profile info from that provider, never your password on their platform.
• Resume content you enter - everything you type into the app: your name, phone, location, links, work history, education, skills, projects, summaries, references, and any job descriptions you paste in for keyword matching. This is the core of what the app stores on your behalf, so you can access and edit it from any device you sign into.
• An optional GitHub personal access token - only if you turn on GitHub Backup. It's encrypted at rest (via Supabase Vault) and only ever decrypted server-side to push a backup copy of your data to a GitHub repository you choose. It's never exposed back to your browser or any other client after you first enter it.
• AI assistant connections (optional) - if you connect an AI assistant (Claude Code, Codex, Claude Desktop, claude.ai, or ChatGPT) from Settings → Connected Apps, we store a hashed, non-recoverable credential for that connection, which app it is, and when it was last used - never your password or any other secret. See "AI Assistant Access" below for what this lets an assistant do.

We do not use third-party analytics or advertising trackers of any kind, and we do not sell or rent your information to anyone.

How we use it

Solely to provide the app's own features: storing and syncing your resume data across your devices, rendering PDF/DOCX exports, sending you account-related email, and (only if you opt in) pushing a backup copy of your data to your own GitHub repository.

Third-party services we rely on

• Supabase - our database, authentication, and backend hosting provider. Your account data is stored on Supabase's infrastructure, access-controlled so only your own signed-in session can read or write it.
• Resend - delivers account-related email (confirmation, password reset, security notifications) on our behalf.
• A PDF rendering service we operate - receives your resume's content momentarily, only when you click "Download PDF," purely to generate the file; it does not store that content afterward.
• GitHub - only if you enable GitHub Backup, and only to the specific repository you configure. That connection, and everything pushed to it, is entirely under your control.
• Google / GitHub / LinkedIn - only if you choose to sign in using one of these instead of a password. We receive only the basic profile info those providers share for sign-in.
• Claude Code, Codex, Claude Desktop, claude.ai, or ChatGPT - only if you connect one of these as an AI assistant. See "AI Assistant Access" below.

AI Assistant Access

DraftShelf can optionally be connected to an AI assistant (Claude Code, Codex, Claude Desktop, claude.ai, or ChatGPT) so it can read and edit your Library and Versions in conversation, on your behalf. This is entirely opt-in - nothing is connected unless you explicitly authorize it.

• An assistant can only do what you approve when you click "Allow": read and write your resume Library and versions. It can never see or change your password, and it can never set up or read your GitHub Backup token - those stay web-app-only, by design.
• Every action an assistant takes goes through the same access-controlled path and revision checks a normal browser edit does - an assistant can never read or write another account's data.
• The credential behind a connection is short-lived and renews automatically only while the connection is actively used; it is never stored anywhere in a form that could be read back as the original secret.
• You can review every connected assistant and revoke access immediately, at any time, from Settings → Connected Apps.

Cookies and local storage

DraftShelf uses your browser's local storage to keep you signed in and remember device preferences, like light/dark theme. We don't use third-party tracking cookies.

Data retention and deletion

Your data is kept for as long as your account exists. You can export everything you've entered at any time from the Dashboard ("Export JSON"). To delete your account and all associated data, email ariadaikalam1234@gmail.com and we'll remove it.

Children's privacy

DraftShelf is not directed at children under 13, and we don't knowingly collect information from them.

Security

Passwords are hashed by our authentication provider, never stored in plain text. Any stored third-party access token (like a GitHub PAT) is encrypted at rest and only decrypted server-side, on demand. AI assistant connection credentials are hashed the same way passwords are - never stored in a recoverable form. All traffic to and from the app is encrypted (HTTPS). Database access is scoped so that each account can only ever read or write its own data.

Changes to this policy

If this policy changes, we'll update the date at the top of this page.

Contact

Questions, requests, or concerns about your data: ariadaikalam1234@gmail.com