Privacy Policy

1. Who We Are

Calwyn is an AI-powered job-application platform at calwyn.app, operated by Shivam Singh, an individual doing business as "Calwyn" ("Calwyn," "we," "us," or "our"), based in India. Because Calwyn is run by an individual, Shivam Singh is personally the data controller / data fiduciary for your personal data.

I built Calwyn to help job seekers put together stronger applications — tailored résumés, cover letters, interview prep, and outreach — with AI doing the heavy lifting and you staying in control. This policy explains, in plain terms, exactly what personal data Calwyn collects, where it goes, how long it's kept, and what rights you have over it.

If you have any question about this policy, or you want to exercise a privacy right, email hello@calwyn.app.

2. What Data We Collect and Why

We collect data in four categories, and only for the purposes listed here. We do not collect data "just in case."

2.1 Account Data

When you create an account, we collect:

Name and email address — to identify your account and send you transactional messages (password resets, billing receipts, and product updates you opt into).
Authentication tokens and session identifiers — to keep you securely logged in. Authentication is handled by Clerk (see the sub-processor table in §5).

We do not store your password directly — Clerk manages credential storage on our behalf.

2.2 Résumé and Career Content

The core of Calwyn's service involves content you provide:

Résumé content — the full text of your résumé, including your name, contact information, work history, education, and skills. You upload this to Calwyn or paste it in.
Job descriptions — the text of job postings you paste in when tailoring your résumé.
Tailored outputs — résumé versions, cover letters, outreach messages, interview-prep notes, and salary-negotiation materials generated by Calwyn on your behalf.
Profile information — a professional profile and portfolio you build inside Calwyn, optionally made public.

This data is the substance of the service. We use it only to provide the features you explicitly use — never for advertising, and never sold to third parties.

2.3 Usage and Product Analytics Data

When you use Calwyn, we collect usage signals:

Feature interactions — which screens you visit and which features you use.
Error and performance data — traces when something goes wrong, so we can fix it.
Approximate location (country/region) — derived from your IP address at the time of a request. We do not store precise geolocation.
Device and browser type — for diagnosing compatibility issues.

This data flows to PostHog (our analytics provider). PostHog runs on a US-hosted instance and uses first-party cookies only — there are no third-party advertising trackers, retargeting pixels, or cross-site tracking scripts on Calwyn. We ask for your consent before analytics run (see §7). See §7 for more detail.

2.4 Payment Data

When you subscribe to Calwyn Pro, payment is processed through Polar (our Merchant of Record). Polar handles the billing relationship; we receive only:

Your subscription status and plan tier.
Anonymized transaction references for our records.

We do not store your credit-card number, bank details, or full payment information. Polar and its underlying payment processor (Stripe) hold these and are responsible for their security.

3. How We Use Your Data

Data Category	What We Use It For
Account data	Creating and securing your account; transactional email
Résumé and career content	Providing AI tailoring, toolkit features, and your portfolio
Usage and analytics data	Improving product quality; diagnosing bugs; measuring feature usage
Payment data	Managing your subscription and billing support

We do not use your data to:

Train, fine-tune, or build AI or machine-learning models (neither do our AI providers — see §4).
Build advertising profiles or target ads.
Sell or rent your information to any third party.
Make automated decisions that significantly affect your employment prospects without your knowledge (see §4 on AI use).

4. How AI Processes Your Résumé

This section explains exactly what happens when you use Calwyn's AI features.

4.1 What the AI Does

Calwyn's AI features — résumé tailoring, cover-letter generation, interview preparation, outreach drafting, and salary-negotiation materials — take your résumé and a job description as input and produce a suggested output. You review and control every output. Nothing is submitted on your behalf, and Calwyn never shares AI-generated content with any employer or third party. The AI is a writing assistant, not a gatekeeper or decision-maker.

Calwyn does not use AI to score, rank, or filter you as a candidate. Our AI generates content to help you present yourself effectively. Any fit indicators shown in the product are for your own guidance — they are not shared with employers and do not constitute automated employment decisions made about you.

4.2 What Data Goes to Our AI Providers

When you run an AI feature, the relevant portion of your résumé and the job description you provide are sent to our AI generation providers over an encrypted connection. This data includes personal information (your name, contact details, work history, and so on) that you put in your résumé.

We use two AI providers:

OpenAI (primary provider): Receives résumé and job-description text for generation. Per OpenAI's API data policy, OpenAI does not use API inputs or outputs to train its models by default. OpenAI retains API data for up to 30 days solely for abuse monitoring, then deletes it.
DeepInfra (backup provider, used when OpenAI is unavailable): Also receives résumé and job-description text. DeepInfra operates a zero-retention policy — data exists in memory only during the brief period of inference and is not written to disk or retained afterward.

Neither provider uses your data to train AI models. Calwyn itself does not train, fine-tune, or use user data to build AI models.

4.3 What We Do Not Disclose About the AI (and Why)

We tell you what your data is used for and where it goes. We intentionally do not publish which specific AI models we use, how our prompts are structured, or internal scoring logic — disclosing that would invite adversarial manipulation that would harm outcome quality for everyone.

We do not sell your personal information. We do not share it for advertising. We share it only with the sub-processors below, each of whom receives only the data necessary for their specific function.

Sub-Processor Table

Sub-Processor	Role	Data Received
Clerk	Authentication and identity	Name, email, auth tokens, session data
Neon	Postgres database	All structured user data (account, résumé content, application records)
Cloudflare R2	File storage	Résumé files, profile assets
Upstash	Caching and rate limiting	Ephemeral session and queue references (no PII stored persistently)
Vercel	Hosting and content delivery	Request metadata, edge logs
Resend	Transactional email	Name and email address
PostHog	Product analytics and error tracking	Usage events, error traces, anonymized IP
Better Stack	Uptime and log monitoring	Operational logs (no résumé content)
OpenAI	AI generation (primary)	Résumé text and job descriptions — retained up to 30 days for abuse monitoring only; not used for model training
DeepInfra	AI generation (backup)	Résumé text and job descriptions — held in memory during inference only; zero post-inference retention
Polar	Payments and subscription management (Merchant of Record)	Payment method data, subscription state

We require each sub-processor to protect your data in accordance with applicable law. We do not permit them to use your data for their own marketing or model training.

Business transfers: If Calwyn is acquired, merged, or its assets are transferred, user data may be part of that transaction. We will notify users via email and/or a prominent notice on the site before data is transferred and becomes subject to a different privacy policy.

6. Where Your Data Lives (Data Residency)

All Calwyn infrastructure, databases, and file storage are located in the United States. Your data is not routed to or stored in any other country as part of Calwyn's own operations.

Each sub-processor listed above processes data in US-based infrastructure:

Neon — US region (US-East)
Cloudflare R2 — US data center
PostHog — US-hosted cloud instance
OpenAI — US-based
DeepInfra — US-based
Vercel — US-primary with global edge (edge logs only; persistent data stays in the US)
Clerk, Upstash, Resend, Better Stack — US-primary data handling

If you're in the European Union or the UK: your data is transferred to and processed in the United States. Calwyn is a single-founder business based in India and does not currently target or market to the EU or UK. Where the GDPR or UK GDPR applies to a transfer, we rely on the Standard Contractual Clauses included in our providers' data-processing agreements as the safeguard under GDPR Article 46. If we begin actively serving EU/UK users, we will formalize our transfer safeguards accordingly. By using Calwyn, you acknowledge your data is processed in the US.

Calwyn uses a minimal set of cookies — only what is necessary for the service to function and, with your consent, to understand how it is being used.

Cookie Type	Provider	Purpose
Authentication	Clerk	Keeping you securely signed in
Session	Calwyn (first-party)	Maintaining your session state
Analytics	PostHog (first-party)	Measuring feature usage and diagnosing errors — only after you consent

Consent: Analytics do not run until you accept our Terms and this Privacy Policy. Until then, PostHog is disabled and captures nothing.

What we do not use: We do not load third-party advertising cookies, tracking pixels, retargeting scripts, or ad-network scripts on Calwyn. PostHog analytics run on our own configured instance using first-party cookies only — your usage data does not flow to an ad network.

Global Privacy Control (GPC): Calwyn honors the GPC browser signal. If your browser sends a GPC signal, we treat it as an opt-out of any sale or cross-context sharing of your personal information. Since we do not sell or share your data for advertising, this is consistent with how we operate regardless.

Do Not Track: Because Calwyn does not engage in cross-site behavioral tracking, the practical effect of a DNT signal is already our default behavior.

8. Data Retention

We keep your data only as long as it serves a legitimate purpose. Here are our concrete retention periods:

Data	Retention Period
Account data and résumé content	Retained for the life of your account
Tailored résumés, cover letters, and toolkit outputs	Retained until you delete them or close your account
AI processing data at OpenAI	Up to 30 days (OpenAI's policy; for abuse monitoring only)
AI processing data at DeepInfra	Zero post-inference retention (in-memory only)
Analytics events (PostHog)	About 12 months (PostHog free-plan retention)
Payment records	Held by Polar and its payment processor (Stripe) under their own retention policies and applicable tax record-keeping requirements; not accessible through Calwyn
Account deletion	Personal data removed from active systems within 30 days of your deletion request; backup copies purged within a further 90 days
Inactive accounts	We email you after 12 months of inactivity, and delete the account 30 days after a final warning if you don't sign back in

When you delete your account using Calwyn's self-serve deletion tool, we begin the removal process immediately.

9. Your Privacy Rights

9.1 Rights for All Users

Whichever country or US state you're in, you have the following rights:

Right to know / access: Request a summary of the personal information Calwyn holds about you, where we got it, and how we use it.
Right to export / data portability: Download your data directly from your Calwyn account settings — including your résumé content and tailored outputs.
Right to delete: Delete your account and associated data from your account settings. We process deletion requests within 30 days.
Right to correct: If personal information about you is inaccurate, correct it in your account settings or ask us to.
Right to opt out of sale: Calwyn does not sell your personal information. We have no product or revenue model that involves selling user data.
Right to opt out of sharing for targeted advertising: Calwyn does not share your personal information with advertising networks. There is nothing to opt out of here — this is simply not how we operate.
Right to limit use of sensitive personal information: Résumé content — including employment history, education, and professional qualifications — may qualify as sensitive personal information under some laws. Calwyn uses this data only to deliver the services you request. You can ask us to limit processing to those purposes by emailing hello@calwyn.app.
Non-discrimination: Exercising any of these rights will not result in you being denied service, charged a different price, or treated differently in any way.
Response timeline: We respond to verifiable privacy requests within 45 days. If we need more time (up to 90 days total), we'll tell you within the first 45 days.

9.2 California Residents (CCPA/CPRA)

The rights in §9.1 apply to you under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of personal information we collect:

Identifiers (name, email address)
Professional or employment-related information (work history, skills, education — as provided in your résumé)
Internet or other electronic network activity (usage events, error traces)
Commercial information (subscription status)

No sale of personal information. Calwyn does not sell, and has never sold, personal information within the meaning of the CCPA. To exercise any CCPA right, email hello@calwyn.app.

Automated Decision-Making (ADMT): Under CPRA regulations effective January 2026, you have rights related to automated decision-making that produces significant decisions about you. Calwyn's AI tools generate suggested text — résumé tailoring, cover letters, outreach, interview prep — which are presented to you for review and use at your discretion. Calwyn's AI does not make employment decisions about you, does not share AI outputs with employers, and does not generate assessments that gate your access to job opportunities. The AI is a writing assistant. If you have questions about how AI is used in the product, email hello@calwyn.app.

If you are located in the European Union or the United Kingdom, you have the following additional rights under the GDPR and UK GDPR:

Right of access (Article 15): Request a copy of the personal data we hold about you.
Right to rectification (Article 16): Request correction of inaccurate personal data.
Right to erasure (Article 17): Request deletion of your personal data where there is no overriding legal basis for us to keep it.
Right to restriction of processing (Article 18): Ask us to pause processing in certain circumstances.
Right to data portability (Article 20): Receive your data in a structured, machine-readable format.
Right to object (Article 21): Object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on your consent, withdraw it at any time — this doesn't affect processing that happened before withdrawal.
Right to lodge a complaint: You have the right to complain to your local data protection supervisory authority.

Legal bases for processing:

Processing Activity	Legal Basis
Providing the AI tailoring and toolkit services	Performance of contract (Article 6(1)(b))
Sending transactional emails (billing, security)	Performance of contract (Article 6(1)(b))
Product analytics and error monitoring	Consent (Article 6(1)(a))
Retaining payment records	Legal obligation (Article 6(1)(c))
Sending marketing or product-update emails (opt-in)	Consent (Article 6(1)(a))

Data controller: Shivam Singh (an individual doing business as Calwyn), based in India. Contact: hello@calwyn.app.

9.4 India (DPDP Act, 2023)

Calwyn is operated by an individual based in India, who acts as the data fiduciary for your personal data. India's Digital Personal Data Protection Act, 2023 (DPDP Act) governs the personal data of individuals in India. If you are in India, you may access, correct, or delete your data using your account settings, or email hello@calwyn.app to make a request or raise a grievance. As a single-founder business, we act as our own grievance contact and will respond as promptly as we can.

10. International Data Transfers

Calwyn's infrastructure is based in the United States. If you access Calwyn from India, the EU, the UK, or anywhere outside the US, your personal data is transferred to and processed in the United States. Where the GDPR or UK GDPR applies to a transfer, we rely on the Standard Contractual Clauses in our providers' data-processing agreements as the safeguard under GDPR Article 46 (see §6). For more information about our transfer arrangements, email hello@calwyn.app.

11. How We Protect Your Data

We use technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction, including:

Encrypted data transmission (TLS/HTTPS) for all connections.
Row-level security on our database — each user's data is logically isolated.
Least-privilege access — only the systems that need data for a specific function can access it.
Vendor security requirements — each sub-processor in §5 is selected in part based on its security posture and data-handling commitments.

No internet-based system is 100% secure. If we become aware of a security incident involving your personal data, we will notify you in accordance with applicable law.

12. Children's Privacy

Calwyn is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, email hello@calwyn.app and we will delete it promptly.

13. Changes to This Policy

We may update this policy as the product evolves or legal requirements change. When we make material changes, we will:

Update the "Last updated" date at the top of this page.
Email registered users.
Where required by law, ask for fresh consent.

We encourage you to review this policy periodically. Continued use of Calwyn after a material update constitutes acceptance of the revised policy, to the extent permitted by law.

14. Contact and Data Requests

For any privacy question, data request, or complaint:

Email: hello@calwyn.app

To exercise a data access, deletion, correction, or portability right, you can:

Use the self-serve tools in your Calwyn account settings (fastest option).
Email hello@calwyn.app with "Privacy Request" in the subject line.

We respond to verified requests within 45 days. We may need to verify your identity before processing a request — we'll ask you to confirm from the email address associated with your account.