Privacy notice
Your information, your documents, your choices.
About this notice
Pastegram is a free personal project maintained to help people create CVs, write cover letters and edit images. This notice explains how those tools handle information. For privacy questions or requests, contact the Pastegram site operator through Private feedback.
CVs and cover letters on your device
You can use the document editors without registering. Local drafts, saved documents, profile photos included in them, and preferences such as language and theme are stored in your browser. They are not automatically copied to your account. Opening an account document in the editor can create a local working copy.
Local storage can remain after you close the browser or sign out. Other people using your device or browser profile may be able to access it. Signing out is not the same as deleting browser data. Download anything you need before removing drafts or clearing site data. Optional offline mode stores site resources in your browser; it does not provide cloud backup.
Optional accounts and account documents
Registration stores your name, email address, a password hash and account administration information, including creation time and account status. Profile information you supply, such as a username, is also stored. If you set up password recovery, we store hashed representations of your six-digit PIN and favorite-place answer. These are checked with Google verification and attempt limits when you request a password reset. Do not share them; successful resets invalidate existing sessions. Passwords are hashed rather than intentionally stored as readable text.
When you choose Save to account, the CV or cover letter content and any included profile photo are stored on the hosting server. Account copies and local copies are separate: deleting one does not automatically delete the other. Administrators can delete regular-user accounts and set a replacement password; a reset invalidates existing login sessions. Stored documents are not end-to-end encrypted, and authorised site and hosting administrators may access server records when necessary to operate or support the service.
Image editing and project files
The photo editor opens files selected on your device and edits them in the browser. Its current integration provides downloaded image exports and project files rather than an account photo-storage service. It does not configure an automatic photo-upload destination. The editor stores your theme preference locally; download your image or project before leaving because the working canvas is not a guaranteed saved backup.
External-image exception: an imported project may contain links to remote images. Loading such a project can contact those image hosts, which can receive your IP address and request information. Use project files from sources you trust. Site assets also require requests to our hosting server. This is why browser-based editing does not mean that the page makes no network requests.
Downloaded project files can contain embedded images, editable layers and history. Treat them as potentially sensitive and review them before sharing. If you later add an edited image to a CV and save that CV to your account, the image becomes part of the server-stored document.
Private feedback and replies
Feedback is private, not a public review. We store the message, optional email address, submission time, review status and, if you are signed in, an account identifier. Administrators can review it; other users cannot browse it. Account deletion removes the feedback’s account link but does not automatically remove its message or optional email address. Mention feedback separately when requesting deletion.
The feedback page is available without signing in and requires Google verification to reduce spam. Providing a reply email is optional, but without one we may be unable to respond or complete a request that needs verification. If we correspond by email, the messages and contact details are handled through the email service used for replies. Please do not send passwords, payment information or identity documents with an initial request.
Cookies, security and hosting
Login uses a session cookie and request-protection mechanisms. The service records rate-limit identifiers derived from an IP address and action, and administration logs recording the actor, action, target identifier and time. Rate-limit records expire according to their rate window and subsequent cleanup. Hosting systems may keep IP addresses, request times, browser information and security logs.
These records help provide accounts, prevent abuse, investigate problems and maintain the service. Browser storage and cookies can be managed in your browser settings, although disabling them can prevent features from working. There is no guarantee that any online service or personal device is completely secure.
Google verification and optional analytics
Account registration and feedback use Google reCAPTCHA to prevent automated abuse. It processes browser, device and connection information for verification, and our server sends the verification token to Google. You can use guest CV and photo editing without completing these forms.
Administration pages are excluded from the supplied Analytics integration. The operator can include or exclude the photo editor separately. If the operator enables Google Analytics, it receives usage information about page visits and interactions, including browser/device and connection information, and may use cookies or similar identifiers. The configured site snippet does not deliberately submit CV text, photos, passwords, email addresses or administrator PINs as event data. External services have their own data-handling arrangements; see Google’s privacy information.
In the current integration, enabling Analytics causes its script to load when you visit pages that include it; the integration does not itself provide an accept/reject consent control. Reading this notice does not constitute consent. Browser controls and blocking tools may limit tracking. Contact us with questions about the use of Analytics. Locally bundled fonts and scripts are served by the site rather than requiring a third-party font request for normal operation.
Storage duration, providers and deletion
Browser copies remain until removed through the tools, browser settings or browser storage management. Account data and documents remain while the account is retained, unless individual documents or the account are deleted. Feedback and administration records are not automatically erased merely because a user signs out or deletes a CV; they remain until removed by the operator. There is currently no fixed automatic deletion schedule for those records.
Hosting, email and enabled Google services process information as needed to provide their services. Their infrastructure may be in a country different from yours. Removing an active record does not necessarily immediately erase hosting backups or logs; any remaining copies depend on the provider’s retention arrangements and applicable requirements. Contact us for information about your request rather than assuming deletion is instantaneous across every system.
Your choices and privacy requests
You can edit your account profile, manage documents through the dashboard, and use guest tools instead of account storage. To request access, correction, account removal, removal of feedback or information about other privacy rights available under applicable law, use Private feedback. Identify the relevant account or submission without sending your password. We may need proportionate verification before disclosing or deleting account information.
Some records may need to be retained for security, dispute handling or legal requirements; we will explain relevant limits when handling a request. We cannot remotely delete downloads or every local copy on your devices. You may also raise a concern with the relevant data-protection authority where applicable.
Use with care and future changes
Only provide information and images you are entitled to use. Avoid unnecessary sensitive information in a CV, photo or feedback message. The service is not designed to collect children’s information; if a child has supplied personal data, contact us so it can be reviewed. This notice may change when features or data practices change. The date above identifies this version; material changes will be described in an updated notice.
Need to get in touch?
Send an issue or privacy request through Private feedback. No sign-in is required. Complete the Google verification and include an optional reply email if you would like a response. Please never include your password.
Back to Pastegram