Forget The Forms
How it works Pricing Download

Privacy Policy

Effective date: October 30, 2026
Controller: Forget The Forms LLC
Mailing address: Forget The Forms LLC, 530 E Main St, Unit 3A #451, Chester, NJ 07930
Privacy contact: hello@forgettheforms.com

1. Summary (how the product is built for privacy)

  • Your résumé facts and answers are stored server-side, scoped strictly to your own account — one user can never access another's data.
  • When the assistant fills a form, the questions on that page are sent to your account and the answers you have already given come back to fill it. The fill itself runs on your own computer, in a browser window the app opens with its own profile, on your own connection — we never open a session at an employer for you.
  • We hold no employer/ATS login credentials — the Service does not log into sites for you.
  • We do not sell your personal information.

2. Information we collect

  • Profile & answers you provide: the text of your résumé as read from the file, and the facts read from it (name, contact details, work history, education); the facts and licenses you enter and confirm; your answers to common application questions; and your search settings (for example job titles, places and keywords, and work-authorization or pay entries if you fill them in).
  • Application activity: for each job you start, a listing reference; where the job's link is on a job board we recognise, that board's website address (for example acme.recruitee.com, which can name the employer); when you started the job and when you last went back to it; what came of it (for example applied, not applied, or no form found) and when that was recorded; and the short phrase, of up to 400 characters, that the result was based on (for example the page's confirmation wording or the form's first error message). It is kept so that going back to a job is free, so a job is charged once, and so an application can be put back if we stop opening that website (see the Terms), and it is also counted in totals (§3). If your free applications are all used and you try to start another, we record when that first happened and how many such requests were turned down, against your account and not against your email address; that record is deleted with your account (§7). The job list and tracker you work from are kept on your computer. What reaches your account about jobs is the record just described and the things §4 lists: the posting details sent for scoring, the posting's details sent with each question, and what the page showed when you finished with a job.
  • Account & billing: your email address (stored encrypted, with a fingerprint of it kept beside it that is not encrypted: see §6 and §7), how many applications you have used and how many are left, and a record of each purchase (the payment processor's reference for it and how many applications it added). If you set a password, we keep a one-way hash of it, never the password itself; if you ask for a password reset, we keep a one-way hash of the reset code and when it was issued. If you ask to change the email address on your account, we keep, until the change goes through, the new address (encrypted) and a fingerprint of it, a one-way hash of the code we emailed, when we sent it, and whether it went to the new address or to the one already on your account. Each time you sign in, we keep a record of that sign-in session: a fingerprint of its key (never the key itself), when it started and when it was last used. If the address you sign up with looks like a throwaway (disposable) address, we note that on your account, encrypted; it does not stop you signing up. If the résumé tune-up ever sends your résumé for suggested rewrites (§5; it does not today), we keep a fingerprint (a hash) of that résumé's text, how many times the tune-up has run on it and when that count started, so that its limit can be applied. There is no subscription. Payment card details are handled by our payment processor, Stripe, and are not stored by us.
  • Technical/usage data: your IP address, used only to rate-limit requests that could be abused: signing up, getting back into an account with a code, signing in, asking for a code to change the email address on an account, and unsubscribing. We keep only a hash of the address, not the address itself, with the time of the request, in the counters that do the limiting. The hash is not your address, but it is plain SHA-256 and the same every time: anyone who already has an IP address can compute the same hash and check whether it matches one we hold. A sign-up or sign-in-code request that is still waiting for its code carries the same hash on its waiting record; nothing in our code reads it back. To limit requests for sign-in codes, we also keep a fingerprint (a hash) of the email address the code was requested for, with the time of the request and the hash of the IP address it came from. This is kept for any address someone types, whether or not it has an account here. It is the same plain SHA-256 fingerprint described in §6 and §7: anyone who already has an email address can compute it and check whether it matches one we hold. Whenever a new code is issued, these records more than a day old are deleted, and those for your address are deleted when you delete your account (§7). To limit password checks, we count attempts against your account: each time your password is checked, right or wrong, we keep the time of the check against your account's internal fingerprint, never the password that was typed. Whenever your password is checked, those times more than two days old are deleted, and all of them are deleted with your account. The server software we wrote does not write your IP address into its own logs; our hosting and network providers (§5) run their own infrastructure and may keep standard network logs that we do not control. Our website counts visits in aggregate using Cloudflare Web Analytics (§5); Cloudflare adds a small script to our web pages to do the counting, and that script runs under Cloudflare's own terms and privacy policy. Neither the app nor our account server contains any third-party analytics or error-monitoring service; we count how the Service is used ourselves, in totals, from the account records described in this section (§3).
  • Which computer is using your account: each time the Account page opens, the app tells our server which installation it is, using a random identifier it made once on your computer and keeps in its own data folder (nothing is read from your hardware). Our server keeps only a one-way hash of that identifier, the time that installation took the account over, and a count of recent changes of computer with the time of the last one.
  • Sensitive/demographic data (EEO): if a form asks voluntary self-identification questions (gender, race or ethnicity, veteran status, disability), the app answers them only from an answer you chose yourself under My Info, and otherwise leaves the question blank for you — it never picks one for you. If you do save such answers, they are stored on our server with your other saved answers (encrypted, §6), because that is how they reach the form. Saving one is a choice you make question by question; we use what you save only to answer that kind of question on an application you open, and it is deleted with the rest of your account data (§7).

3. How we use it

  • To fill applications from facts you confirmed, and to flag anything unproven for your review.
  • To operate your account, tracker, and purchases.
  • To secure the Service and prevent abuse.
  • To count how the Service is used, in totals. From the account records we already hold (§2), we count things such as how many accounts started an application, how many used all their free applications, and how many bought more, so that we can run and improve the Service and set its prices. We see only the totals, not a profile of any one person, and we do not sell them or share them. Nothing extra is collected from your computer for this.
  • Marketing, only if you ask for it. If you tick the box when you sign up (it is never ticked for you), or tick "Product email" later on your Account page, we may use the email address on your account to send you occasional messages about the product itself — news and tips. You can switch it off at any time; §9 sets out how, and what switching it off does not affect.

We do not use your résumé or answers to train any AI model. The only AI provider our code can send any of it to is Anthropic, and only through the optional features described in §5, which are off today. Anthropic states that it does not train its models on data sent through its business API.

4. What leaves your device, and what doesn't

Leaves your device, to your own account on our server:

  • The facts and answers you enter — your profile as read from your résumé (including the full text of the résumé as extracted from the file), the details you confirm on My Info, and each screening answer you save. These are uploaded so that the same answer can be reused on your next application. Uploading happens while an account is connected: when you connect it, when you save an answer, when you save My Info, when you upload a résumé or save your contact details on the welcome page, and when you press Re-send my answers.
  • Your search settings — the job titles, places, keywords, industries and similar choices in Search Settings, and your work-authorization and pay entries if you have filled them in. They travel with every batch of job postings the app sends to be scored. Not included: a home town or ZIP you set for a "within N miles" search — that stays in its own file on your computer and is never sent.
  • The job postings the app finds for you — each posting's public details (for example employer, title, location and description), so your account can score them against your résumé.
  • The questions an application asks you — the wording of each field and the employer's own answer options for drop-down questions. Each of these requests also carries the posting's title, the employer's name, the full link to the posting, the location the posting states, a pay range when there is one, and your Search Settings choice of where in a pay range to ask. The pay range is the one the posting states; when it states none, it is an estimate worked out from the pay that similar postings in your job list state, and the text of those postings is sent to your account to work it out. All of this is sent so your account can work out which of your existing answers applies.
  • Which job you are applying to — a reference to the listing (its id, or a hash of its link) and, where the job's link is on a job board we recognise, that board's website address, so an application is charged once, going back to it does not use another, and an application can be put back if we stop opening that website; the Terms set out the exceptions.
  • What the page showed when you finished — when you close the app's browser window after reviewing a job, the app sends what it saw, so your account can tell whether the application was submitted: the page's address before and after, up to 20,000 characters of the text the page was showing at the end (on a confirmation page that can include your name or other details the page repeats back to you), whether the form was on the page at the end, any error messages on it, and the label of the button it saw you press. Our server keeps from it only the result and the short phrase described in §2, of up to 400 characters.
  • A résumé draft you ask the app to check — if you use the résumé-tailoring step, the text of your original résumé and the text of the tailored draft are sent to your account so it can check the draft against your résumé before any document is written. The finished document is written only on your computer.
  • Never uploaded, and actively stripped before sending: from your saved profile and the answers built from it and from My Info, the Workday login saved in the app, any other field whose name looks like a password, secret key, login cookie or saved browser session, and the full file path of your résumé on your own disk (only its file name is sent). The stripping happens on your computer, before the request is made. It goes by each field's name, not its contents, and in your profile and those answers it covers every name of that kind rather than only the two field names we happen to know about. The screening answers you save one question at a time are not put through this filter: each is sent as you saved it, so do not save a password or other secret as the answer to a question.

Comes back to your device: the answers themselves, one field at a time, so the form can be filled in your browser. This is the core of how the product works. Anything your account cannot prove comes back as needs a human and is left blank for you.

Stays on your device and is never uploaded: your résumé file, the finished documents the app writes for you (only the draft text goes up, for the check described above), the job list and tracker you work from (what reaches your account about jobs is what this section lists above, and what is kept of it is the per-job record in §2), the screenshots and evidence folders from past attempts, and any employer logins held in the app's own browser session.

⚠ The file, not its contents — read this with the first bullet above. The résumé document itself is never sent anywhere, and its location on your disk is stripped before any request. But the text read out of it — all of it, including your employment history and the individual bullet points — is part of "your profile as read from your résumé" in the first bullet, and it is uploaded to your account, because the scoring and the rewrite coach run on our server. "The file stays here" and "nothing from my résumé leaves" are different statements and only the first is true.

5. Who we share it with (processors)

We share limited data with service providers strictly to run the Service:

  • Stripe — takes payment when you buy applications. It receives your payment details directly, never us, and we never receive your card number. When a purchase completes, Stripe sends our server a signed notice that is its whole record of that checkout, and that record can include the name, billing address, phone number and tax details you gave Stripe, depending on how the checkout is set up. Our server reads from it only the email address you entered, Stripe's own reference for the purchase, how many applications the purchase covers and the account reference we attached to the purchase link, and stores none of the rest. Sales tax is added at checkout where we are registered to collect it, worked out by Stripe from what you give it there.
  • Render (Render Services, Inc.) — hosts the server that runs the Service, in a United States data centre, and the disk that server stores your account on. What that disk holds is your account record, as listed in §2: your email address, your profile facts and your saved answers, which are encrypted as described in §6, and your application history (for each job, the details in §2, including the job board's website address where we keep one and when you last went back to the job) and usage record, which sit in the same database without that encryption. Render provides the machine and the storage under its own terms and privacy policy.
  • Anthropic — used only by two separate optional features, each one something we can switch on, independently, at our server. Both are off today. What Anthropic would receive is different for each, so they are listed separately rather than as one entry:
    • Question matching. When it is on, it receives the wording of the question an application is asking you, and the wording of questions you have answered before, so it can say which of yours is the same question. It is never sent the page, its address or the employer's name, except where the wording of a question itself names an employer. For this feature it does not receive your answers, your résumé, your name or your contact details — see the résumé-rewrite entry below, which is a different feature and sends different data.
    • Résumé rewriting — suggested rewrites for the rewrite coach and the résumé tune-up. No page in the app asks for these suggestions today, so even with the feature on, nothing is sent for it until one does. When it is used, it receives the résumé line being rewritten, and, for the per-job coach, the text of the job posting it is being rewritten against. It receives one line at a time and never your résumé as a whole document, and it does not receive your saved answers, your name or your contact details. One visit can send more than one line: asking for suggestions sends your experience bullets, one request each, until it has enough suggestions to show you.

    Anthropic states that it does not train its models on data submitted through its business API.

  • Cloudflare — serves our public website and the app download, counts visits to the website in aggregate (Cloudflare Web Analytics), and receives any email you send to us at our contact address (it runs the mail routing for our domain and forwards the message on to the mailbox below). It also sits in the network path in front of our server: requests the app makes to our account server reach our host, Render, through Cloudflare's servers, so what the app sends to your account (§4) passes through Cloudflare on the way, over an encrypted connection.
  • Google (Gmail) — holds the mailbox that email sent to our contact address (which is also our privacy contact) forwards to, so it receives, reads and stores whatever you choose to put in a message to us. That includes anything you volunteer in a support email — a résumé attachment, an account detail, a complaint about a specific application — because a support inbox is not scoped the way the app is; whatever you write into the email goes to Google's mail servers, in full, as ordinary Gmail content.
  • Resend (Resend, Inc.) — sends account email on our behalf: your sign-up code today, and any other transactional message, and any marketing message we send you (§9). The only things it receives are your email address and the text of that one message — nothing from your profile, your saved answers, or your application history rides along. Resend sends that mail through Amazon Web Services' email service (Amazon SES), so the same address and message also pass through Amazon's mail servers.
  • The Muse — a job site our server can read listings from for you, when we have that feed switched on at our server. While it is on, for each place in your Search Settings written as a US city and state (and for remote work, if you accept it), up to a limit, our server asks The Muse for jobs there. It sends The Muse the name of that place, the job categories worked out from your saved job titles and industries (when they cannot all be matched to a category, no category is sent and every kind of job is asked for), and our server's own access key. It does not send your name, email address, résumé, answers or anything else that identifies you or your account, and The Muse sees our server asking, not your computer. Our server may keep The Muse's reply for a while, filed under that place and those categories; it holds job listings, not your saved job titles or anything that identifies you.

Each handles that data under its own terms and privacy policy. We do not sell personal information or share it for cross-context behavioral advertising.

6. Security

  • Your answers and email address are encrypted where they are stored. Your answers, saved responses and email address are encrypted in our database. The record of which jobs you started and when, and your usage count, sit in the same database without that encryption. So does a fingerprint of your email address (a SHA-256 hash, see §7), kept beside the encrypted address so we can find an account from an address: it is not your address, but anyone who already has your address can compute the same fingerprint and check it against ours. Limit, stated deliberately: this protects a stolen backup, a decommissioned disk or a copied snapshot — the realistic ways a small operation leaks data. It does not protect against someone who has taken over the running server itself, and we do not claim it does.
  • Your access token is not stored in a usable form. We keep a one-way fingerprint of it, so a copy of our database is not a set of working logins for our customers.
  • Strict per-account separation. One account can never read another's data; this is enforced in the storage layer and tested.
  • Encrypted in transit over HTTPS.
  • A new computer using your account is shown to you. Each time the Account page opens, the app tells our server which installation it is. If that is not the installation that used the account last, the Account page on the computer that has just taken the account over shows a notice that the account was being used on another computer until just now. We count these changes: the count starts over only after 168 hours (a week) with no change, and once there have been more than five, the notice says instead that the account has been flagged. Nothing is emailed, nobody is signed out, and the computer that used the account before is not told at that moment; it sees the same kind of notice only when it next opens its own Account page, which takes the account back. This is an alarm, not a lock — we will never refuse service to the person who paid, because locking a customer out of what they bought is worse than the theft it would prevent.

No system is perfectly secure; we cannot guarantee absolute security.

7. Retention and deletion

We keep your data while your account is active. You can delete your account and its data yourself, at any time, without asking us — in the app under Search Settings → Your data → Delete my data (also on the Account page). You can also ask us by email (§8). Deleting in the app is available even if your account has lapsed or was never connected: the right to erase your data does not depend on your billing status.

You choose the scope:

  • Your data on this computer — your résumé, parsed profile, confirmed facts, saved answers, job list and application history, tailored documents, the evidence folders from past attempts, and any employer logins saved in the app's browser. Your search settings are reset to blank rather than deleted, so the app still runs.
  • Everything, including your account — the above, plus your account record on our server (your answers, remembered answers, email and usage history), after which the app is disconnected. Any unused credits are lost.

Deletion is verified, not assumed: the app re-reads the disk afterwards and tells you plainly if anything could not be removed (for example a file another program has open), rather than reporting success it has not checked. When you delete everything from the app, your profile, answers, email address, usage record, application records and sign-in sessions are removed from our server's database at that moment, together with the record of requests turned down because your free applications were used up (§2), and any sign-up or sign-in-code request on your address that is still waiting for its code. If you ask us by email instead, we complete the deletion within 30 days; we match an emailed request to an account by its email address, so send it from the address on the account. Some records are kept because the payment system or the two fingerprints below need them — see "What deletion does not remove". Billing records are held by Stripe. Our host, Render, may keep backup copies of the disk our database is stored on, on its own schedule, so a deleted account can remain in such a copy for a time after it is removed from the database itself.

What deletion does not remove

Some records are kept after you delete everything. Two of them are a fingerprint of your email address: a SHA-256 hash of it. The fingerprint is not your address and we do not use it to contact anyone. But it is the same every time, so anyone who already has your email address can compute the same fingerprint and check whether it matches one we hold, and so can anyone who guesses it. Your résumé text and facts, your saved answers, your application history, your email address and your account record are all destroyed as described above, and we no longer hold an account for you.

  • If you have used the unsubscribe link in one of our marketing emails, we keep the fingerprint of your address so that the unsubscribe keeps working. Without it, deleting your account and signing up again on the same address would quietly put you back on the list.
  • Whatever kind of account you had, if it had an email address on file and you either deleted the account or changed that address to a different one, we keep the fingerprint of the address the account left, so that the same mailbox cannot claim a fresh free allowance by deleting its account, or by moving it to another address, and signing up again. We keep only the fingerprint: no address, no account, no date. It answers one question and no other: did an account here have this address on file and then leave it, by being deleted or by a change of address? The mark is written at the moment the account leaves the address: when you delete the account, when a confirmed change of email takes effect, or when the address on an account is replaced by a different one in any other way, which includes our payment handling. It is not written when an account first gets an address, or when the same mailbox is confirmed again, including under a variant of the address that our sign-up treats as the same mailbox (capital letters, a plus tag, dots in a Gmail address). It is kept whether you were on the free allowance or had bought applications, and whether or not you had used any of the free applications. A new account can still be opened on that mailbox, but it starts with no free applications; applications can be bought for it. Because of this mark, our sign-up tells anyone who enters that address, without needing access to the mailbox, that it has had an account here before (not whose it was, whether it was deleted or still exists under another address, or when), just as it tells anyone who enters an address that has an account now that the address is already in use. The fingerprint has no end date: it carries no time, nothing in our code expires it, and nothing in our code removes it, including deleting the account later.
  • If you bought applications, a bare purchase record stays: the payment processor's reference for each purchase, how many applications it added and when. It holds no name, address or email, and is tied only to an internal account fingerprint that no longer points at anything. It is kept so that a repeated payment notice from the processor cannot add the same applications twice.
  • Internal housekeeping records that never pointed at an account: the counters that limit sign-up, account-recovery, sign-in and unsubscribe requests, which hold only a hash of an IP address (for sign-in codes, also a hash of an email address) and a time. Those holding a hash of your email address are deleted when you delete your account (§2); a code asked for on your address after that is counted afresh. That hash, too, is plain SHA-256: anyone who already has an IP address or an email address can compute the same hash and check it against ours. (Sign-in sessions are not kept; they are ended when you delete.)

We do not describe the two email fingerprints as anonymous, and we do not claim they fall outside personal data: each is derived from your address and is used to make a decision that affects you. What we do say is that each is kept for a single stated purpose, and that each can be matched by anyone who already has the address. The purchase record and the two email fingerprints kept after deletion are also counted, in totals, by our own report on how the Service is used (§3); those counts say nothing about any one person.

8. Your rights

Wherever in the United States you live, you can ask us to tell you what personal information we hold about you and send you a copy of it, to correct it, or to delete it, and you can withdraw a consent you have given us. Much of this you can do yourself in the app: change your details on My Info, untick "Product email" on the Account page (§9), or delete your data (§7). For anything else, including a copy of what we hold, write to hello@forgettheforms.com from the address on your account. There is no automatic tool for these requests: a person handles each one by hand, and we respond within 30 days. We will not charge you, refuse you service or treat you differently for asking.

9. Marketing email

Marketing email has its own section because it is the one kind of message you can switch off — and because switching it off does not switch off the rest.

What it is. Occasional email about the product itself: news of a new feature, or a tip for getting more out of it. Any such message goes to the email address on your account and nowhere else: we do not put your address on anyone else's list, and we do not sell or rent it (see §5).

It is opt-in. We send it only to an address whose account ticked the box — "Send me product news and tips by email" — when signing up, or ticked "Product email" later on the Account page. The box is never ticked for you. An account that was never asked, or never ticked it, gets no marketing email from us. While the box stays ticked, we keep the date you ticked it and the wording you saw; unticking it on the Account page clears that record.

How to switch it off. Any one of three ways is enough. Untick the box under "Product email" on your Account page. Or use the unsubscribe link that every marketing message we send carries: it works in one click, needs no login and no password, and takes effect as soon as you use it — you do not have to be signed in, or even still have an account, for it to work. Or write to hello@forgettheforms.com and ask us to stop; there is no automatic tool for this, so a person handles your request by hand. However you do it, we stop sending, and in no case later than 10 business days after you ask.

The unsubscribe link stays in force; the box on the Account page is per account. The unsubscribe link is recorded against your email address rather than against your account, so it survives you deleting your account, signing up again on the same address, and ticking the box again: once an address has unsubscribed through the link, no later tick starts marketing email to it. Otherwise an unsubscribe could be undone by something that has nothing to do with it. That record is one of the things §7 tells you we keep after deletion. Unticking the box is different: it is recorded on that one account only, so ticking the box again, or ticking it on a new account on the same address, starts marketing email again.

Switching off marketing does not stop account email, and the difference is worth being clear about. These are not marketing: a sign-up, sign-in or reset code, the connect code we send when a purchase creates your account, a code or a notice about a change to the email address on your account, a reply to something you asked us, and a notice that this policy or the Terms have changed. When we send you one of those, we send it because it is part of running your account for you — it travels by a different route from marketing email, and unsubscribing from marketing does not stop it. If you want no email from us at all, the way to get there is to delete your account (see §7).

What every marketing message carries. A line saying it is promotional, a working unsubscribe link, and our postal mailing address, as US law requires. We do not send one without all three: the code that sends marketing email refuses to.

10. International users

The Service is offered only to individuals located in the United States (see the Terms of Service). We do not knowingly offer it to, or collect data from, anyone located outside the US. Before you create a free account or buy applications, the app asks you to tick a box saying you live in the United States (version 2.6 of the app asks only before you buy). That tick is your own statement: the app does not check where you are, and nothing about the tick is stored or sent to us.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

12. Changes

We will post updates here with a new effective date and, for material changes, notify you by email at the address on your account. That email is an account message, not marketing, so it reaches you even if you have switched marketing email off (§9). The mail provider accepting a notice is not proof that it reached your inbox, and an account with no email address on file cannot be emailed, so for such an account the effective date posted here is the only notice.

13. Contact

Privacy questions or requests: hello@forgettheforms.com. Write to us by post at: Forget The Forms LLC, 530 E Main St, Unit 3A #451, Chester, NJ 07930.