Privacy Policy

Riffed is a job-search tool built for people who have recently been laid off. It helps you tailor your resume, draft cover letters, and shape your professional story. This policy explains what information we collect, how we use it, and the choices you have. It applies to the Riffed application at riffed.io. (The old app.riffed.io address now redirects here.)

We treat your resume and your employment situation as sensitive information, because they are. Two principles guide everything below: we collect only what we need to provide the service, and we never sell your personal information. Handling this information carefully is a core feature of Riffed, not an afterthought.

• To provide the core service: tailoring resumes, drafting cover letters, and related tools.
• To authenticate you and keep your account secure.
• To operate, maintain, debug, and improve the reliability of the service.
• To communicate with you about your account or important service changes.

We do not use your resume or layoff information to make automated decisions that produce legal or similarly significant effects about you. Riffed reframes and sharpens the real experience you provide; it does not invent employers, titles, dates, or credentials on your behalf.

Riffed uses Anthropic’s Claude API to generate resume suggestions and cover letters. When you use these features, the content you provide is sent securely to Anthropic’s API to produce your result. We do not permit your inputs or outputs to be used to train AI models. AI processing happens server-side; our API keys are never exposed to your browser.

We rely on a small number of infrastructure providers to run Riffed, each acting on our behalf. A dated, complete list lives at riffed.io/subprocessors.

• Supabase: authentication, database, and storage (where your account and content are held).
• Vercel: application hosting and content delivery.
• Anthropic: AI processing via the Claude API, as described above.
• Stripe: payment processing, only if you or someone else buys something. Stripe sees a buyer’s own email and payment details. If a gift or seat was bought for you, Stripe has nothing about you at all.
• Resend: sending transactional email — sign-in confirmations, password resets, claim links, and any digest you opted into.
• Google and LinkedIn: only if you choose to sign in with them, for authentication.

Some pages let you write things down for yourself — what a job was carrying for you, who is in your corner, what to make of a rejection. Those pages are stored in your account like anything else and are covered by everything on this page, with two additions worth stating plainly: nothing you write there is scored, analysed for mood, or summarised, and nothing you write there is ever sent to an AI model. They exist for you to read, not for us to learn from.

Your data is encrypted in transit and at rest. Access to your records is restricted at the database level so that, by default, only you can access your own information. Sensitive credentials are held server-side and are never sent to the browser.

We keep your information for as long as your account is active. You can delete your account at any time, which removes your profile and associated records. If you need help deleting your data, contact us using the details below.

You can access and update your account information, request a copy of your data, or ask us to delete it. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including the right to object to or restrict certain processing. We honor these requests as required by applicable law.

We use cookies that are necessary to keep you signed in and to operate the service securely. We do not use advertising cookies or sell your information to advertisers.

Riffed is intended for adults in the workforce and is not directed to anyone under 18. We do not knowingly collect information from children.

We may update this policy as the product evolves or as legal requirements change. When we do, we will revise the “Last updated” date above. Significant changes will be communicated through the service.

Questions about this policy or your data? Email privacy@riffed.io.