Who else can see your data
Riffed.io is one person’s software running on other people’s infrastructure, which means a handful of companies necessarily touch what you give us. Here is the complete list, what each one does, and exactly what reaches it.
Reviewed August 2026. If this page is out of date, that is a bug — tell us at hello@riffed.io.
Services that handle your information
Database, authentication, file storage, and the server functions that run our tools.
What reaches them: Effectively everything you give us: your account, your resume file and the parsed profile, jobs you save, drafts we generate, and any numbers you enter into the runway calculator.
Hosts the website and the app, and serves every page you load.
What reaches them: Standard request data: IP address, browser, and the pages you visit. Not your resume contents.
The AI model behind resume tailoring, cover letters, and the brand tools.
What reaches them: The specific text a tool needs for the task you asked for: relevant parts of your profile and the job description you pasted. Anthropic does not train its models on data sent through the API.
Sends transactional email: sign-in confirmations, password resets, and digests you opted into.
What reaches them: Your email address and the contents of the message we send you.
Runs our human inbox at hello@riffed.io.
What reaches them: Only what you choose to put in an email to us.
Optional sign-in providers, if you choose to use one instead of a password.
What reaches them: Your name and email address, passed to us when you authorise the sign-in. We never receive your password.
Job sources
Worth separating out, because the difference matters. These services answer questions about jobs. They never receive your resume, your profile, or anything that tells them who is asking.
Job listing search.
What reaches them: The search terms and location you type. Not your name, not your resume, and nothing that identifies you to them.
Reading the public job boards of companies you choose to watch.
What reaches them: The public board address you asked us to check. Nothing about you at all.
Who is not on this list, and never will be
- No advertising networks or trackers. We do not run ads and we are not building an audience to sell.
- No data brokers. Your resume and the fact that you were laid off are not products.
- No recruiters or employers. Nobody pays us to reach you, and no third party receives your profile because they asked.
- No analytics vendor. What we measure, we measure ourselves, in our own database.
The honest limits
Your data is encrypted in transit and at rest, and access is restricted per-row so one account cannot read another’s. But we do not use end-to-end encryption, because the tools have to read your resume in order to do anything useful with it. That means our infrastructure provider, and whoever holds our service keys, could technically reach the database. We would rather tell you that than imply a guarantee we cannot make.
Deleting your account deletes your rows and your uploaded files, not just a flag on a record. Questions about any of this, including from a security team doing a review, go to hello@riffed.io and get a real answer.