CoverCraft — Privacy Policy

Last updated: 31 July 2026 · Effective: on first publication

CoverCraft is published by Sycamore Hill Studios. This policy describes the app as it is actually built, not a generic template.

The short version. There is no account and no sign-up. Your resume and the job posting you paste are sent to our server to write the letter and are never written into our logs. Saved resume profiles and letters live on your phone. On a paid plan a copy of the letter is held for at most 24 hours so a rewrite can build on it, and for nothing else.

1. What we collect

Data	Why	How long we keep it
A random device identifier A randomly generated UUID created on first launch.	To count your daily free usage and to remember whether you have a subscription. It is not a hardware ID, not an advertising ID, and it does not follow you between apps.	Until you delete your data or uninstall.
Your resume and the job posting Plus the tone and length you choose.	Sent to our server, which passes them to Microsoft Azure OpenAI to write the letter.	Never written into our logs. A resume is a name, an address, a phone number and an employment history in a single paste, so it is treated as sensitive in code: our logs record only the app, the task, the units it cost, how many characters came back, and a random content id — never your text, not even a truncated excerpt. At most 24 hours, and only on a paid plan. Paid plans can rewrite a letter, so the server keeps the letter it just wrote in order to build on it. That copy expires 24 hours after it is written. On the free plan nothing is kept at all.
Saved resume profiles and letters	So you do not retype your resume for every application.	On your device only. Never uploaded to us. Removed when you delete them, delete your data, or uninstall.
Subscription status	To unlock paid features. Verified directly with Google Play.	Until you delete your data or the record expires.
Usage counts	To enforce the free daily allowance.	Rolling daily counters, tied to the random identifier above; removed when you delete your data.
Content reports	To review and improve safety filtering. Required by Google Play's AI-generated content policy.	Kept while we review them. A report contains the random content id, the reason you picked, and anything you chose to type — not your resume.

2. What we do not collect

No name, email address, phone number or postal address of your own — we never ask for one. Details of that kind inside a resume you paste are handled as the resume text described above.
No contacts, photos, camera, microphone or location access. The app requests two permissions in total: internet access, and the one Google Play Billing needs to talk to the Play Store app.
No advertising identifier. There are no ads in CoverCraft.
No third-party analytics or crash-reporting SDK. No Firebase Analytics, no Sentry, no Crashlytics, no tracker of any kind.
No payment details. Google Play processes all payments; we never see your card.
No profile of you, and nothing you paste is used to train an AI model.

3. AI-generated content

Letters and rewritten bullet points are generated by an artificial intelligence model (Microsoft Azure OpenAI), automatically and without a person reviewing them first. Every generated output carries a Report button.

CoverCraft will not invent experience you do not have. The model is instructed to use only what appears in the material you supply, and to check its draft against that material before answering. Read anything it writes before you send it — it is your application, going out under your name.

4. Who processes your data

Microsoft Azure (including Azure OpenAI) — hosts our server and generates the output. Data is processed in the United States (East US 2). Microsoft states that prompts and completions are not used to train or improve its models, and that the models themselves store nothing. Azure does run automated safety checks on what is sent; if something is flagged as potentially harmful, a sample may be reviewed — by an automated system in almost every case, and in rare complex cases by an authorised Microsoft employee under controlled access. We have not applied to disable that review.
Google Play — processes payments and tells us whether your subscription is valid. See Google's own privacy policy for how they handle it.

We do not sell your data, and we do not share it for advertising.

5. Deleting your data

Open Settings → Delete my data in the app. That removes the usage counters, the subscription mapping, the device identifier held for you, and anything held in the short-lived store described above. It takes effect immediately. Anything saved on your phone is removed with it, or by uninstalling the app.

6. Children

This app is not directed to children and we do not knowingly collect data from anyone under 13.

7. Changes

If this policy changes materially we will update this page and the “last updated” date above before the change takes effect.