Now Is the Time to Stop Building Your Resume Online

A resume is the most complete record of yourself you will ever hand to a stranger. It holds your full name, your personal email address, and the telephone number that rings in your pocket. It maps your employment history, your education history, and your skills. A form on a website asks you to type out the timeline of your adult life. That timeline becomes a database record on someone else's server.

Read the fine print

Look at the terms attached to the forms. Two well-known resume builders owned by the same parent company updated their privacy policies in March 2025 and July 2025. Both contain this sentence: "We may use the personal data we collect from your resume to sell to third parties, including data brokers, for targeted advertising, profiling, or to sell to others." They clarify elsewhere that "we may also sell your personal data to data brokers, analytics companies, third-party advertisers, or other merchants." One of them lists what that data includes: "your name, email, job title, phone number, address, birth date, place of birth, employment experience and information, education history, website and social links, skills."

A third large builder, owned by a different company, updated its policy in July 2026. It notes that "If you have chosen to participate in some of our career building Services, the information you share with us can be provided to third parties such as (i) resume editors, (ii) employers or recruiters who can contact you about career opportunities". It adds: "Because of the CCPA's broad definition of data selling, in some instances, our sharing of data may be considered a sell".

The first two builders also look at your text as raw material. "We may use your personal data to further develop our existing products and services, including artificial intelligence tools and features". Sending your resume to job sites is described as happening "with your consent".

The copies left behind

Security researchers found over 5.1 million files in a misconfigured cloud storage container belonging to a resume-building and job search platform with more than 10 million users. The documents were mostly resumes and CVs dated 2016 to 2025. They held full names, phone numbers, email addresses, home addresses, and complete employment histories. Reported in July 2025; the company had not made a public statement by the time it was reported.

A separate exposure was found on January 7, 2025, involving an applicant tracking software maker. This is the kind of system a resume lands in after you apply. Nearly 26 million files, mostly resumes of US job seekers, sat in a publicly accessible cloud storage container. It was disclosed on April 2, 2025.

A leaked resume holds everything a fake recruiter needs to sound real. Between 2020 and 2024, reports of job and employment agency scams tripled, and the money people reported losing to them rose from $90 million to $501 million, according to the FTC.

If you stay in the browser

If you keep using an online builder, there are ways to limit what you hand over:

• Search the privacy policy for the words the policies above use: "sell", "data brokers", "recruiters", and "artificial intelligence".
• If the policy offers a way to opt out of the sale or sharing of your data, use it before you type anything.
• Leave off what nobody needs at the first stage. A city is enough for your street address. Strip out your birth date and place of birth, and skip a photo unless the job market you apply in expects one.
• Use a separate email address for applications.
• When you are done, delete the account and ask for your data to be deleted, following the policy's own section on it.

Every upload adds one more copy you do not control. An upload is a copy, rather than a loan. The fewer copies exist, the fewer can leak.

Keep the file on your machine

ResumeRoast is a desktop app for Mac and Windows. Resumes and cover letters are kept in a database file on your own disk. You construct the document on the machine you own, and the data stays there.

It talks to getapps.cafe for two things only: checking your membership, and checking whether a newer version exists. No field of your resume is part of either request. It has no AI and generates no text. There is nothing for it to train. A resume can be exported as a JSON file to back it up or move it to another machine, and imported again. The only copy that leaves your computer is the final PDF you send to the job you chose.

Drafting and exporting

Type into the form on the left and a live A4 preview redraws on the right; the PDF you export is what the preview showed. There are 12 resume templates: Modern, Classic (ATS), Creative, Compact, Elegant, Minimal, Timeline, Sidebar, Executive, Technical, Bold, and Corporate. Six take a photo; six are text-only, including the ATS layout. Long-form fields take rich text, and there is a photo cropper: drag, and scroll to zoom.

Duplicate a resume for each job; every copy keeps its own template, colours and content. Switching template reflows the same content into the new layout. You get 23 colour swatches plus a hex field in every colour picker, and every font installed on your machine alongside built-in Sans, Serif, and Mono.

There are 6 cover-letter designs. A cover letter can borrow the name and contact details from a linked resume and shares its look, then exports as its own PDF.

What stays off the page

The PDF export is A4 only. There is no US Letter size. It does not write or rewrite your bullet points. It does not post to job boards or send applications. You attach the PDF yourself, to the job you chose. It is not a website: the resume is on the machine where you made it, and moves by JSON file.

Your career history is nobody's product. Keep it local. ResumeRoast is part of the Mocha shelf, and you can download it with a free trial today.