Privacy
Short version: your CV is stored in your browser on this device and is never sent to CV Once or anyone else. The site sets no cookies and loads nothing from other companies.
Where your CV is kept
- In this browser only. The builder saves your CVs (text, settings and any photo you add) in your browser's local storage on this device. It is never uploaded. CV Once has no server-side copy, no account system and no database of CVs.
- The page can't send it anywhere. The site's Content Security Policy includes
connect-src 'self', which tells your browser to block the page from sending data to any other server, and the builder never sends your CV to this one either. The only requests the builder makes are for the site's own files (templates, example CVs and word lists). - Exports are made on your device. PDFs are produced by your browser's own print dialog; text, Markdown and JSON files are generated in the page and saved straight to your device.
Back it up yourself
Because your CV lives only in this browser, it is lost if you clear your browsing data, use a private window, or switch device or browser. Some browsers also clear storage for sites you haven't used for a while: Safari, for example, may delete it after seven days of browsing without a visit, unless you've added the site to your home screen. The builder's "My CVs" panel has a button that asks your browser to keep the storage. To keep it safe, use Export → JSON backup in the builder now and then, and keep the file somewhere you back up. Import brings it back on any device.
No cookies, no trackers
CV Once sets no cookies and loads no third-party scripts, fonts, images, analytics or advertising. Every file comes from cvonce.com. If this ever changes, for example if advertising is added, this page will say so before it happens, and the CV itself will still stay on your device.
Server logs
Like almost every website, the server keeps a log of requests: the time, the page requested, the referring page, the browser's user-agent string, and a shortened network address (the last part of the IP address is removed before anything is written, so the log cannot point to one connection). The log is used only to count visits and to stop abuse, is never shared or sold, and is deleted after 30 days. The legal basis under the GDPR is legitimate interest in running and securing the site. What you type into the builder never reaches the server, so it is never in the log.
The hosting proxy in front of this site (measured 2026-10-26): successful requests are not logged there. Requests that fail at the proxy are recorded with the visitor's IP address and browser user-agent, with cookies and authorization headers redacted, and are currently kept until the proxy is restarted. A retention limit for those records is under review.
Offline use
A small service worker caches the site's own pages and files so the builder keeps working without a connection. It stores copies of CV Once's files only; your CV stays in local storage.
Your rights
CV Once holds no account or profile about you and never receives your CV, so there is nothing about you to request or delete beyond the 30-day server log described above. To delete your CVs, use Delete in "My CVs", or clear this site's data in your browser settings.