Legal
Last updated: October 12, 2026
AboutStack is hosted at aboutstack.com. Some data must identify you so we can run your account (email, billing, resume content you enter). On our marketing, sign-up and account pages we use Google and Meta advertising and analytics cookies to measure our ads and improve the site — but only if you accept them in our cookie banner. We do not sell your personal data, and public resume pages stay completely tracker-free.
When you create an account: your email address, username, and the password you choose (stored as a one-way hash, we cannot see it).
When you use Google to sign in: your Google account email and display name, as shared by Google during authentication.
When you build your resume: the content you enter (job titles, employers, education, skills, etc.) and any photos you upload.
When you subscribe: Stripe handles your card details directly. We only store a Stripe customer ID, never your card number.
Automatically: your IP address (in server logs, retained for 30 days). We always set strictly necessary cookies for your session and form security (see below). If — and only if — you accept our cookie banner, Google Ads, Google Analytics and the Meta Pixel also set advertising and analytics cookies on our marketing, sign-up and account pages so we can measure our ad campaigns and site usage.
If you submit in-app feedback or a bug report while logged in: your message, optional page URL, browser user-agent string, account identifier, and timestamp, used only to respond and improve the product.
Your email: to send you account verification emails, password resets, and subscription notifications. Legal basis: contractual necessity.
Your resume content: to build and host your resume. Legal basis: contractual necessity.
Your GDPR consent timestamp: to prove you agreed to our terms and this policy. Legal basis: consent.
Feedback submissions: to operate support and improve AboutStack. Legal basis: legitimate interests (service improvement), and consent where applicable.
Your account data is kept until you delete your account. After deletion, your data is fully removed within 30 days.
Feedback records are kept only as long as needed for support and quality assurance, then deleted or aggregated so they no longer identify you.
You can download all your data at any time from your account settings.
You can delete your account at any time from your account settings. Deletion is permanent and processed within 30 days.
If you have questions, email aboutstack@gmail.com.
Strictly necessary cookies (always on). A session cookie (keeps you logged in) and a CSRF cookie (protects forms). These are essential to run the site and do not require consent.
Advertising & analytics cookies (only with your consent). On our marketing and sign-up pages we offer a cookie banner. If you click Accept, we load Google’s tag (gtag.js) for Google Ads (to measure whether an ad click led to a sign-up) and Google Analytics 4 (to understand how visitors use the site), and the Meta Pixel (to measure whether a Facebook or Instagram ad led to a sign-up, a free trial or a subscription). These set cookies in your browser. If you click Decline, none of these load and no advertising or analytics cookie is set. Legal basis: consent.
Server-side ad measurement (only with your consent). If you have accepted the cookie banner when you sign up, start a free trial or make your first payment, our server also reports that event to Meta through its Conversions API so the measurement works even when a browser blocks the pixel. We send your email address and account ID only as one-way hashes, plus your IP address, browser user-agent, and the Meta cookie identifiers from your browser, and for a payment its amount and currency. If you decline (or your browser sends Do Not Track), nothing is sent. To support this we keep a record of your cookie choice and those Meta cookie identifiers with your account.
Changing your mind. You can withdraw or change your choice at any time using the Cookie settings link in the footer. If your browser sends a Do Not Track signal, we treat that as a decline and do not show the banner.
Public resume pages. When someone views a published resume on a *.aboutstack.com subdomain, at aboutstack.com/cv/…, or as the owner’s preview, we load no Google or Meta tags and set no advertising or analytics cookies. Those pages remain completely tracker-free; see “Anonymous analytics” below for how we count views.
When someone views a public resume, we record a single anonymous page view. We do not set any cookie for this purpose, we do not use localStorage, and we do not run any third-party tracker.
To estimate unique visitors we compute a one-way hash of the visitor's IP address and user-agent combined with a server-side secret that rotates every 24 hours. The original IP address and user-agent are never stored, only the hash. Because the secret changes daily and the hash is bound to a single resume, the same person visiting tomorrow looks like a completely different visitor, and the same person viewing two different resumes cannot be linked.
We respect the DNT: 1 (Do Not Track) browser header: when it is sent, we skip the unique-visitor hash entirely and only increment an anonymous counter.
The raw pageview rows are deleted after 30 days. Only the aggregated daily counts (total views, unique visitors, top referring site) persist long-term so you can see your resume's traffic over time.
We compute site-wide, anonymised statistics about the kinds of content people put on their resumes, for example, how many people list a particular skill or job title. These aggregates are never per-user and never per-resume.
We apply a strict k-anonymity floor: any term that appears on fewer than 5 resumes is dropped, so no one can be singled out through an unusual entry. The resulting dataset contains no personal data and may be used internally for product decisions or shared with third parties as market-research insights.
Google Sign-In — If you authenticate with Google, Google processes your login according to its own terms and Privacy Policy. We receive only what Google sends to complete sign-in (such as email and name) and store it as part of your account.
Stripe — payment processing. Stripe's privacy policy applies to card data.
Cloudflare R2 — file storage for uploaded profile photos. Data stored in the EU.
Google Ads & Google Analytics — only if you accept our cookie banner. Google processes this data to measure our advertising and site usage under its own Privacy Policy. No Google tags load until you consent, and none load on public resume pages.
Meta (Facebook & Instagram) — only if you accept our cookie banner. Meta Platforms Ireland Ltd. receives the Meta Pixel and Conversions API events described above to measure our Facebook and Instagram ads, under its own Privacy Policy. Nothing is sent to Meta until you consent, and the pixel never loads on public resume pages.
We do not sell your personal data. We do not share it with advertisers except for the consent-based measurement with Google and Meta described above.