Security and privacy
It has your address, your phone number and your entire employment history in one document. Here is exactly what GrowAhead does with it, and what it does not.
Only a bcrypt hash at a work factor that costs real time to brute force. Sign-in failures return one message for both “no such account” and “wrong password”, because two different messages would tell a stranger which addresses are registered.
The cookie is httpOnly and SameSite=Lax, so page scripts cannot read it and another site cannot send it. Session tokens are held as hashes, so a database leak hands over no live sessions.
This service handles resumes. A log that captured bodies would copy somebody’s employment history into a file with whatever retention the log store happens to have. Errors carry a request id instead, so one support message finds exactly one event.
Files are deleted 7 days after upload, along with their metadata. Keeping them indefinitely would be a liability, not a feature. You can export or delete everything else at any time from your account settings.
Model-backed endpoints spend real money per call, so requests are refused before any work happens — a rejected request costs nothing. Limits are shared across workers through Redis rather than being per-process.
A rewrite that introduces something your source document did not state is discarded by a grounding check before you ever see it. Learning history cannot bypass this: only a skill proven by a passed quiz may be referenced at all.
What is not true yet
Found something wrong? Write to privacy@growahead.in.