Is it safe to use an online resume builder? What to check before you sign up

Using an online resume builder is usually safe, as long as you're careful about what you put on the resume and what you let the builder do with it. Your resume holds your name, phone number, email, city and work history, and it gets copied to every builder, job site and employer you send it to. Leave off anything a stranger could use to pose as you, such as your date of birth, an ID number or your full street address.

Then check the builder's privacy policy. It should tell you whether the builder sells or shares your data, whether profiles or links are public by default, whether it trains AI on your content and how you delete your account. Most of the real risk sits in those four answers.

What are the risks of an online resume builder?

Leaks happen, including at resume builders

In July 2025, the security research site Cybernews reported that "An unprotected Microsoft Azure storage container has spilled over 5.1 million files, mostly resumes and CVs, for anyone to find on the internet." It linked the container to LiveCareer, a resume builder, and said the files were dated between 2016 and 2025. They held names, phone numbers, email addresses, home addresses and work histories. Cybernews counted files, and one person can have several. LiveCareer hadn't commented when the report came out.

It isn't the only one. Cybernews also found nearly 26 million files, most of them US job seekers' resumes, in storage linked to the applicant tracking system TalentHook. WIRED reported that McDonald's AI hiring chatbot, run by Paradox.ai, exposed "as many as 64 million records", after researchers logged in with the username and password "123456". Paradox says the researchers accessed seven records in total.

You can't check a company's storage settings yourself. What you can control is what's in the file if it leaks.

Leaked resumes feed job scams

A resume tells a scammer your name, contact details, field and job history, which is enough to write a convincing fake job offer. Cybernews made that point about both leaks, and WIRED said the McHire data could have been used by fraudsters "impersonating McDonald's recruiters".

The FTC says reports of job and employment agency scams tripled from 2020 to 2024, and reported losses rose from $90 million to $501 million. Its advice says "Real employers won't ask for that kind of information before they've actually interviewed and hired you." That information is your driver's license, Social Security or bank account number. The FBI gives the same advice, and in 2020 it put the average reported loss in fake job scams at "nearly $3,000 per victim".

Some builders can sell or share your data

Privacy policies differ more than you'd expect. Resume.io's policy, updated in September 2026, says "We may use the personal data we collect from your resume to sell to third parties, including data brokers, for targeted advertising, profiling, or to sell to others." It adds that this is based on your consent, which you can withdraw.

Zety's and ResumeBuilder.com's policies, which use the same text because both brands belong to Bold, say that sharing your browsing data from cookies with marketing partners "may be considered a sell" under California's privacy law. Kickresume's says it will "never share your resumes and cover letters with recruiters or job sites", though a separate tick box lets you agree to share your details with partner employers. Novoresume's says "By default, all your data is private."

Profiles and share links can be public

Some builders and job sites make your resume findable unless you change a setting. Zety's policy says that if you use the site, Bold "can create" a profile from the information you give it, and that the profile "will be publicly viewable", including in search engines such as Google and Bing, until you restrict it in your settings. On Indeed, a profile "is set so that employers can find you by default." LinkedIn says a resume you attach to your profile or a post "may be visible off LinkedIn."

Share links are the other gap. Canva's policy describes "Anyone with the link" sharing and says "We do not recommend this option for information you wish to keep confidential." A link you send to one recruiter can be forwarded to anyone.

Whether a public page shows up in Google depends on a tag called noindex. Google's own documentation says a robots.txt file "is not a mechanism for keeping a web page out of Google", so a builder that uses one to hide pages isn't hiding them reliably.

Your resume can be used to train AI

Builders that write with AI send your text to an AI company, and their policies differ on training. Canva says it may use your content "to train our algorithms, models and AI products" and lets you opt out in your privacy settings. Kickresume trains on "strictly anonymised data", but says it "cannot, however, fully rely on" that anonymization. Novoresume names OpenAI and Anthropic as its providers and says they don't train on your data.

The difference between an app and a chatbot matters too. Data sent through OpenAI's and Anthropic's APIs isn't used for training by default. OpenAI says the consumer version of ChatGPT "may use your content to train our models" unless you turn that off, and Claude asks you to choose. If you paste your resume into a chatbot, check that setting first.

Removing your email and phone number before you paste doesn't make a resume anonymous. The UK's data protection regulator, the ICO, points out that "personal data" is a broader concept than the PII many companies focus on. Your job history alone can be enough to identify you.

Deleted data can take time to disappear

Deleting your account doesn't always delete everything at once. Novoresume keeps identifying data "no longer than 6 years since the last usage". Kickresume keeps it for 30 days after you close your account, in case you change your mind. Canva keeps content "for a commercially reasonable time" after an account is closed. The ICO says data can also stay in backups "until it is overwritten".

What should you leave off your resume?

The safest data is data you never upload. US career offices agree on what to leave out.

• USAJOBS, the federal government's jobs site, says not to include your Social Security number, photos of yourself, or your age, sex or religion.
• NC State's textiles college says "Do not include date of birth, social security number, photo, age, marital status, religion".
• Wellesley's career office says "No need to include your full address, listing the city and state are enough."

In practice, that leaves your name, a plain email address, a phone number, your city and state, and a LinkedIn or portfolio link if you have one. Watch your email address too. One with a birth year in it gives away your age.

Some countries still expect a date of birth or a photo on a CV, and if you're applying there, follow local practice. ID numbers are different. Keep passport, driver's license and Social Security numbers off your resume everywhere, and give them only on official forms after you've been hired.

How to check whether a resume builder is safe

You can answer most of these questions in ten minutes with the builder's privacy policy and your browser.

1. Does it sell or share your data? Search the policy for "sell", "share", "data brokers" and "advertising".
2. Is anything public by default? Search for "public", "profile" and "search engines", and look at the default sharing setting before you create a link.
3. Does it train AI on your content? Search for "train", "model" and "artificial intelligence", and look for an opt-out.
4. Can you delete your account yourself? Look for a delete button in the settings, and search the policy for "retain" to see how long data stays afterwards.
5. Where is your data stored, and who else processes it? A good policy lists its service providers and the countries they're in.
6. Does an import upload your file? In Chrome, open DevTools with Cmd+Option+I on a Mac or Ctrl+Shift+I on Windows, choose the Network tab, then import your resume. The Network panel shows every request the page makes. If the builder saves the resume to your account, you'll see that text being saved, but no request should carry the file itself unless the builder uploads it.
7. Does it load advertising trackers? Search the policy for "pixels" and "advertising partners", and check whether the cookie banner lets you turn them off.
8. What will it cost? Read what the trial renews at before you enter a card. Our guide to whether resume builders are worth it shows the renewal prices of five well-known builders.

If your contact details already show up in Google, its "Results about you" tool lets you ask for search results with your address, phone number or email to be removed.

Your rights over your resume data

Where you live decides which rights you have, and most come with a deadline.

In the EU, the GDPR gives you the right to a copy of your data, the right to have it erased and the right to get it in "a structured, commonly used and machine-readable format". The UK GDPR gives people in the UK the same rights. The company must answer "within one month", which it can extend by two more months for complex requests. The ICO's guide adds that you can ask "any part of the organisation", verbally or in writing.

In California, the CCPA covers for-profit businesses above a size threshold, such as more than $25 million in yearly revenue. It gives you the right to know what a business holds about you, the right to delete it and the right to opt out of its sale or sharing for advertising. The California Attorney General's page says "Businesses must respond to your request within 45 calendar days," and opt-outs must be honored within 15 business days. Turning on the Global Privacy Control setting in your browser counts as an opt-out. California also runs a deletion platform for data brokers, the Delete Request and Opt-out Platform, which sends one request to every registered broker.

Outside these places, many builders still honor a deletion request. Email the address in the privacy policy and keep a copy of what you sent.

How OneCV handles your data

Here are OneCV's own answers to the questions above, from its privacy policy and the way the app works.

Frequently asked questions

Is it safe to upload my resume to a resume builder?

Usually, yes. Leave your date of birth, ID numbers and street address off the resume, and check the builder's privacy policy for selling, public profiles, AI training and deletion before you upload.

Do resume builders sell your data?

Some say they can. Resume.io's privacy policy says it may sell personal data from your resume to third parties, including data brokers, with your consent. OneCV's says it doesn't sell or rent personal data. Search the policy for "sell" and "share" before you sign up.

Can I delete my data from a resume builder?

Usually. Look for a delete button in your account settings. If there isn't one, email the privacy contact. In the EU and UK the company must answer within one month, and in California within 45 days. Some builders keep data for months or years after you stop using them, so check the retention section.

Is it safe to put my address on my resume?

Put your city and state, and leave the street address off. Career offices such as Wellesley's say the city and state are enough, and an employer who needs your full address will ask for it on a form after an offer.

Do resume builders use your resume to train AI?

Some do. Canva says it may train its models on your content and lets you turn that off, and Kickresume trains on what it calls anonymized data. Novoresume says its AI providers don't train on your data, and OneCV says it doesn't use your documents to train AI. Search the privacy policy for "train" before you upload.

Is it safe to use ChatGPT to write my resume?

It's safer if you change one setting. OpenAI says ChatGPT may use your content to train its models unless you turn that off, and temporary chats aren't used for training. Remove your contact details and any ID numbers before you paste, and remember your work history can still identify you.

Create your free OneCV account and build your resume with no ads, no data sales and no card.