Back to ResuLune

Security

Verify what you download.

A plain-language guide to current platform warnings, SHA-256 checksums, local data, and responsible issue reporting.

Why an operating system may show a warning

Current ResuLune Desktop builds are not signed or notarized with paid Windows and Apple publisher certificates. Windows or macOS may therefore be unable to verify the publisher automatically. A warning is not proof that a file is malicious, but it is a reason to confirm that the file came from the official website and matches the published checksum.

Verify a SHA-256 checksum

A checksum is a digital fingerprint. Run the command for your platform, then compare the complete result with the value in the ResuLune checksum archive. The values must match exactly.

  • Windows PowerShell: Get-FileHash "C:\path\to\ResuLune-Setup.exe" -Algorithm SHA256
  • macOS Terminal: shasum -a 256 /path/to/ResuLune.dmg
  • Linux Terminal: sha256sum /path/to/ResuLune.AppImage

If the checksum differs, do not open the file. Delete it and download it again from the official download section.

How resume data is handled

The applications do not implement accounts, cloud resume storage, advertising SDKs, or a resume-upload channel. Desktop profiles and gallery images are stored on your device. The Web edition processes resume content in your browser; an explicit Save keeps the profile in that browser for up to seven days.

The website, Web edition, downloads, and update service use limited first-party server analytics. The server processes the network address, stores a secret-keyed pseudonymous identifier and approximate location for selected requests, and automatically deletes those analytics events after 90 days. Resume content is not part of this data. See the Privacy Policy for the complete categories, purposes, and controls.

Report a security concern

Send a clear description to info@resulune.com. Include the affected edition and version, reproduction steps, potential impact, and any non-sensitive evidence. Please avoid sending exploit code or personal resume data unless requested through an agreed safe channel.