Privacy Policy

1. Our Commitment to Your Privacy

We deeply respect your privacy. The information you provide, specifically the textual contents extracted from your Resume and LinkedIn PDFs, is never sold to third-party data brokers.

2. How We Use the Data Collected

The data you upload is exclusively utilized for two distinct purposes:

1. Providing the analysis: We temporarily extract text from your PDFs and securely pipe it via API to our LLM partners (OpenAI and Anthropic's Claude) solely to generate your custom statistics and analytical roadmap.
2. Personalized Roadmaps & Data Retention: To provide the Premium Roadmap service without requiring re-uploads, we securely store the extracted text from your Resume and LinkedIn profiles in our encrypted database. This data is only accessible to you and is used exclusively for your roadmap generation.
3. Survey & Feedback Collection: We collect and store your responses to the 9-question personalization survey and any feedback you provide (ratings, category tags, and comments) to improve our recommendation models and platform experience.
4. Identity Integrity: We extract your name from the uploaded documentation solely to ensure that premium re-evaluations are utilized by the same individual, preventing account sharing and maintaining the integrity of our premium services.
5. Communication & Feedback: We may contact you via the email address provided to share updates about new platform launches, feature releases, or to request feedback on your experience. We typically limit these communications to 2-3 times per quarter to avoid inbox clutter.
6. Platform Improvements & Benchmarking: We retain anonymized, generated outputs (e.g., job title, risk level, and computed score) to derive aggregated statistics, global industry averages, and real-time percentile rankings. This anonymized data helps us provide benchmarking insights for all users and improve our analytical models without compromising your personal identity.

3. External Processing Over which We Share Data

Because our logic relies heavily on cutting-edge AI computation, data processing happens via strictly vetted external pipelines covered under their respective privacy structures:

• Inferences & LLMs: Text is transmitted to OpenAI and Anthropic per their API data governance guidelines, wherein they do not use API data to train their models under zero-data retention commitments if authorized as such.
• Checkout: Billing data is heavily sequestered and handled completely by Dodo Payments; we never touch, see, or store your credit card information.
• Database & sign-in: Supabase hosts our database and handles authentication. Your account, your evaluations, and your autofill profile are stored there.
• Email delivery: Resend sends the emails we send you, and therefore processes your email address and the contents of those messages.
• Error monitoring: Sentry receives diagnostic reports when something breaks. These are generated by faults, not by normal use, and may include your IP address, the page you were on, and your account identifier so that we can reproduce the fault.
• Website analytics: Google Analytics measures aggregate traffic — which pages are visited and how people arrive. We do not use it to build advertising profiles, and we do not show personalised ads.

None of the services in this list are used by the Job Autofill browser extension. Its network requests go only to us and to Supabase, as described in section 4.

4. The Job Autofill Browser Extension

Job Autofill is our optional Chrome extension. It fills job application forms from a profile you write yourself. It is a separate decision from using the website: you have to install it, and then explicitly connect it to your account.

The voluntary equal-opportunity questions

US application forms routinely ask for gender, race or ethnicity, veteran status and disability status. So the profile has a place to store answers to those four questions — and because they are more sensitive than anything else in it, they are treated differently:

• Every one of them defaults to “prefer not to say.” We never pre-select an answer on your behalf. If you leave that tab alone, there is nothing to store and nothing to fill.
• They are only ever filled into the equivalent voluntary question on a form — the same question the employer is already asking, and one you are always free to leave blank.
• They are never used for anything else. They are not part of your job security score, they play no role in any AI processing, they are not used for analytics or benchmarking, and they are never shared with anyone.
• You can clear them at any time from your account page, by setting each one back to “prefer not to say.”

If you would rather we did not hold this information at all, simply leave those four questions unanswered — every other part of autofill works exactly the same without them.

What the extension keeps on your own device

Four things, and nothing else. None of them ever leaves your browser except the sign-in token, which is sent back to us to prove the profile request is yours:

• A sign-in token for your account, so the extension can fetch your profile without asking you to log in again.
• A cached copy of our public form-layout list — the notes that tell the extension where the fields are on a given job site. It is the same file for every user and contains nothing about you.
• Where you dragged the button — which edge of the window you parked it on, and how far down.
• Which sites you have hidden it on, so it stays tucked away where you asked it to be.

Your profile itself is not saved to your device. It is fetched when a fill needs it and held in memory for up to a minute so that pressing the button twice does not mean waiting for the network twice.

What it does not do

The extension does not read the pages you visit. It looks at the form fields on a page to work out which of them it could fill, and that inspection happens entirely in your browser. Nothing about the pages you open, the jobs you look at, or the forms you fill is sent to us or to anyone else.

It contains no analytics and no tracking of any kind. There is no telemetry, no usage reporting, and no advertising or analytics code in the extension. It makes exactly three kinds of network request, all of them to us or to our own hosting: fetching your profile, fetching that public form-layout list, and renewing your sign-in token with Supabase, the database and authentication provider this site runs on. It loads no code from the internet at run time — everything it executes ships inside the extension and is reviewed by Google before you receive it.

What it is never used for

We do not sell this data, we do not use it for advertising, we do not build a profile of your browsing, and we do not transfer it to third parties. None of the AI processing described above touches it — your autofill profile is never sent to OpenAI or Anthropic.

Why it asks for each permission

• Storage: to keep your sign-in token and a cached list of known form layouts on your device.
• Active tab and scripting: so that pressing “Fill this page” can reach the form in front of you, on a page we do not otherwise run on.
• Named job sites: the extension runs automatically on a fixed list of applicant tracking systems (Greenhouse, Lever, Ashby, Keka and similar) so the fill button is there when you need it.
• Any other site, only if you ask: most companies run their own careers page. You can grant one of those individually, from the extension itself. Nothing is granted at install, and you can revoke any of it from your browser's extensions page at any time.

Disconnecting and deleting

“Disconnect” in the extension removes the sign-in token from your device immediately. Your autofill profile can be cleared from your account page, and removing the extension removes everything it held locally. Deleting your account deletes the profile with it.

5. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.