Last updated: 2026
We collect information you provide directly, including your name, email, and resume data. We also collect job descriptions you submit for tailoring.
Your resume and job descriptions are sent to OpenAI's API for AI-powered tailoring. We do not store your data on OpenAI's servers beyond what is necessary to process your request. Your tailoring sessions are stored in our Supabase database for your history and future reference.
Your data is stored securely in Supabase with Row Level Security policies ensuring only you can access your own data. Payment information is processed by Stripe and is not stored on our servers.
You can delete your account and all associated data at any time from the Settings page. Upon deletion, your profile, resume, and tailoring history will be permanently removed.
We use the following third-party services: Supabase (database & authentication), OpenRouter (AI model routing), and Stripe (payment processing). Each has their own privacy policy governing data they process.
The ApplyAgent Auto-Fill Chrome extension ("the extension") runs in your real browser to fill out job application forms on your behalf. This section describes how the extension accesses and processes data.
chrome.storage.local (encrypted at rest by Chrome) and sent as a Bearer token to the ApplyAgent API for authentication. Login passwords for ApplyAgent are never stored by the extension beyond the session token. An optional job-site account password may be saved separately if you enable that feature (see below).The extension never reads, captures, or transmits the following highly sensitive fields: Social Security numbers, date of birth, and payment or credit card information. These fields are automatically detected and always skipped regardless of user settings.
Protected-class / EEOC demographic fields (gender, ethnicity, race, disability, veteran status, sexual orientation) are treated as sensitive by default and are skipped. However, you may explicitly opt in to auto-filling these fields by enabling the "Auto-fill sensitive fields" toggle in the extension popup. When opted in, these fields will be filled based on your candidate profile data if available. When not opted in (the default), they are skipped and flagged for your manual review.
Preference fields (salary expectations, compensation, pronouns, work authorization, sponsorship, relocation, remote work, notice period, travel willingness) are only filled if you have explicitly saved an answer in the extension popup or dashboard. If no saved answer exists, they are skipped and flagged for your input.
If you choose to save an account password in the extension (used to auto-fill password fields when creating accounts on job application sites), it is encrypted at rest using AES-GCM via the Web Crypto API before being stored in chrome.storage.local. The plaintext password is never written to disk. The password is only decrypted in memory when needed for autofill, and is only auto-filled on pages hosted on known Applicant Tracking System (ATS) domains (e.g., Workday, Greenhouse, Lever, iCIMS, Taleo, and other verified platforms). Password autofill is blocked on non-ATS domains to prevent credential exposure on unverified sites.
Before every form submission, the extension captures a screenshot of the current page using chrome.tabs.captureVisibleTab. This screenshot is sent to the ApplyAgent API and stored with your session record as an audit trail. The screenshot captures only what is visible in the browser tab at the time of submission.
Form field descriptors and page context are sent over HTTPS to the ApplyAgent API (/api/extension/analyze-form) for AI-powered field matching. The AI receives field labels, types, options, and your resume data — not full page content. Your resume data and saved answers are retrieved from the ApplyAgent API (/api/extension/profile) and matched to form fields server-side.
Auto-apply session records (filled fields, skipped fields, steps) are stored in your ApplyAgent account for your history. The extension does not store form data locally beyond the current session. You can delete your session history by deleting your account from the Settings page.
host_permissions (all URLs): Required because job applications exist on any career site. The extension needs to read and fill forms on arbitrary domains where job applications are hosted.activeTab: Used to access the current tab when the user clicks "Start Auto-Fill".scripting: Used to inject content scripts that detect and fill form fields on the current page.tabs: Used to track which tab the agent is running on and re-inject scripts after page navigation in multi-step forms.storage: Used to store the authentication token, user preferences, and an encrypted account password locally.sidePanel: Used to display the live feed of agent actions in a browser side panel.identity: Used to authenticate users with the ApplyAgent backend via Supabase. No Google account data is accessed — the permission is used solely for the extension's own auth flow.We do not sell, rent, or share your data with third parties for advertising or commercial purposes. Your form data and resume are used solely to provide the auto-fill functionality.
If you have questions about this privacy policy, please contact us at support@applyagent.app.