Privacy Policy

Applytrac has one purpose: to detect job application fields and help you auto-fill and track job applications. We do not use the extension for advertising, analytics resale, price comparison, content injection, or any purpose unrelated to that.

Your saved profile — contact details, work history, education, the answers you reuse and the per-site corrections Applytrac learns — stays on your machine. The extension stores it in chrome.storage.local, which is sandboxed to the extension and unreadable by the websites you visit. It is not encrypted at rest, so anyone with access to your computer and your Chrome profile can read it. Two things are deliberately not local, because being local would break them: your Resumes, and the applications you actually submit. The table below is the complete list.

Resumes are the exception, and deliberately so: they are stored in your account, so the web app and every browser you sign in from use the same set instead of a per-browser copy that drifts. Deleting a Resume in the web app removes it everywhere, including the file.

Applytrac does not sell, rent, or trade your personal information or job application data to third parties. We do not share it for cross-context behavioural advertising, and we have no advertising business. We use a small number of processors strictly to run the product — Supabase (database and authentication), Stripe (payments), and Anthropic (AI drafting, see §5) — and they may only process data on our instructions.

The extension asks Chrome for access to all websites, and Chrome shows you that at install. It needs the breadth because job applications are not submitted in one place: they are on the big boards, on the applicant tracking systems behind them (Greenhouse, Lever, Workday, Ashby, iCIMS and others), on every company’s own careers domain, and inside the third-party frames those forms embed. That list cannot be written down in advance, and asking for permission mid-application is not something we are willing to put in your way.

What we do with that access is narrower than the permission itself:

• Nothing happens until you sign in. A signed-out install reads no page, fills nothing and sends nothing. Sign out and it stops on pages already open.
• Nothing happens in a frame that has no form. The extension checks for form fields first and does not load your profile into frames that have none.
• Filling is a click, not a default. Auto-fill on page load is off until you turn it on, and even then only on a recognised application form.
• We never inject content into pages and never read pages that are not job applications.

You can narrow the access yourself at any time: in chrome://extensions set Applytrac’s site access to On click or to specific sites. If you do, use “Enable Applytrac on this site” in the popup to grant a site when you need it.

Field detection itself uses no AI and no network: it runs on rules shipped inside the extension, plus a shared mapping cache described in §6. Nothing about the form leaves your browser in order to fill it.

Two features send personal content. Draft with AI runs only when you click the button next to a screening question, and sends that question along with your Resume text and the answers you have saved before, so an answer can be written for you to edit. Drafted text is surfaced for you to review and is never submitted for you.

The match score sends your Resume text and the job description shown on the page, and returns the percentage, the skills you cover and the ones the posting asks for that you do not. It runs when you open Applytrac on a job posting. If you would rather it did not run, close the popup on job pages, or sign out — signed out, the extension makes no requests at all.

These requests are processed transiently through our API endpoints to Anthropic’s API and are not used to train AI models. We keep the drafted answer only where you can see it — in your answer bank or the application record.

Application forms repeat. When Applytrac works out that a particular field on a particular applicant tracking system is “phone number”, that knowledge helps the next person who meets the same form. Two things follow from that, and they are deliberately separate:

• Reading the shared cache is on by default. When Applytrac meets a field it cannot place, it asks our server whether other users have already resolved the same one. The request carries the applicant tracking system’s name and a hashed fingerprint of the field layout — never your answers, never your Resume, never the page’s contents.
• Contributing back is off until you switch it on. Under Settings → Your data, “Help improve field detection” is off by default. When you turn it on, Applytrac shares the field mappings it worked out (a signature hash and the field type it turned out to be) and reports the redacted shape of fields it failed to recognise — tag names, labels and nearby text, with email addresses, URLs, Social Security / national ID numbers, payment card numbers, phone numbers, dates and street addresses stripped out, plus any exact value we know is in your stored profile. Turning it off again discards anything still queued locally, unsent.

Neither of these is stored against your account. The reports table has no user column at all — a valid session is required to send one, so the endpoint cannot be used as an open firehose, but the identity is discarded before anything is written. There are no screenshots and no session recording: the extension does not bundle rrweb and has no code path that captures a replay of a page.

If you are a California resident, the CCPA/CPRA gives you the right to know what we collect, to delete it, to correct it, and not to be discriminated against for asking. You do not need to be in California to use any of the controls below.

• Delete everything on your device: extension → Settings → Account → Delete my data → “Wipe this browser”.
• Delete your account and all cloud data: web app → Settings → Delete account. This permanently removes your pipeline, Resumes, answers, notes, usage history and your login. It cannot be undone.
• Export: any application can be downloaded as a Markdown profile from its detail panel.
• Correct or ask a question: email privacy@applytrac.com.

Pipeline data is kept until you delete it or close your account. Anonymous field-structure reports are retained in aggregate and are not tied to you. Local browser data lives until you wipe it or remove the extension.

Applytrac is not directed to children under 13 and we do not knowingly collect their data.

If we change how data is used, we will update this page and the date above, and any new data sharing will remain off until you opt in.