Privacy Policy

What we collect

• Account data: your email address and authentication state (via Clerk).
• Career profile: the resume you upload and the structured facts, experiences, education, projects, skills, and screening answers derived from it or that you add.
• Job descriptions: the text of a job posting you choose to capture. The browser extension reads supported application pages only after you open the signed-in side panel and accept its data-use disclosure. Other pages are read only after you click the relevant action. It never collects unrelated browsing history.
• Application form data: field labels and available options from the application form you are viewing. Values you type are sent to Jobsy only when you choose to remember them or finish an application.
• Generated documents: the tailored resumes we produce and the record of which application each was sent with.
• Role-copilot conversations: the questions you ask about a captured role, Jobsy's final answers, and the names and outcomes of the read-only tools used to ground each answer. Transient tool results are not retained in the conversation.
• Sensitive saved answers (optional): compensation and demographic/EEO answers you choose to remember are encrypted with AES-256-GCM before storage. Jobsy marks them confirm-first and never enters them automatically.
• Operational telemetry: counts about autofill sessions (fields filled, corrected, duration) and, if enabled, product-analytics events. Telemetry never contains field values - only hashed field signatures and outcome flags.
• Billing and access records: the pass or grandfathered plan, Lemon Squeezy order/customer identifiers, payment status, currency, totals, refund amount, access dates, and which saved jobs have been unlocked. Jobsy does not receive or store card numbers or payment credentials.

How we use it

To parse your resume, tailor it to a job, autofill application forms on your instruction, track your applications, and operate and improve the service. To generate a tailored resume we send the relevant profile facts and job-description text to our AI provider (OpenRouter, routing to the underlying model). When local form matching cannot identify a field, its label and options may also be sent through Jobsy to that provider to map the field. For the role copilot, we send your question, recent conversation, the captured role, and only the profile evidence selected by its read-only tools. We do not sell your data, and we do not use it for advertising.

Who we share it with

Service providers that run the product on our behalf: Clerk (authentication), Neon (database), Google Cloud (hosting), OpenRouter and the model providers it routes to (AI processing), Lemon Squeezy (billing), Sentry (error monitoring, when enabled), and PostHog (cookieless product analytics, when enabled). We disclose data if required by law. We never sell personal data or share it with recruiters or advertisers.

The browser extension

The extension shows a data-use disclosure before it reads a page or fetches your profile. It has standing page access only on the supported applicant-tracking systems listed in its manifest; access to another website is requested for that origin when you choose to use Jobsy there. It fills fields but never submits a form for you, never solves CAPTCHAs, and does not automate a job board’s own application flow.

For speed, the extension stores a per-account profile snapshot in extension-local storage and keeps the current application plan in browser-session storage. Signing out clears those working copies. Authentication is managed by Clerk; Jobsy’s extension code does not persist a separate session token in its own storage.

Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Your rights

You can export your Jobsy profile, saved content, application history, telemetry, usage, and billing records (Settings → Export), and permanently delete your account and associated documents (Settings → Delete account) at any time. A successful deletion is a hard delete that removes stored files. For access to authentication-provider records or any other privacy request, contact shaikharbaz077@gmail.com.

Retention & security

We keep your data while your account is active and delete it on request. We use TLS in transit, authorize every data request against the authenticated user ID, and encrypt the sensitive class of saved answers with AES-256-GCM before database storage.

Changes

We will update this page and, for material changes, notify you. Continued use after an update means you accept the revised policy.