Privacy Policy

Applytrac has one purpose: to detect job application fields and help you auto-fill and track job applications. We do not use the extension for advertising, analytics resale, price comparison, content injection, or any purpose unrelated to that.

Your saved profile — contact details, work authorisation answers, work history, education and the answers you reuse — is stored in your Applytrac account. That is what lets you edit it on this site and sign in from a second computer without retyping it, and it is why deleting your account deletes it everywhere at once. The extension keeps a copy in chrome.storage.local as a cache, so a form can be filled instantly and offline; that store is sandboxed to the extension and unreadable by the websites you visit, but it is not encrypted at rest, so anyone with access to your computer and your Chrome profile can read it.

Your profile fills in as you apply. Rather than asking you to answer fifty questions before you can start, Applytrac saves an answer to your profile the first time a job form asks for something it recognises and you have no answer stored — your notice period, say, or whether you need sponsorship. It only ever fills a blank: an answer you already have is never changed by a later form, and correcting a field on a site is remembered for that site alone. Voluntary self-identification answers are excluded and only ever saved through the separate opt-in below, and free-text written for one job — a cover letter, a summary — is never taken as a default. You can see and edit everything it has learned on the Autofill profile page, at any time.

The per-site corrections Applytrac learns are the exception in the other direction: they describe how this browser has seen a particular site behave, they are never uploaded, and they are cleared by Wipe this browser. The table below is the complete list.

Applytrac does not sell, rent, or trade your personal information or job application data to third parties. We do not share it for cross-context behavioural advertising, and we have no advertising business. We use a small number of processors strictly to run the product — Supabase (database and authentication), Stripe (payments), and Anthropic (AI drafting, see §5) — and they may only process data on our instructions.

The extension asks Chrome for access to all websites, and Chrome shows you that at install. It needs the breadth because job applications are not submitted in one place: they are on the big boards, on the applicant tracking systems behind them (Greenhouse, Lever, Workday, Ashby, iCIMS and others), on every company’s own careers domain, and inside the third-party frames those forms embed. That list cannot be written down in advance, and asking for permission mid-application is not something we are willing to put in your way.

What we do with that access is narrower than the permission itself:

• Nothing happens until you sign in. A signed-out install reads no page, fills nothing and sends nothing. Sign out and it stops on pages already open.
• Nothing happens in a frame that has no form. The extension checks for form fields first and does not load your profile into frames that have none.
• Filling is a click, not a default. Auto-fill on page load is off until you turn it on, and even then only on a recognised application form.
• We never inject content into pages and never read pages that are not job applications.

You can narrow the access yourself at any time: in chrome://extensions set Applytrac’s site access to On click or to specific sites. If you do, use “Enable Applytrac on this site” in the popup to grant a site when you need it.

Field detection itself uses no AI and no network: it runs on rules shipped inside the extension, plus a shared mapping cache described in §6. Nothing about the form leaves your browser in order to fill it.

Two features send personal content. Draft with AI runs only when you click the button next to a screening question, and sends that question along with your Resume text and the answers you have saved before, so an answer can be written for you to edit. Drafted text is surfaced for you to review and is never submitted for you.

The match score sends your Resume text and the job description shown on the page, and returns the percentage, the skills you cover and the ones the posting asks for that you do not. It runs when you open Applytrac on a job posting. If you would rather it did not run, close the popup on job pages, or sign out — signed out, the extension makes no requests at all.

These requests are processed transiently through our API endpoints to Anthropic’s API and are not used to train AI models. We keep the drafted answer only where you can see it — in your answer bank or the application record.

Application forms repeat. When Applytrac works out that a particular field on a particular applicant tracking system is “phone number”, that knowledge helps the next person who meets the same form. Two things follow from that, and they are deliberately separate:

• Reading the shared cache is on by default. When Applytrac meets a field it cannot place, it asks our server whether other users have already resolved the same one. The request carries the applicant tracking system’s name and a hashed fingerprint of the field layout — never your answers, never your Resume, never the page’s contents.
• Contributing back is off until you switch it on. Under Settings → Your data, “Help improve field detection” is off by default. When you turn it on, Applytrac shares the field mappings it worked out (a signature hash and the field type it turned out to be) and reports the redacted shape of fields it failed to recognise — tag names, labels and nearby text, with email addresses, URLs, Social Security / national ID numbers, payment card numbers, phone numbers, dates and street addresses stripped out, plus any exact value we know is in your stored profile. Turning it off again discards anything still queued locally, unsent.

Neither of these is stored against your account. The reports table has no user column at all — a valid session is required to send one, so the endpoint cannot be used as an open firehose, but the identity is discarded before anything is written. There are no screenshots and no session recording: the extension does not bundle rrweb and has no code path that captures a replay of a page.

If you are a California resident, the CCPA/CPRA gives you the right to know what we collect, to delete it, to correct it, and not to be discriminated against for asking. You do not need to be in California to use any of the controls below.

• Delete everything on your device: extension → Settings → Account → Delete my data → “Wipe this browser”.
• Delete your account and all cloud data: web app → Settings → Delete account. This permanently removes your pipeline, Resumes, answers, notes, usage history and your login. It cannot be undone.
• Export: any application can be downloaded as a Markdown profile from its detail panel.
• Correct or ask a question: email privacy@applytrac.com.

Pipeline data is kept until you delete it or close your account. Anonymous field-structure reports are retained in aggregate and are not tied to you. Local browser data lives until you wipe it or remove the extension.

Applytrac is not directed to children under 13 and we do not knowingly collect their data.

If we change how data is used, we will update this page and the date above, and any new data sharing will remain off until you opt in.