Privacy Policy

ApplyCandid browser extension and applycandid.com — Last updated: 29 September 2026

Short version: ApplyCandid (“we”) runs the AI server the extension connects to. Your resume and the job descriptions you apply to are sent to that server so it can score jobs and draft cover letters and answers; it uses Google’s Gemini API to do that. Plain facts such as your name, email and phone are typed into forms inside your browser and are not sent to us for that. We never sell your data, never use it for advertising, and you can delete your resume, drafts and email from the extension’s Settings, or ask us to delete your account.

1. Who is responsible

ApplyCandid, reachable at support@applycandid.com, operates the extension, the AI server it connects to by default, and this website. The extension can be pointed at a different, self-hosted server in Settings; in that case whoever runs that server receives the data described in Section 2 instead of us.

2. What we collect

Resume — the file you upload and the details parsed from it: name, email, phone, location, links, work history, education and skills. Stored in your browser, and on our server (encrypted) so drafts can be grounded in it.
Job and form content — the text of job listings and application pages the extension reads while you run it or click “Fill This Page”, including screening questions, and the label of any form field it cannot recognise.
Drafts — cover letters, answers, proposals and tailored resumes generated for you, cached on our server so the same job does not cost you another draft.
Account details (only if you create an account) — your email address and either a password or your Google account. With a password we store only an Argon2 hash of it, never the password. With “Sign in with Google” we request only the openid and email scopes and store your Google account ID and email address; we get no access to your Gmail, contacts or files.
Email address (optional, without an account) — if you enter one after a fill or in Settings.
Purchase status — if you buy Pro: a subscription ID, its status, the date the paid period ends, the buyer email the payment provider shares, and a one-way hash of your license key. We never receive or store card details.
Partner code redemptions (only if you redeem a code) — the code, the email you enter (encrypted, plus a one-way hash so one email can redeem a code only once), the date, and a one-way hash of the license key it created. Used to switch on Pro, enforce the code’s usage limit, and tell the partner who issued it how many times it was used; partners never see your email.
Usage counts — with “Help improve this tool” switched on (the default; switch it off in Settings at any time), the extension reports events such as “run started”, “run finished”, “fields filled” or “limit reached”, and job-match scores. They carry no user ID, job, company, URL or field content, and are stored only as anonymous daily totals.
Technical data — an access token that identifies your install to our server, daily counts of AI calls per install (to enforce plan limits), and a one-way hash of your IP address used only to rate-limit sign-ups and sign-ins. Our hosting provider also keeps standard request logs, which include IP address and browser type.

In the Chrome Web Store’s categories this covers personally identifiable information and location (from your resume), website content and web history (the job pages the extension reads while you use it), and user activity (the usage counts above). We do not collect health, financial or payment-card information, authentication credentials for LinkedIn, Naukri, Indeed or any career site, or your browsing outside the pages you ask the extension to work on.

3. How we use it

To provide the features you ask for: filling application forms, scoring how well a job matches your resume, drafting cover letters and answers, tailoring your resume, and keeping your application tracker.
To sign you in, apply your plan and its limits, and deliver and validate Pro.
To send email you would expect: confirming your address, password resets, a welcome note, one notice if you hit a free-tier limit, and warnings about a failed or ended payment. No newsletter or marketing sequence.
To keep the service working and secure: rate limiting, preventing abuse and investigating errors.
To improve the product, using only the anonymous daily totals described in Section 2.

We do not sell or rent your data, use it for advertising or personalised ads, use it to determine creditworthiness or for lending, or allow any person to read your resume or drafts except where you ask us for support, it is needed for security, or the law requires it.

4. Who we share it with

We share data only with the service providers below, only for the purpose listed, and only what that purpose needs:

Google Cloud (Cloud Run and Firestore, United States) — hosts our server and database. All data we store lives here.
Google Gemini API — receives your resume text and the job or question text to generate each score or draft. It is used under Google’s paid API terms, which do not allow Google to use this data to train its models.
Google Sign-In — only if you choose it, to confirm who you are.
Resend — delivers the emails listed in Section 3; it receives your email address and the message.
Dodo Payments — our merchant of record. It runs checkout and billing and holds your payment details under its own privacy policy; it sends us the purchase status listed in Section 2.
Google Analytics — used on applycandid.com only, never inside the extension (see Section 8).

We may also disclose data if required by law or to protect the rights and safety of our users, or pass it to a successor if ApplyCandid is sold or merged, in which case this policy continues to apply.

5. How we store and protect it

Everything sent between the extension, this website and our server travels over HTTPS.
Your resume, drafts and email address are encrypted before they are written to our database. Email addresses and license keys are also kept as one-way hashes so they can be looked up without being readable. Passwords are stored only as Argon2 hashes.
Your profile, settings and application history are kept in your browser’s own extension storage. The application history never leaves your device unless you export it.
Access to our server and database is limited to the ApplyCandid operator.
The extension never asks for, reads or stores your password for LinkedIn, Naukri, Indeed or any career site. It works inside tabs where you are already signed in.

6. When the extension reads web pages

The extension reads and fills pages only when you act: it reads LinkedIn, Naukri and Indeed job listings during a run you start with “Start Run”, and it reads the current page when you click “Fill This Page” on a company career site or freelance platform. It does not monitor or record your browsing in the background, and nothing it fills is submitted unless you submit it or turn on Auto-Submit yourself.

7. How long we keep it, and how to delete it

Resume, drafts and email address on our server — until you delete them, or automatically once the extension in that browser has not used our server for 12 months. “Delete my data on the AI server” in Settings erases everything held for that browser immediately and signs it out of your account.
Account — until you ask us to delete it at support@applycandid.com; we do so within 30 days.
Purchase records — as long as the law requires for tax and accounting.
Usage totals — deleted automatically after 30 days. Hashed-IP rate-limit counters — deleted automatically after 2 days. Password-reset and email-confirmation links expire after 1 and 48 hours.
Data in your browser — until you remove it (“Remove” on the Resume tab, “Clear All” on the Tracker tab) or uninstall the extension.

You can also ask us for a copy of your data, or to correct or delete it, by emailing support@applycandid.com. We reply within 30 days. Depending on where you live you may have further rights, such as to object to processing or to complain to a data-protection authority.

8. This website

applycandid.com uses Google Analytics 4 to count page views and see where visitors arrive from. It records the page, referrer, approximate location from a truncated IP address and device type, and stores an identifier in your browser to tell new visits from returning ones. The site also sends our own server anonymous events — which page and sections were viewed, how far you scrolled, how long the page was open, and which buttons were clicked — with no identifier attached, folded into daily totals. If you arrive from a campaign link, its utm_* tags are kept for that tab only and passed to checkout so a sale can be credited to the campaign. You can block all of this with your browser’s tracking protection or a content blocker, and the site works the same.

9. Chrome Web Store Limited Use

ApplyCandid’s use of information received from the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use this data only to provide and improve the extension’s single purpose — helping you fill in and write job applications — and do not transfer, use or sell it for any other purpose.

10. Children, changes and contact

ApplyCandid is not directed at children under 16, and we do not knowingly collect their data. If we change this policy we will update the date above, and tell you in the extension before a change that affects data you have already given us. Questions or requests: support@applycandid.com.