Privacy
Privacy policy
Last updated . This is the privacy policy for the JobFit AI Chrome extension, the JobFit API, and this website. Use this URL in the Chrome Web Store privacy-policy field.
The short version
- Your CV, settings, and application tracker stay in this browser.
- When you ask for a tailored CV, a cover letter, or an AI-assisted match, the open job posting and the CV you selected are sent to the JobFit API, then to the language-model provider, only to produce that result.
- The on-device keyword score does not leave the browser.
- We do not sell personal data. We do not use it for advertising. We do not use it to judge credit.
- Lemon Squeezy takes payment. The extension stores a license key, not your card number.
Who we are
JobFit AI is the product name. The controller for personal data the extension and the API process is the publisher named on the Chrome Web Store listing. For access, correction, or deletion, email privacy@jobfit.ai.
Data that stays on your device
Unless you ask for a networked feature, this data is not uploaded:
- CV profiles you type: name, email, optional phone and location text, summary, experience (title, company, dates, bullets), education, skills, languages, and links.
- Tracker entries you save: the extracted job, a status (saved, applied, interview, offer, or rejected), notes, and dates.
- Settings, such as preferred tone, language, and the API base URL.
- The license key and cached plan, after you activate Pro.
Profiles, settings, and the license cache use chrome.storage.local. Tracker
entries use IndexedDB in the extension's origin. Chrome does not encrypt extension storage
beyond the protections of your operating-system account. Uninstalling the extension removes
this local data.
Data sent when you ask for it
These calls go to the JobFit API over HTTPS. Provider API keys stay on the server. They are never shipped inside the extension.
- Tailored CV. The job posting and the selected CV profile. The response is a revised profile that is supposed to rewrite bullets you already had, plus short notes.
- Cover letter. The job posting, the selected CV profile, a tone (formal, confident, friendly, or concise), and a language (English, Italian, Turkish, Spanish, German, or French).
- AI-assisted match. The job posting and the selected CV profile, when you run that request. The ordinary keyword score runs locally and is not this request.
- License check. The license key. The response can include whether it is valid, the plan, an optional email, and an optional expiry time.
- Usage. The API reports the plan, how many generations were used, the monthly limit (5 on Free, unlimited on Pro), and the current period.
A job posting includes its source, URL, title, company, location line, description, requirements, and the time it was extracted. The URL is the address of that posting, not a history of other pages.
Autofill, when you use it, writes values from the saved profile into matching application fields. It does not upload the form you are filling.
Payments
Pro is sold by Lemon Squeezy as merchant of record, at €7.99 a month or €59 a year before the tax they calculate. You enter payment details on Lemon Squeezy's checkout, not in the extension. We receive subscription status and the license key. We do not receive your full card number.
This website
jobfit.ai is a static site. It does not set analytics cookies, advertising cookies, or an account. The server that hosts it can log ordinary request data such as IP address and user agent for security. The install and checkout buttons are links. Checkout placeholders are not live products.
Limited Use
JobFit AI's use of user data complies with the Chrome Web Store Limited Use policy.
In plain language:
- We use data from the extension only to provide and secure its single purpose: help you apply to the job posting you have open, by extracting that posting, scoring it against your CV, drafting a tailored CV or cover letter you asked for, tracking applications you save, checking a license, and enforcing the free-plan generation limit.
- We do not sell personal data. We do not transfer it to advertisers, data brokers, or other information resellers. We do not use it for personalized advertising or retargeting.
- We do not use it to determine credit-worthiness or for lending.
- We transfer it only to the processors named on this page, to comply with law, to protect the service against abuse, or as part of a merger or sale of assets after notice.
- Humans do not read your CV, job postings, or drafts unless you ask for support and agree to that review, we must investigate abuse or a security incident, the law requires it, or the data is aggregated and no longer identifies you.
Permissions
The extension asks for the permissions below. Host access is broad because job boards and company career sites do not share one domain. The content script looks for a job posting. When the page is not one, it stores nothing and sends nothing.
| Permission | Why it is there |
|---|---|
storage |
Saves CV profiles, settings, and license state in chrome.storage.local on the device. The tracker uses IndexedDB and does not need a separate permission. |
sidePanel |
Opens the product UI in Chrome's side panel so the job posting stays visible beside the match, the draft, and the tracker. |
activeTab |
Lets the extension act on the tab where you opened it, so it can work with the posting in that tab. |
https://*/* |
The content script runs on https pages so it can read a posting on LinkedIn, Indeed, Glassdoor, Greenhouse, Lever, Workday tenants, InfoJobs, and other career sites. Workday and company boards use a different host per employer, so a short allowlist would miss them. The script extracts title, company, location, description, requirements, source, and URL when it recognizes a posting. It does not build a browsing history. |
http://localhost/* |
Lets the same extractor run on local pages during development and review. It does not reach other computers. A store build can drop this host if review requires it. |
The extension does not execute remote code. Pages and the API return text, not JavaScript for the extension to run.
Who receives data
| Party | What they receive | Why |
|---|---|---|
| Cloudflare | Requests to this website and to the API, plus database rows for licenses and usage. | Hosts the site (Pages), the API (Workers), and the database (D1). |
| Language-model provider | The job posting and CV profile in a generation or AI-match request you started. The default provider is xAI (Grok). The operator can switch the server to an OpenAI-compatible provider. The key stays on the server. | Writes the draft or the match you asked for. |
| Lemon Squeezy | The details you submit on their checkout, and subscription status they report back. | Merchant of record for Pro: payment, tax, invoices, and refunds. |
Their own privacy terms apply to what you type on their sites. Lemon Squeezy: lemonsqueezy.com/privacy.
Why we are allowed to process it
- Contract. Providing the features you use: extraction, scoring, drafts, the tracker, and a paid plan you bought.
- Legitimate interests. Keeping the service secure, preventing abuse, and counting the free monthly allowance. You can object where the law gives you that right.
- Legal obligation. Tax and accounting records that Lemon Squeezy keeps as merchant of record.
We do not rely on a cookie banner because this site does not use non-essential cookies. The extension's disclosure before the first upload of a CV is part of the product UI, not only this page.
How long it is kept
- On your device: until you delete it or uninstall the extension.
- License and usage rows: while the plan is active, and then for up to 24 months to resolve billing disputes and abuse, unless a longer period is required by law.
- A generation request is sent to produce a response. We do not build a marketing archive of your CV from it. If a request is logged to investigate abuse, it is kept only as long as that investigation needs and then deleted.
- The model provider's retention of API inputs follows that provider's API terms. We send a request only when you run a generation or an AI-assisted match.
- Payment records stay with Lemon Squeezy under their retention rules.
Where it is processed
Cloudflare, the model provider, and Lemon Squeezy may process data in the United States and other countries. Where the law requires a transfer tool, the transfer uses that provider's Standard Contractual Clauses or an adequacy decision. Email privacy@jobfit.ai if you want a description of the safeguards.
Your rights
Depending on where you live, you can ask us to:
- confirm whether we hold data about you, and for a copy of it;
- correct it;
- delete it;
- restrict or object to processing based on legitimate interests;
- receive data you provided in a portable form;
- complain to a supervisory authority. If you are in the EU or EEA, that is the authority in your country of residence. Nothing on this page removes that right.
Email privacy@jobfit.ai. We will answer within 30
days. To delete data that never left the browser, remove JobFit AI from
chrome://extensions. To delete license and usage rows we hold, use the same
email address. Lemon Squeezy handles deletion of payment records they control.
Children
JobFit AI is not for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has sent us a CV, email privacy@jobfit.ai and we will delete it.
Automated scoring
The match score is a hint for you while you edit. It does not decide whether an employer interviews you, and we do not send scores to employers. You choose what to put in an application.
Security
The API is served over HTTPS. Model keys are worker secrets, not extension settings. No method of transmission or storage is perfectly secure. Use a device account you trust, because extension storage is readable by someone who can use that account.
Changes
If this policy changes, we will update the date at the top. A material change to what the extension collects will also be disclosed in the product before that collection starts.
Contact
Privacy questions and requests: privacy@jobfit.ai. The same address is the support contact for the Chrome Web Store listing until a separate mailbox is published here.