Privacy Policy
Last updated: November 7, 2026. Written to be read — if anything is unclear, email us and we'll explain.
This policy explains what the Applyd web app and the Applyd Chrome extension (together, “Applyd”, “we”) collect, why, who processes it, how long we keep it and the choices you have. Applyd exists for one purpose: helping you prepare and fill in job applications. We do not sell your data, we don't use ad trackers, and we don't use your data for advertising.
What we collect
- Account data: your email address and, if you use Google sign-in, your name.
- Resume and profile: the resume file you upload and the profile built from it (contact details, work history, education, skills, projects, certifications), your preferences, and your “common answers” such as work authorization, notice period and desired salary.
- Optional self-identification answers (gender, pronouns, race/ethnicity, veteran, disability status, sexual orientation): stored only if you give explicit consent in your profile. Without consent we store nothing and always answer “Prefer not to say”. You can withdraw consent at any time, which immediately resets these answers.
- Job postings you act on: the URL, title, company and description of jobs you analyse, tailor for, autofill or save.
- Your work in Applyd: tailored resumes and cover letters, your application tracker (statuses, notes, contacts, interview dates, offer details you enter), saved answers to custom questions, interview prep and outreach drafts, and share cards you create.
- Usage and billing: counts of tailoring and other actions (to enforce plan limits and measure AI cost), and subscription status from Stripe. We never see or store your full card number.
- Product analytics (first-party): events such as “resume uploaded” or “autofill run” with non-personal details (for example the job site and how many fields were filled — never the values). If you allow analytics, a random device identifier links events from the same browser; if you decline, events are counted without it.
- Diagnostics: error reports (message, page, app version) so we can fix bugs, and feedback you send us (e.g. “report a problem” or the uninstall survey).
- Referral and campaign attribution: the referral code you arrived with and first-visit campaign details (UTM parameters, referring site), stored with your account.
What the Chrome extension accesses
- The extension reads a web page only when you open the Applyd side panel on it and ask it to (for example “Analyze”, “Autofill” or the right-click “Use as job description”). It does not collect your browsing history.
- On application forms it reads field labels and options so it can fill them, and writes values into those fields. It never clicks submit.
- Access to a site is granted by you, per site, through Chrome's permission prompt and can be revoked at any time in Chrome's extension settings.
- The extension stores its own sign-in session locally in Chrome. “Disconnect” in the side panel removes it.
Chrome Web Store Limited Use: Applyd's use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use that data only to provide and improve Applyd's single purpose — helping you apply to jobs — and never transfer it for advertising, credit-worthiness or any unrelated purpose, and never allow humans to read it except with your consent, for security, or as required by law.
How we use your data
- To build your profile, score your match against a job, tailor documents, draft answers and fill in application forms.
- To run your tracker, enforce plan limits and referral bonuses, process subscriptions and prevent abuse.
- To keep Applyd reliable and secure (error monitoring, rate limiting) and to improve it (aggregate analytics).
- To respond to support requests and feedback.
Legal bases (EU/UK): performance of our contract with you; your explicit consent for self-identification answers and for analytics identifiers; and our legitimate interests in security and improving the service.
Service providers (subprocessors)
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Authentication, database, private file storage | All account and application data |
| Anthropic | AI processing (extraction, tailoring, matching, drafting) | Profile, job descriptions, form field labels — not used to train models |
| Stripe | Payments and subscriptions | Email, billing details, subscription status |
| Vercel | Application hosting | Request data and server logs |
Each provider processes data under contract and only on our instructions. We do not use any other third-party analytics, advertising or tracking services.
Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
| Supabase auth cookies (sb-…) | Keep you signed in (essential) | Session / until sign-out |
| applyd_ref | Remembers a referral link so both of you get the bonus (essential to the referral feature) | 30 days or until sign-up |
| applyd_attribution | First-visit campaign/referrer, attached to your account at sign-up | 30 days or until sign-up |
| applyd_analytics_consent (local storage) | Remembers your analytics choice | Until cleared |
| applyd_anon_id (local storage) | Random analytics identifier — only if you click “Allow” | Until cleared or consent withdrawn |
Retention
- Account, profile, documents and tracker data: while your account is active; deleted when you delete your account.
- Product analytics events: 400 days, then deleted. On account deletion they are de-identified.
- Error reports: 90 days. Autofill quality telemetry: 180 days.
- Billing records: as long as required for tax and accounting.
Your choices and rights
- Export: download everything we hold about you from Settings → Export my data.
- Delete: delete your account from Settings → Delete account. This cancels your subscription, deletes your files and removes your account data. It can't be undone.
- Correct: edit your profile at any time.
- Withdraw consent: turn off self-identification storage in your profile, or change your analytics choice by clearing site data.
Depending on where you live you may have further rights (for example to object to processing or to complain to a data-protection authority). Contact us and we'll respond within 30 days.
Security
Data is encrypted in transit and at rest, database rows and files are isolated per user, and AI and payment keys never leave our servers. More detail on our Security page.
Children
Applyd is not intended for anyone under 16.
Changes
If we make material changes we'll update this page and notify you by email or in the app before they take effect.
Contact
Questions or requests: support@applyd.app.