Privacy Policy

The extension is designed to collect as little as possible. It stores locally, on your device only:

• Your JobForge host URL and a personal access token (a jfx_… string you generate in JobForge Settings), kept in chrome.storage.local.
• UI preferences — the position of the floating button and recently typed job locations, used to offer suggestions.

The extension does not collect browsing history, does not track which pages you visit, does not read pages in the background, and does not run analytics, advertising, or fingerprinting code. Content is read from a page only at the moment you open the JobForge panel on a job posting, and data leaves your device only when you press Save to job board.

When you explicitly save a job, the extension reads the currently open job posting and sends only these fields to your own JobForge account:

• Job title
• Company name
• Job location (as shown on the page, or as you type it)
• The job posting URL
• The job description text of that posting

This is public content published by the employer or job board. We do not extract your personal profile, messages, connections, cookies, passwords, payment details, or any other page on the site. Nothing is captured until you click save.

Using the JobForge web app requires an account. We process:

• Email address and, if you sign in with Google, the basic profile information Google returns (name, email, avatar URL).
• Authentication credentials — passwords are never stored by us in readable form; they are hashed and managed by our authentication provider.
• Session tokens and extension access tokens (stored only as a one-way SHA-256 hash on our servers, plus a short non-sensitive prefix so you can identify a token).
• Content you create — saved jobs, base résumés you paste or upload, generated résumés and cover letters, notes, and AI tool outputs.
• Billing records — plan, subscription status, renewal dates and payment identifiers returned by the payment processor. We never see or store your full card number.
• Minimal operational logs — timestamps of generations and downloads, approximate country derived from the request (for currency selection), and error logs used to fix bugs and prevent abuse.

We do not use your data for advertising, profiling, or automated decisions with legal effects, and we do not build cross-site behavioural profiles.

Yes — but only when you trigger an AI action. When you tailor a résumé, generate a cover letter, request insights, run an ATS/fit score, or use an AI tool or document chat, the relevant content is sent over an encrypted connection to our third-party large-language-model provider (DeepSeek) for processing, and the result is returned to you.

What is sent: the job description and/or your résumé text plus your instruction for that action.

What is not sent: your email address, password, payment data, access tokens, or any identifier linking the request to you personally. Requests are made server-side with our own API credentials; the provider does not receive your account identity. We do not permit our data to be used to train third-party models and we do not send your data to any AI provider for any purpose other than fulfilling the action you requested.

We rely on a small set of processors, each bound by their own security and privacy terms:

• Supabase — database, authentication, and encrypted file storage for your résumés and generated documents.
• Lovable / Cloudflare — application hosting, serverless execution and content delivery.
• Google — optional Google Sign-In, if you choose it.
• DeepSeek — AI text generation, as described above.
• Razorpay (and, where applicable, other payment processors) — subscription payments. Card details are entered on the processor’s own hosted checkout and never reach our servers.

Analytics: the Chrome extension contains no analytics or tracking SDKs. The web app uses only basic, aggregated hosting-level request metrics for reliability and security; we do not run third-party advertising or cross-site tracking pixels.

• Jobs, résumés and generated documents are kept until you delete them or delete your account.
• Deleting a job, document or résumé removes it from our database and storage; backups are rotated out within 30 days.
• Extension tokens are removed immediately when you revoke them in Settings.
• Operational and error logs are kept for up to 90 days. Billing records are retained as long as required by tax and accounting law.
• Locally stored extension data is deleted when you remove the extension or clear its storage in Chrome.
• Account deletion: email support@jobforgex.com from your registered address and we will erase your account and associated content within 30 days.

• All traffic between the extension, your browser, our servers and our providers uses HTTPS/TLS.
• Data is encrypted at rest by our database and storage provider.
• Row-level security ensures each account can only read its own records; documents are served through short-lived signed links rather than public URLs.
• Extension tokens are stored only as irreversible hashes and can be revoked at any time.
• API keys and secrets are held server-side and are never shipped to the browser or the extension.

No system is perfectly secure, but we work to protect your data and will notify affected users of any breach that presents a material risk.

Depending on where you live (including under GDPR and similar laws), you may request access to, a copy of, correction of, or erasure of your personal data, object to or restrict certain processing, and withdraw consent at any time. Most of this is self-service inside the app; for anything else, contact us:

support@jobforgex.com

We respond to privacy requests within 30 days.

JobForge does not sell, rent, or trade your personal data or job-page content, and does not share it with data brokers, advertisers, or for any purpose unrelated to operating JobForge. Data is shared only with the processors listed in section 6, strictly to deliver the features you use, or where legally required.

JobForge is not intended for anyone under 16, and we do not knowingly collect their data.

If we make material changes we will update the effective date above and, where appropriate, notify you in the app or by email. Continued use after an update means you accept the revised policy.