Privacy policy

Last updated October 2, 2026. Covers the CareerFlow website and the CareerFlow Autofill browser extension.

What we collect

Account details: your name, email address and a hashed password, or your Google name, email and picture if you sign in with Google.
What you add to CareerFlow: resumes, profile details (such as work authorization, notice period, salary expectations and the achievements you list), saved jobs, applications, notes, contacts, interviews and cover letters.
Usage records: which AI features you used and how many tokens they consumed, so we can meter credits and keep costs in check.
Payments go through Stripe. We store your plan and credit balance, never your card details.

To run the features you ask for: matching you to jobs, analyzing and tailoring your resume, drafting cover letters and application answers, and tracking your applications.
We don't sell your data, use it for advertising, or share it with anyone except the processors listed below.

When you use an AI feature, the relevant text (for example your resume, the job description and your profile facts) is sent to DeepSeek's API to generate the result. If you add your own DeepSeek key, requests are made with your key. Your key is stored encrypted (AES-256-GCM).
AI output is checked against your own resume and profile so it doesn't invent experience, employers or numbers.

The extension only works when you start it: by clicking Apply with CareerFlow on a job, or Fill this page in its popup. It doesn't run in the background on the sites you visit and doesn't read your browsing history.
On the application page you start it on, it reads the form's questions, field labels and answer options, and the page's text when the job isn't already in CareerFlow. It sends these to CareerFlow to work out answers from your profile and resume.
It fills the form in your browser and attaches your resume, which it downloads from your CareerFlow account. Nothing is submitted until you press Submit in its review panel. When the application goes through, it records the job and the page address in your application tracker.
It stores two things in the browser's local extension storage: a connection token (revocable at any time from the Chrome Extension page in CareerFlow) and the list of tabs it opened for applications. It never sees your CareerFlow password.
It doesn't run on LinkedIn or Indeed.
The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Vercel (hosting), Neon (database), DeepSeek (AI), Stripe (payments, if you buy a plan or credits), Google (only if you choose Google sign-in) and Resend (password-reset emails).
Job listings come from public job boards and company career pages. We don't send your data to them. When you apply, you go to the employer's own site and their privacy policy applies there.

We use one sign-in session cookie and remember your theme. No advertising or tracking cookies.

You can edit or delete any resume, application or profile detail at any time.
Settings → Privacy lets you export your data or delete your account. Deleting your account removes your data from our database.
Disconnect the extension from the Chrome Extension page in CareerFlow, or uninstall it from your browser.

Questions or requests: use the contact details on the CareerFlow Chrome Web Store listing.
If this policy changes in a way that affects how your data is used, we'll update the date above and tell you in the app.