Privacy policy
Effective date: 23 October 2026 · Version: 1.0
ApplyKeep ("ApplyKeep", "we") is a Chrome extension that helps you apply for jobs: it compares a job posting with your profile, suggests how to word your CV's bullets for it, drafts cover letters, prints your CV in European formats and keeps track of your applications. This policy explains what happens to your data. In short:
- Your CV, profile, applications and CV photo stay on your computer, in Chrome's storage for the extension.
- Data leaves your computer only when you press an AI button. It goes to our server in the EU, which passes it to the Claude API (Anthropic) and sends back the answer. We don't store it.
- Our database holds only your account: email address, plan and usage counters (and, once Pro is on sale, the purchase records the payment provider sends us, never card details).
- "Delete all my data" in Settings deletes your account and everything on your computer. Only this month's usage counts stay, under a scrambled form of your address, until the month ends (section 4).
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
Suheyl Baghban, a private individual in Latvia
Email for privacy requests: privacy@applykeep.com
Please write to this address for anything about your data: it reaches the controller directly.
2. Data that stays on your computer
The extension keeps the following in Chrome's local storage for the extension
(chrome.storage.local) on your computer. It is not synced to your Google account, and we
can't see it:
| Data | Where it comes from |
|---|---|
| Your CV text | Extracted from your PDF on your computer (the file itself isn't kept) |
| Your profile | Name, headline, location, skills, languages, experience, projects, education |
| Personal details and CV photo | Optional details you add in the Profile tab: first and last name, email, phone, address (street, postal code, city, country), LinkedIn, portfolio and other links, date and place of birth, nationality; and a photo for the CV, reduced to at most 100 KB |
| The current job posting and its results | The posting you read, the last fit analysis, cover letter and CV improvement suggestions |
| Your application tracker | Saved postings, status, notes, applied and follow-up dates |
| Settings | Letter language, tone, chosen CV format |
| Worked out on your computer | The language of your CV (a language code), details found in your CV and not yet saved (email, phone, LinkedIn, website; with the CV import also name, city and country), your profile completeness score, whether you hid the Get started list |
| Sign-in session | Tokens that keep you signed in |
Web pages are read only when you press a button ("Read this job page", "Use selected text"), and
only the page you are on. If you click "Always allow on
The personal details and the photo are never sent to us or to the AI. They are used to print your CV on your computer and, when you press "Fill this form" in the Apply tab, to fill in the application form on the page you have open. The extension never submits a form: what you send to an employer, you send yourself, under that employer's privacy policy. The contact details found in your CV, the profile completeness score and the CV's language are worked out on your computer, without AI. Re-encoding the photo removes data stored in the image file, such as where it was taken.
You can delete this data at any time: individual entries in the extension, everything with "Delete all my data" in Settings, or by removing the extension (Chrome then deletes its storage).
3. Data sent to our server and the AI
Data leaves your computer only when you press one of these buttons, and only what the button needs:
| Button | What is sent |
|---|---|
| Analyze fit | Your profile (name, headline, location, skills, languages, experience, projects, education; not your CV text) and the posting (title, company, location, language, employment type and text; not the page address) |
| Write cover letter | The same, plus the letter language, tone and length you chose |
| Improve my CV for this job | The same as for Analyze fit. Only your experience bullets (with job title, company and dates) and the posting are passed to the AI; our server uses the rest of the profile only to check the suggestions |
| Fill in the details from my CV | Your CV text, with email addresses and phone numbers removed on your computer first, and the CV's language as detected on your computer (a language code). The answer includes your first and last name, city and country as the CV states them; they are only offered to you and kept on your computer |
How it is processed. Our server (Supabase Edge Functions, see section 6) checks that you are signed in and within your allowance, builds the instructions for the AI, sends them with your data to the Claude API of Anthropic, checks the answer and returns it to the extension. The data and the answer are not stored on our server and not written to our logs.
At Anthropic. Anthropic processes the data to produce the answer, as our processor under its Commercial Terms and Data Processing Addendum. It doesn't use the data to train its models and deletes it within 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law.
Please don't include sensitive information in your CV or profile that you don't want an AI to process, such as health details, religion or political opinions. If you send such information anyway, it is processed only to give you the answer you asked for, and not kept.
The answers are generated by AI. Fit analyses, letters and CV improvements are suggestions for you to review; they are not decisions about you. A CV improvement changes your profile only when you accept it and save. We make no automated decisions about you (Art. 22 GDPR).
4. Your account
To use the AI you sign in with Google or with your email address. With Google, Chrome opens Google's own sign-in window and Google tells our sign-in service your name, profile photo address, email address and Google account id (nothing else: no contacts, files or calendar). We keep only the email address and the account id: the name and photo are removed as soon as the sign-in service stores them. With your email address, we email you a 6-digit code that expires after 10 minutes. There is no password either way. When an account is created, by either way, our database checks the address's domain against a public list of disposable (temporary) email services, and refuses such an address; it also refuses a Gmail address that is only another spelling of an existing account's (other dots, a "+" tag). The same checks apply when you change your address. Nothing about the checks is stored.
| Data kept on our server | Why |
|---|---|
| Email address, account id, sign-up date, plan | Your account and sign-in |
| Usage counters per month (analyses, letters, CV imports, CV improvements) | Your free monthly allowance |
| Your number of AI requests in the current short time window, and today | Rate limit and daily fair-use limit against abuse |
| Once Pro is on sale: Stripe customer, subscription or payment ids, status | Giving you the Pro you paid for |
| Once Pro is on sale: ids and types of the payment events Stripe sent us | Applying each payment event only once |
| Number of free AI requests per day, of all users together | A daily cap on free requests (contains no personal data) |
| If you press "Notify me when Pro is available": when you asked | To email you once, at your account's address, when Pro is available |
When you delete your account, this month's usage counters are kept until the end of the month, so that deleting the account and signing up again doesn't restart the free allowance. They are stored under a salted hash of your email address (a one-way scrambled value, not the address itself, and not linked to an account), and a new account with the same address this month starts from them. They are deleted automatically once the month is over.
The sign-in service (Supabase Auth) keeps your sessions while you are signed in: for each one, when it started and was last refreshed, the browser's user agent and the IP address, and a refresh token. A session ends when you sign out, when it expires, or when you delete your account. It also keeps when you last signed in.
Our own server code logs one line per request with technical details only: which function ran, the result status, how long it took, an error code, the AI model and the number of tokens. These lines contain no texts, user ids or email addresses. Our hosting platform (Supabase) also logs every request to our server and the sign-in service, as any web service does: the time, the address requested, your account id (from the sign-in token), the IP address, the approximate location it derives from it (country, region), and the browser's user agent. We use these logs only to keep the service running and to find abuse; Supabase deletes them after a few days (1 to 7, depending on our Supabase plan).
5. Our website, feedback and support
- When you install the extension, it opens our welcome page (
applykeep.com/welcome) once. - When you remove it, Chrome opens
applykeep.com/uninstallwith the extension's version number in the address (for example?v=1.2.0), nothing else: no account id, no email address, nothing from your profile. - On the uninstall page you can tell us, if you want to, why you removed the extension: a reason from a list and an optional comment. It is stored without your name, email address or IP address, and without any link to an account. Please don't write personal details in the comment. Answers are deleted after 24 months.
- Feedback and support emails. If you write to support@applykeep.com (for example with "Send feedback" during the beta), we receive your email address and what you write, and use them only to read and answer your message and to improve ApplyKeep. Please don't send your CV or other documents. We delete these emails within 24 months, or sooner if you ask.
- The website uses no cookies for tracking and no analytics. Like any website, its hosting provider (Vercel) receives technical request data, such as IP addresses, to deliver the pages, and keeps it in its logs for a short time.
6. Who receives data
| Recipient | Role and location |
|---|---|
| Supabase, Inc. | Hosts our server, database and sign-in, as our processor. Data is stored in the EU (Frankfurt, Germany); access from outside the EU is covered by Supabase's Data Processing Addendum with the EU Standard Contractual Clauses. |
| Anthropic, PBC (Claude API) | Generates the AI answers, as our processor, in the USA, under its Data Processing Addendum with the EU Standard Contractual Clauses. |
| Vercel Inc. | Hosts the website (section 5), as our processor, on servers worldwide, under its Data Processing Addendum with the EU Standard Contractual Clauses. |
| Resend (Plus Five Five, Inc.) | Sends the sign-in emails (your email address and the code), as our processor, in the USA, under its Data Processing Addendum with the EU Standard Contractual Clauses. |
| Google (if you choose it) | Confirms who you are when you press "Continue with Google", as a separate controller; Google's own privacy policy applies. |
Pro isn't on sale yet. Before it is, we will add the payment provider (Stripe, which will sell Pro as the merchant of record) to this policy.
We don't sell your data, don't use it for advertising, and don't share it with anyone else unless the law requires it. The extension contains no analytics or tracking.
ApplyKeep's use of information it receives through Chrome complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: data is used only to provide the extension's features described here (Limited Use requirements).
7. Legal bases
- Your account, sign-in and the AI features you request: performance of a contract (Art. 6(1)(b) GDPR).
- Usage counters (also the ones kept after deleting an account until the month ends), rate limits, the daily cap and technical logs: our legitimate interest in a secure service that is fairly shared and protected against abuse (Art. 6(1)(f) GDPR).
- The uninstall survey: your consent, by choosing to answer (Art. 6(1)(a) GDPR); the answers aren't linked to you.
- Feedback and support emails: our legitimate interest in answering you and improving the service (Art. 6(1)(f) GDPR).
- The email when Pro is available: your consent, by pressing "Notify me when Pro is available" (Art. 6(1)(a) GDPR). You withdraw it with "Undo" in the same place, or by deleting your account.
8. How long data is kept
| Data | Kept |
|---|---|
| Data on your computer | Until you delete it, use "Delete all my data", or remove the extension |
| Texts sent to the AI | Not stored on our server. At Anthropic: deleted within 30 days (section 3) |
| Account, usage counters, rate-limit entry | Until you delete your account ("Delete all my data" while signed in) |
| Usage counts after deleting your account | Until the end of that month (as a salted hash of the address, see section 4) |
| "Notify me when Pro is available" | Until we have sent that one email, until you press "Undo", or until you delete your account |
| Sign-in codes | They expire after 10 minutes |
| Sessions of the sign-in service | Until you sign out, the session expires, or you delete your account |
| Technical logs (ours and Supabase's) | A few days (1 to 7, depending on our Supabase plan) |
| Uninstall survey answers | 24 months; they aren't linked to anyone, so they can't be looked up for a single person |
| Feedback and support emails | Until the matter is closed, at most 24 months |
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format (Articles 15 to 21 GDPR). Where processing is based on consent, you can withdraw it at any time.
Most of it you can do yourself: everything on your computer is in the extension, and "Delete all my data" deletes your account on our server. For anything else, write to privacy@applykeep.com. We answer within one month.
You can also lodge a complaint with a data protection authority: the one in the country where you live or work, or ours. As we are established in Latvia, our lead authority is the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv, pasts@dvi.gov.lv).
10. Security
Connections to our server are encrypted (HTTPS). The database allows each signed-in user to read only their own account and usage, and only our server can change them. The AI key is kept on the server only, never in the extension. We store as little as possible: no CV, profile, posting or letter text on the server.
11. Children
ApplyKeep is not meant for anyone under 16.
12. Changes
We will update this policy when the extension's data handling changes, for example when paid plans are added, and show the date above. Significant changes will be announced in the extension or by email before they take effect.
13. Contact
Suheyl Baghban, Latvia
privacy@applykeep.com