Privacy Policy
Last updated: 2026-07-08
Job Buddy has no servers. Everything stays in your browser's local storage by default. Three optional features can send data off-device, and only when you explicitly enable them:
- Cloud Backup uploads your profile to your own Google Drive.
- AI Resume Import sends a résumé file you choose to Google's Gemini API for extraction.
- AI Autofill assist sends form-field metadata and your profile to Google's Gemini API when the rule-based autofill cannot confidently resolve a field.
All three are off until you turn them on. Job Buddy itself never stores your data on any server and is not a party to your connection with Google.
Who We Are
Job Buddy is a free, open-source Chrome browser extension created and maintained by Myo Win Thein. It helps job seekers autofill application forms using a profile they build and store entirely on their own device. The extension is distributed through the Chrome Web Store and its source code is available at github.com/myowinthein/job-buddy.
There is no company behind Job Buddy, no servers, and no database. The developer is the data controller for the limited purposes described in this policy.
What Data We Collect
Job Buddy does not collect data in the traditional sense. All data is entered by you and stored locally in your browser's chrome.storage.local. The developer has no access to it. The following categories are stored:
Profile data (stored on your device)
- Personal information — name, email address, phone number, date of birth, and optional EEO fields (gender, ethnicity, veteran status, disability status). EEO fields are optional and voluntary.
- Address — street, city, state or province, postal code, and country.
- Professional summary — a career summary and notice period you write yourself.
- Salary information — current salary and expected salary figures, currency, and pay period.
- Work authorization — your authorization status, visa type, and visa expiry per country.
- Work history — company names, job titles, dates, locations, work arrangement, and descriptions.
- Education — institutions, degrees, fields of study, dates, and descriptions.
- Languages — languages and proficiency levels.
- Links — LinkedIn, portfolio, and other URLs you add.
- Documents — if you upload a CV or résumé, it is stored on-device as encoded file data. It is not sent anywhere by default; if you enable Cloud Backup it is included in the Drive backup.
Supporting data (generated as you use the extension)
- Learned field mappings — when you manually assign a profile field to a form field, Job Buddy remembers that pairing for the site's domain. Only field-name-to-profile-path associations are stored, never the values you typed or page content.
- AI settings — if you enable AI features, your Gemini API key and selected model are stored locally. The key is never included in export bundles and never sent to anyone other than Google's Gemini API.
- Cloud Backup state — if you connect Google Drive, the OAuth token and a small amount of bookkeeping (Drive file ID, last sync time, pending-sync flag) are stored locally. The token is never included in export bundles.
- Theme preference — your System / Light / Dark choice.
Special Category Data (GDPR Article 9)
The optional EEO fields — gender, ethnicity, veteran status, and disability status — are special category data under Article 9 of the GDPR. Job Buddy processes this data solely on the basis of your explicit consent, which you provide by voluntarily entering values. This data is stored only on your device, is never sent to Job Buddy's servers (which do not exist), and reaches third-party APIs only through opt-in features you activate. You can delete any of these fields at any time from the Options page.
How We Use Your Data
The table below lists each processing purpose and its GDPR legal basis under Article 6.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Autofilling job application form fields | All profile fields | Art. 6(1)(a) — consent; you installed the extension and entered data for this purpose |
| Remembering learned field mappings to improve accuracy on sites you revisit | Form field identifiers, profile path associations | Art. 6(1)(f) — legitimate interests (improving autofill accuracy at your direction) |
| Remembering display preferences | Theme setting | Art. 6(1)(f) — legitimate interests |
| Cloud Backup to your Google Drive | Full profile, learned mappings, application history | Art. 6(1)(a) — consent (opt-in feature you explicitly enable) |
| AI Resume Import via Google Gemini API | Résumé file contents (sent to Gemini on your instruction) | Art. 6(1)(a) — consent (opt-in, triggered per upload) |
| AI Autofill assist via Google Gemini API | Profile JSON, form field labels and metadata | Art. 6(1)(a) — consent (opt-in feature you explicitly enable) |
| EEO fields (gender, ethnicity, veteran status, disability status) | Special category personal data | Art. 9(2)(a) — explicit consent |
How Job Buddy Accesses Web Pages
Job Buddy includes a content script that runs on web pages so that, when you click Auto Fill, it can scan the page for form fields and fill them using your profile. The script is present on all pages, which is why Chrome may show a permission notice describing access to "your data on all websites."
In practice, the script does nothing on its own. It only scans or fills a page when you actively trigger it. It does not read, monitor, or transmit page content in the background.
One exception, limited to fields you have already autofilled: if your profile is updated while a job application tab is open, Job Buddy may silently fill fields it identified earlier but had no value for, without touching any fields it already handled.
Permissions We Request
| Permission | Why it is needed |
|---|---|
storage |
To save your profile, learned field mappings, AI settings, theme preference, and Cloud Backup state in your browser's local storage. |
identity |
To perform the Google OAuth flow if you opt in to Cloud Backup. Used only when you click Connect Google Drive in Settings. |
| Content script on all pages | To allow the Auto Fill and field-picker features to work on any job application page, only when you trigger them. |
Host access to https://www.googleapis.com/* |
Used by Cloud Backup to upload, download, and delete your backup file inside Drive's hidden application-data folder. |
Host access to https://oauth2.googleapis.com/* |
Used to revoke your Google OAuth token when you disconnect Drive from Settings. |
Host access to https://generativelanguage.googleapis.com/* |
Used by the optional AI features. Never contacted unless you have configured a Gemini API key. |
Cloud Backup (optional)
When enabled, Cloud Backup syncs your profile to your own Google Drive using the https://www.googleapis.com/auth/drive.appdata scope. This scope grants access only to a hidden application-data folder inside your Drive, not your general Drive contents. The backup file is not visible in the regular Google Drive UI.
Your local profile is the source of truth. Drive never overwrites your local data silently; restoring from Drive is always explicit. Your OAuth token is stored only in local extension storage and is never included in any export bundle. Disconnecting from Settings revokes the token and, at your choice, deletes the backup file from your Drive.
AI Features (optional)
Two optional AI features use Google's Gemini API via an API key you supply yourself. Both are off until you paste a key into Settings. The key is yours, obtained directly from Google AI Studio.
AI Resume Import. When you upload a PDF or DOCX résumé, the file is sent to the Gemini API as base64 inline data. Extracted suggestions are shown in a review screen where you accept or reject each one; nothing writes to your profile until you confirm.
AI Autofill assist. After the rule-based autofill runs, unresolved fields are sent to the Gemini API along with your profile JSON. Only field labels, names, and surrounding text are sent; the full HTML of the page is not.
If you do not provide a Gemini API key, neither AI feature runs. Clearing the key stops all future AI requests immediately. Data sent to the Gemini API is processed by Google under their API terms. Job Buddy is not in the middle of that connection and never receives a copy.
Data Sharing and Third Parties
Job Buddy does not sell, rent, or share your data with any third party. Data leaves your device only through the two opt-in features described above:
- Google Drive — if you enable Cloud Backup, your profile is uploaded to your own Google Drive account. Google processes this data under their Privacy Policy.
- Google Gemini API — if you enable AI features, résumé content or profile data is sent to the Gemini API using your own API key. Google processes this data under their Gemini API additional terms.
There are no advertising networks, analytics services, crash reporters, or marketing tools integrated into Job Buddy.
International Data Transfers
By default, no data leaves your device, so no international transfers occur. When you use the optional Cloud Backup or AI features, your data is sent to Google's services, which are operated in the United States and other countries outside the European Economic Area (EEA).
Google participates in the EU–US Data Privacy Framework and uses Standard Contractual Clauses (SCCs) as safeguards for transfers from the EEA. More information is available in Google's data transfer frameworks documentation.
Data Retention
Your data is retained in your browser's local storage for as long as you keep the extension installed and do not delete it. There is no automatic expiry. Uninstalling the extension removes all locally stored data.
If you have connected Google Drive, your Drive backup is retained until you disconnect and choose to delete the file, or until you delete it manually from your Google account.
Learned field mappings are retained indefinitely unless you clear them via Settings. They contain no personal data, only field-name-to-profile-path associations.
Your Rights
If you are in the European Economic Area, you have the following rights over your personal data under GDPR Articles 15 to 21. Because Job Buddy stores all data locally on your device, you can exercise most of these rights directly within the extension without contacting the developer.
- Access (Art. 15) — view all data Job Buddy holds by opening the Options page, or export a full JSON copy via Settings > Export.
- Rectification (Art. 16) — edit any field in your profile at any time from the Options page.
- Erasure (Art. 17) — delete individual fields, or use Settings > Reset to permanently clear all data. Uninstalling the extension also removes all local data.
- Restriction of processing (Art. 18) — you can stop Job Buddy from using specific data by removing it from your profile, or disable the extension entirely to halt all processing.
- Data portability (Art. 20) — Settings > Export produces a JSON file containing your profile, learned mappings, and application history, importable into another Job Buddy instance.
- Objection (Art. 21) — where processing is based on legitimate interests (Art. 6(1)(f)), you may object at any time by removing the relevant data or uninstalling the extension.
- Withdraw consent — for EEO fields processed under Art. 9(2)(a), you can delete them at any time; withdrawal does not affect the lawfulness of prior processing.
Children's Privacy
Job Buddy is a professional productivity tool intended for adults who are actively applying for employment. It is not directed at children under the age of 16, and the developer does not knowingly collect personal data from anyone under 16. If you believe a child has entered personal data into Job Buddy, you can clear all stored data from Settings > Reset, or by uninstalling the extension.
Supervisory Authority
If you are in the EEA and believe your data protection rights have been infringed, you have the right to lodge a complaint with your national data protection authority (Art. 77 GDPR). A list of EEA supervisory authorities is available on the European Data Protection Board website. If you are in the UK, you may contact the Information Commissioner's Office (ICO).
Changes to This Policy
If Job Buddy's data practices change, this policy will be updated with a new effective date and the changes will be reflected in the Chrome Web Store listing. Continued use of the extension after an update constitutes acceptance of the revised policy.
Contact
For questions about this Privacy Policy, open an issue at https://github.com/myowinthein/job-buddy/issues.