Your resume is personal
Here's how we protect it — in plain language. Encryption everywhere, data isolated per user, an extension that asks for as little as possible, and no training on your data.
Last updated: November 7, 2026
Protected at every layer
From the connection to the database to the extension in your browser — the short version first, with the detail further down the page.
Encrypted everywhere
All traffic uses TLS. Data at rest — database and file storage — is encrypted by our infrastructure providers.
Isolated per user
Row-level security in the database means every query is scoped to your account. Files live in a private bucket under your user ID; downloads use short-lived signed links.
Secrets stay on the server
AI and payment keys never ship to your browser or the extension. The extension holds only its own revocable session token.
Minimal permissions
The extension reads a page only when you ask it to, requests site access per site, and never submits a form.
No training on your data
We use Anthropic's API, which doesn't use your inputs or outputs to train models. We never sell your data.
You're in control
Export or delete everything from Settings at any time. Self-identification answers are only stored with your explicit consent.
How your data flows
Five moments where your information moves — who handles it at each step, and where it stops.
Step 1
Upload
You upload a resume — it's stored in a private bucket and its text is extracted on our servers.
Text extracted server-side
Step 2
AI processing
To build your profile, tailor a resume, score a match or draft an answer, the relevant text is sent to Anthropic's API over TLS and the result returned to us.
Only the relevant text
Step 3
Your documents
Generated documents are stored privately in your account. Only you can access them.
Only you can access them
Step 4
Autofill
When you autofill, the extension reads the form's field labels, asks our API how to fill the ones it can't match itself, and fills them in your browser. Field values never go into our analytics.
Field values never in analytics
Step 5
Payments
Payments are handled by Stripe; we never see or store your card number.
We never see your card number
Every permission, explained
Applyd asks for as little as possible. It reads a page only when you open the side panel there and ask it to.
- Never reads your browsing history
- Never runs on sites you haven't enabled
- Never submits anything
manifest.json · permissions
sidePanelSide panel- Shows Applyd in Chrome's side panel, next to the job posting.
activeTabActive tab- Reads the job posting and application form of the current tab only, when you open Applyd from the toolbar.
scriptingScripting- Injects Applyd's script on demand — never automatically — to read the job description and fill the fields when you click Autofill.
storageStorage- Keeps your Applyd sign-in and panel preferences on this device, plus a temporary hand-off from the right-click menu.
contextMenusContext menu- Adds one right-click item, “Use as job description”, for pages Applyd can't read automatically.
optional_host_permissionsSite access — optional, per site- Requested only when you click “Enable on this site” or “Enable on supported job sites”, so Applyd keeps working across multi-step forms and embedded application frames. No site access is granted at install, and you can revoke it in Chrome's extension settings.
externally_connectableWebsite connection- Lets only the Applyd website hand your session to the extension, after you click “Connect extension”.
No remote code. All of the extension's code is bundled in the package; it calls the Applyd HTTPS API for AI features.
Your data, your call
Everything Applyd holds about you can be downloaded or deleted from Settings, and anything sensitive is opt-in.
Export everything
Open Settings and click “Export my data”. You'll get a JSON file with your profile, jobs, applications, documents list and answers — your files come as download links that expire after 7 days.
Delete your account
In Settings, choose Delete account and type your email to confirm. Your subscription is cancelled, your files are deleted and your account is removed. This can't be undone.
Self-ID, only with consent
Gender, race, veteran and disability questions are optional. Without your explicit consent we store nothing and always answer “Prefer not to say”. Withdrawing consent immediately resets these answers.
Disconnect any time
“Disconnect” in the side panel removes the extension's sign-in session. Site access is granted by you, per site, and can be revoked in Chrome's extension settings.
Analytics, your choice
First-party only. If you allow analytics, a random identifier links events from the same browser; if you decline, events are counted without it. Never field values.
The full list of what we collect, why and for how long is in our Privacy Policy.
Built defensively
The safeguards in the app itself — from the first request to the last line of billing code.
Requests
Security headers, strict same-origin checks on sensitive endpoints and per-user and per-IP rate limits.
Uploads
Uploaded files are identified by their contents (not their name), size-limited, parsed with a timeout, and never executed.
AI inputs
Content from job pages is treated as untrusted data and isolated from AI instructions.
Data access
Automated tests verify that users can only ever read their own rows.
Billing
Billing and credits can only be changed by the server, never by a user.
Who handles your data
Each provider processes data under contract and only on our instructions. We do not use any other third-party analytics, advertising or tracking services.
Supabase
Authentication, Postgres database with row-level security on every table, private file storage.
Data
All account and application data
Vercel
Application hosting with HTTPS everywhere.
Data
Request data and server logs
Anthropic
AI processing via API (no training on your data) — extraction, tailoring, matching and drafting.
Data
Profile, job descriptions, form field labels — not used to train models
Stripe
Payments (PCI DSS Level 1).
Data
Email, billing details, subscription status
Found a vulnerability?
Please email support@applyd.app with the subject “Security report” and the details needed to reproduce it.
See also our Privacy Policy and how extension permissions are used.
What you can expect
- We'll acknowledge within 3 business days
- We'll keep you updated
- We'll credit you, if you'd like
Please don't
- Access other users' data
- Degrade the service
- Publicly disclose before we've had a chance to fix the issue
Apply faster, stay private
Upload your resume once. Only you can access your documents, and you always click submit.
- No credit card
- 5 free tailored applications / month
- You always click submit