JobFit Privacy Policy
JobFit is a Chrome extension that analyzes supported job posting pages and compares them with a user-saved profile. JobFit offers both local analysis (on-device) and optional premium AI-powered analysis (server-based). This policy explains what JobFit reads, what it stores, how it uses that information, and what choices users have.
This revision describes the credit-ledger rollout when deployed. Updating this source does not confirm that the rollout or the Chrome Web Store listing is live.
한국어 핵심 요약
기본 공고 추출과 로컬 매칭 점수 계산에는 외부 AI 호출이 없으며, 공고를 여는 것만으로 유료 AI 요청을 보내지 않습니다. 공고 AI 분석과 이력서 분석은 각각 1크레딧으로, 공고 분석은 확장 소유 확인 창에서 공고명과 비용을 확인한 뒤 실행하고 이력서 분석은 확장 설정 안의 명시적 사용자 동작으로 실행합니다. 선택한 분석에 필요한 공고·프로필·이력서 내용은 아래 AI 처리 사업자에게 전송되며, 서버에는 계정·라이선스·크레딧·결제·작업 기록과 개인정보를 포함할 수 있는 암호화된 AI 응답이 저장됩니다. AI 응답은 24시간 동안 재조회할 수 있고 만료된 동일 작업의 재조회는 추가 차감 없이 410 응답을 반환하며, 만료 암호문은 기존 시간별 정리 루틴에서 자동 정리하지만 장애·재시작 등으로 지연될 수 있어 정확히 24시간 후 물리 삭제를 보장하지 않습니다. 금액 원장·결제 이력은 응답과 별도로 보존하며 백업에도 별도 보관과 접근 제한이 적용되고, 이 개정 내용은 해당 버전의 실제 배포 시 적용됩니다.
1. What JobFit does
JobFit reads supported job posting pages in the browser, normalizes the posting into a consistent structure, and displays an on-page analysis panel and local fit score. The extension also provides an options page where users can save profile preferences such as target roles, skills, domains, regions, and remote-work preferences.
Premium features (optional, user-initiated only): AI analysis costs 1 credit per analysis; resume analysis also costs 1 credit per analysis. Opening a job posting page sends no AI request. The in-page AI button opens an extension-owned confirmation showing the job title and 1-credit cost; dispatch happens only after the user confirms there. Resume analysis starts from an explicit action inside the extension's options page, without a second confirmation popup. The selected feature sends the needed job posting, profile fields, or resume text through our API to the AI services in section 5.
One-time credit packs contain 20 / 60 / 200 credits, with displayed prices of KRW 3,900 / 8,900 / 19,900 respectively. Confirm the final price and available payment methods on the checkout page before paying. New recurring subscriptions and sprint passes are not offered; closing new sales does not itself revoke existing entitlements.
Semantic skill matching based on external embeddings is unavailable in this rollout: its disabled endpoint returns HTTP 503 without an AI call. This is separate from the local fit score, which continues to run on-device without external AI calls.
As of this policy's effective date, JobFit uses the following job-site host-permission
domains from the extension manifest: linkedin.com, indeed.com, indeed.co.uk, indeed.ca, glassdoor.com, wellfound.com, ziprecruiter.com, greenhouse.io, jobs.lever.co, myworkdayjobs.com, wd1.myworkday.com, wd3.myworkday.com, wd5.myworkday.com, wanted.co.kr, jobkorea.co.kr, saramin.co.kr, incruit.com, jumpit.co.kr, careers.kakao.com, teamblind.com, peoplenjob.com, rocketpunch.com, recruit.navercorp.com, notion.so, notion.site, and about.daangn.com. JobFit also requests api.gamja.top only for extension-initiated API requests, not for content
script injection. This list may change in future versions of the extension.
2. Information JobFit reads
JobFit's content script is loaded on pages within the supported job-site domains listed above. On each page load, JobFit reads the page URL and may inspect limited page metadata or page structure to determine whether the page is a recognized job posting.
On supported job posting pages, JobFit may read:
- Page URL, job title, company name
- Location, workplace type, employment type
- Salary information when present
- Apply method and application URL
- Requirements, qualifications, skills, and technologies
- Job description content needed for extraction and scoring
JobFit may also store user-entered information from the options page:
- Target roles, skills, domains, years of experience
- Summary text, preferred regions, remote-work and language preference
If you choose resume analysis, the selected PDF is sent to our API for text extraction, and the extracted text is sent for AI processing. Resume content and profile-derived results may contain personal information.
3. How JobFit uses information
Local parsing and scoring (no external AI calls):
- Detect supported job posting pages
- Extract normalized job fields
- Compute a local fit score against the saved profile
- Render the in-page diagnostics panel
Premium AI analysis:
- Google sign-in is optional for local features and is used for account/license activation and authenticated premium requests; the verified email is retained as account identity
- Opening a recognized job posting page sends no AI request, regardless of license or credit status; paid analysis follows the explicit actions described in section 1
- One-time credit-pack checkout is user-initiated; final prices and payment methods are confirmed at checkout
- Send only the job posting, profile fields, or resume text needed for the selected analysis through our API to the AI services described below
- Return AI-generated results to the extension and store an encrypted response for same-operation re-query and recovery if a response is lost
- Keep account, license, credit, payment, operation-ID and audit metadata for service operation, security, and duplicate-charge prevention
Anonymous analytics (opt-in only):
- If the user opts in, aggregate usage statistics (feature counts, not personal data) may be sent to our server
- Analytics is separate from the account records and AI response storage described below
- Users can opt out at any time from the extension settings
Parser health telemetry (opt-in only, shares the same toggle as analytics):
- When the user opts in, each time the extension parses a supported job posting it reports:
- the adapter id (e.g.
linkedin,greenhouse) - whether parsing succeeded or failed
- how many structured fields were extracted (counts only, never the values)
- the domain name (e.g.
linkedin.com) — never the full URL - the extension version
- the adapter id (e.g.
- The payload contains no URLs, no job posting content, and no device or user identifiers.
- Purpose: detect broken adapters across the fleet without accessing user data.
- Retention: 30 days, after which reports are automatically deleted.
- Users can opt out at any time from the extension settings — the same toggle as anonymous analytics.
4. Where information is stored
On-device: User profile, analysis snapshots, recent-analysis history, saved jobs, and local premium state are stored in chrome.storage.local.
Server-side, when account or premium features are used: Verified account email and account/device identifiers, license identifiers, credit balances and ledger entries, payment records, operation IDs and audit metadata. AI responses are also stored encrypted with AES-256-GCM for re-query and lost-response recovery. These responses can contain personal information, including fields derived from your profile or resume; encryption does not make them anonymous. Their replay window and cleanup are described below.
5. Data transmitted to third parties
- OpenRouter → Parasail — the primary AI route uses GLM (
z-ai/glm-5.3-flash) to process the job posting, profile fields, or resume text needed for your explicit request - OpenRouter → Google Vertex AI — Gemini 3.5 Flash Lite is the backup route only when the primary is confirmed not to have executed the request; ambiguous outcomes do not trigger an automatic resend or fallback
- Google sign-in — the sign-in token is used to verify account identity for account/license activation and authenticated premium requests; the verified email is retained in the account record
- Lemon Squeezy — user-initiated checkout and payment processing; JobFit retains payment identifiers and transaction records for fulfillment, refunds, and reconciliation
This rollout does not use a direct OpenAI route or an embedding service. The services' own data-handling terms apply; JobFit's 24-hour result replay window is not a promise about their retention periods.
JobFit does not include third-party analytics, advertising, or tracking libraries in its extension runtime.
6. Sharing and selling
JobFit does not sell user data or transfer it for advertising or data brokerage. Transfers to the AI services, Google sign-in, and payment processor described above are limited to providing the selected features and operating the account and payment service.
7. Retention and deletion
On-device data persists until the user clears it or removes the extension.
Encrypted AI responses have a 24-hour re-query window from capture. After expiry, re-querying or retrying the same operation returns HTTP 410 rather than generating a new result or charging again. Expired ciphertext is automatically cleared through the existing hourly expiry routine in this rollout. Cleanup may be delayed by restarts, outages, or processing backlog: this is not a guarantee of physical deletion at exactly 24 hours, or of immediate erasure from all storage.
Credit-ledger, payment, operation and audit metadata are retained separately from AI response bodies for accounting, refunds, security, and duplicate-charge prevention; result expiry does not delete those records. Backups have separate retention and restricted access; a specific backup retention period is not yet established in this policy. Expired results cannot be re-queried through the API even if a backup still contains them. Contact us to request deletion or ask about retained account data.
8. Security
On-device data uses Chrome's extension storage API and is not end-to-end encrypted by JobFit. Server communication uses HTTPS. Stored AI response bodies use AES-256-GCM; the API can decrypt them for authorized same-account re-query. License identifiers are used for verification. These measures do not guarantee that data can never be accessed or that deletion is instantaneous.
9. Chrome Web Store limited use disclosure
JobFit uses job-page content and user-provided profile or resume data to provide its visible job-review and profile features. It does not sell that data, transfer it for advertising, or use it for creditworthiness decisions. Transfers are limited to the feature, account, and payment purposes disclosed above. This is a statement of data use, not a certification of legal or Chrome Web Store approval.
10. Permissions
- storage — save user profile and analysis locally
- host permissions — load content scripts on supported job-site domains and contact the JobFit API server
- activeTab — access the active tab when the popup is opened
11. Children's privacy
JobFit is not directed to children under 13.
12. Changes to this policy
Updates will be posted at this URL with a revised effective date.
13. Contact
Questions? Contact: ppkimsanh@gmail.com