Privacy Policy

Last updated: 2 August 2026

AI Job Hunter is a local-first desktop app with an optional companion browser extension. There are no accounts to sign up for, and most of what the app does never leaves your computer. The desktop app does send crash reports so we can fix what breaks — on by default, switchable off, and never containing your résumés or job data. The browser extension sends nothing at all. The parts that do leave your computer are spelled out plainly below, because store reviewers read this against the actual code, and so should you.

The short version #

No accounts. Nothing to register. We never see your data because there is no "we" server to see it.
No behavioural analytics or ad tracking. No Google Analytics, no PostHog, no Segment, no Mixpanel, no advertising or cross-site tracking of any kind. Nothing follows you around, and nothing records what you do in the app.
Crash reports, on by default, from the desktop app only. When something breaks, the error and its stack trace, your operating system and the app version are sent to Sentry so it can be fixed. Paths, links, e-mail addresses and credentials are stripped before anything is sent. You are asked during setup and can switch it off there or in Settings → Privacy at any time. The browser extension is excluded entirely.
The browser extension is loopback-only. It talks to your own running desktop app on 127.0.0.1 and nowhere else.
The desktop app talks to a third-party AI provider only when you set one up and run an AI feature — using your own API key (or your own local model). That content is governed by that provider's privacy policy.
Your data lives on your machine — résumés, job history and settings are stored locally in your OS application-data directory. Secrets (API keys, board passwords) go in your operating system's keychain, not plain files.

Browser extension #

The AI Job Hunter — Job Importer extension (Chrome and Firefox) exists to do one thing: take the job posting you're looking at and hand it to the desktop app running on the same machine. It is inert unless that app is running and you've paired it.

What it sends — and where

Loopback only. The extension connects to your own desktop app over native messaging (preferred) or a loopback WebSocket at ws://127.0.0.1:<port> (fallback). It has no remote backend and contacts no third-party server. Its only host permission is 127.0.0.1 (loopback); it grants no access to any public or LAN address.
Import this job sends the current tab's URL to the local app. The extension also captures the page's rendered DOM when possible (for logged-in boards that a headless server-side fetch cannot reach), and sends that HTML only to the local app. Nothing is captured in the background or on page load. Capture happens only when you click Import.
Fill this form (assisted autofill: opt-in, off by default). If you turn on Assisted form autofill in the desktop app (Settings → Accounts → Browser extension), clicking Fill this form asks the desktop for your saved contact details (name, email, phone, location, LinkedIn/GitHub/website) over the same loopback connection and fills matching empty fields on the current page, then shows an in-page summary. Your details are your own data, come from your own paired desktop, are used only for that one fill, are never stored in the browser, and never leave your computer except into the page you chose to fill. It never submits the form for you. When the toggle is off, the desktop declines the request. This is why the extension collects no data and its Firefox data-collection declaration is ["none"].
Attaching a résumé or pasting a cover letter (same opt-in). The workspace panel can export your résumé or a saved cover letter — rendered on your own computer — and either attach it to the page's résumé upload field or paste/copy its text into a field you pick. The file is never stored in the browser and never leaves your computer except into the page you are on; nothing is attached or pasted until you choose the action.

Permissions, and why each is there

activeTab — read the URL and the DOM of the tab you clicked, only on that click. No standing access to any site.
storage — store the pairing token locally so you only pair once.
scripting — MV3 requires this to inject the DOM capture into the active tab on import click; its reach stays limited to the active tab.
nativeMessaging — connect to the AI Job Hunter desktop host (app.aijobhunter.bridge) using the browser's native-messaging channel. This is the primary transport to the local app and is immune to Firefox HTTPS-Only Mode silently upgrading ws:// connections. Falls back to the loopback WebSocket if the native host is not registered.

No broad host access (<all_urls>), no tabs permission, no webRequest, no remotely-hosted code, no eval. Everything is bundled at build time.

What it stores

The only value the extension persists is the pairing token — a one-time secret you copy from the app's Settings — kept in chrome.storage.local. It is used solely to authenticate to your local desktop app and is never sent to any remote server. No telemetry, no analytics, no external API.

Desktop app #

The desktop app is local-first: it stores your data on your machine and does its work there. But it is an AI job-hunting tool, so some features do reach out over the network — by design, and only when you ask. Here is exactly what goes where.

AI providers — your text, your key, their servers

When you run an AI feature (tailoring a résumé, analysing a job, writing a cover letter), the app sends the relevant résumé / job-posting / cover-letter text to the AI provider you choose and configure, authenticated with your own API key.

Local models — Ollama runs models on your own machine (default; keyless, nothing leaves the computer).
Cloud providers — OpenAI, Anthropic, Google Gemini, Ollama Cloud, and any OpenAI-compatible endpoint (LM Studio, OpenRouter, Groq, Together, DeepSeek, Azure, etc.) via a base URL you set.
Local CLI agents — Claude Code, Codex, and the Gemini CLI, run as child processes under your own logged-in CLI.

When you pick a cloud provider, the content you generate over is sent to that provider and is governed by that provider's own privacy policy and terms — not by us. We are not a party to that exchange; the request goes straight from your machine to the provider you chose, under your key. If you stay on a local model (Ollama), that text never leaves your computer.

Embeddings

To rank job matches the app computes embeddings for your résumé and the postings. By default these are computed locally with Ollama (nomic-embed-text), so the text stays on your machine. If you explicitly configure a cloud provider for embeddings, the same "your text → your chosen provider, under your key" disclosure above applies.

Job scraping — fetching job-board pages

To find and import jobs, the app makes outbound requests to the job boards you search. Most boards (e.g. Greenhouse, Lever, Ashby, Personio) are fetched over plain HTTP. LinkedIn job listings are also fetched over HTTP like the other boards; the only local-Chromium use is an optional login window that saves your LinkedIn session cookie to a per-board profile on your machine (to enrich authenticated searches) — not the scrape transport. The walled aggregator boards (Indeed, Glassdoor, StepStone, Xing, Workday) are reached via the Adzuna/JSearch/Jooble aggregator API using your own API key — no browser required. Adzuna requests go directly to Adzuna's API. JSearch requests go through RapidAPI (the API gateway for JSearch) using your RapidAPI key. Jooble requests go directly to Jooble's API, using your own Jooble key, and are made only as a last-resort fallback after Adzuna and JSearch. freehire is the one aggregator tier that needs no API key, so it is the only one that can run before you have configured anything. It is tried last, and only when none of the keyed tiers above failed — if one of your own keys errors, we show you that error rather than quietly answering from freehire instead. It receives only your search keywords and (when you have picked one) a country code. We run no proxy or intermediary; there is no AI Job Hunter server in the path. Adzuna, JSearch, RapidAPI, Jooble, and freehire requests are subject to their respective terms of service and privacy policies.

LinkedIn via Apify (opt-in, off by default). Enabling the "Include LinkedIn (Apify)" toggle and providing an Apify token activates an additional source that sends a search request to Apify's API, which then queries public LinkedIn job listings on your behalf. Both conditions must be met: a token stored and the toggle on. This ensures the feature never runs silently (e.g. during a scheduled autopilot run). What leaves your machine: the search keywords, location, and date-range window, used to build a LinkedIn jobs search URL. No résumé, profile data, or other personal information is included; your Apify token travels in an authentication header only. Requests go directly to Apify's API. No AI Job Hunter server is in the path. Results are billed pay-per-result to your own Apify account. Apify requests are subject to Apify's terms of service and privacy policy.

Where your data is stored

Résumés, job and application history, embedding vectors, and settings are stored locally on your machine, in the operating system's standard per-application data directory. Secrets — AI provider API keys and saved board passwords — are kept in your operating system's keychain / credential store, never in plain-text files. None of this is uploaded anywhere by the app.

Crash reporting — on by default, and switchable off. The desktop app sends crash and error reports to Sentry (Functional Software, Inc.), our only data processor, so that failures can be found and fixed.

What is sent: the error and its stack trace, your operating system and architecture, and the app version. What is never sent: your résumés, cover letters, job data, prompts, generated documents, credentials, or anything you typed. Before any report leaves your machine, file paths, links, host names, e-mail addresses and credential-shaped values are replaced with placeholders, and the machine name is not attached.

Your choice: you are asked during first-run setup, and nothing is sent until you have been asked. You can turn it off there, or later under Settings → Privacy. Reports are kept for 30 days. To have any report deleted, e-mail us and we will remove it.

No behavioural analytics. There is no Google Analytics, PostHog, Segment, Mixpanel, Amplitude or Datadog, and no advertising or cross-site tracking. Nothing records which features you use or what you search for.

Two things happen automatically, without you asking: AI Job Hunter checks for updates periodically — starting shortly after launch, then every few hours — by contacting GitHub, transmitting only your current app version and operating system / architecture; and, like that check, the crash report described above is something the app sends on its own, not something you trigger.

A few other calls happen only when you turn on the feature behind them: an opt-in Exa search for AI-assisted company research, a Photon lookup as a location-autocomplete fallback when the offline index has no match, opt-in Clearbit company-logo lookups, and — if you enable email-confirmation watching — a connection to your IMAP provider.

Your control #

Rotate the pairing token any time from the app's Settings → Browser extension. Re-pairing invalidates the old token.
Uninstall the extension to remove its stored pairing token — it lives only in the browser's extension storage.
Delete your local app data by removing the app's data directory and clearing the saved secrets from your OS keychain. Your résumés, job data and generated documents exist only on your machine, so deleting them locally deletes them everywhere.
Erase crash reports — the one thing that is not local. If crash reporting was on, reports are held by Sentry for 30 days. Switch it off in Settings → Privacy to stop new ones, and e-mail us to have existing reports deleted sooner.
Stay fully local by choosing a local model (Ollama) for AI and embeddings — then nothing leaves your machine except the job-board fetches you initiate.

Changes to this policy #

If this policy changes, we'll bump the "Last updated" date at the top of this page and publish the revised version here. Material changes will be reflected in the app's store listings. There are no accounts, so there's no mailing list to notify — checking this page is the source of truth.

Contact #

Questions about privacy, or a data request? Email [email protected].