Privacy Policy

1. Information we process

This policy covers the JobAgent web service (the ability-report site and its API) and the JobAgent Autofill browser extension. JobAgent analyzes public developer activity on GitHub and Gitee to produce evidence-backed ability profiles, matches profiles to job postings, and helps fill out application forms on supported applicant tracking systems (ATS). We design JobAgent to collect as little personal data as possible.

1.1 Public code-platform data (core feature)

When you submit a GitHub or Gitee username, we call the platform official API to read public information only: the public profile, public repositories, and public commits, pull requests and issues. We never clone repositories, never request access to private repositories, and never ask for your code-platform password. Every profile conclusion links back to the public evidence.

1.2 Sign-in data (only if you choose to log in)

You can use the core report without an account. If you sign in with GitHub or Gitee OAuth to claim a profile, we receive your public username/display name and, where provided, an email address (GitHub user:email, which may be empty; Gitee user_info). Your email is never returned by the who-am-I API endpoint and is never shown to other users.

1.3 Technical data for anonymous demo rate limiting

Anonymous demo usage is rate limited. Without storing your IP address, we store only a salted SHA-256 hash of your IP together with an opaque session identifier and timestamps; we cannot reconstruct your IP from the hash. Demo sessions expire after 24 hours.

1.4 Contact details you enter — kept on your device, never uploaded

The name, email, phone number, LinkedIn URL, location and personal website you type into the extension panel or the resume form are stored only in your browser local storage. They are not transmitted to or persisted on our servers, and are written only into the application form you are viewing, only when you click the fill/apply action yourself. You can erase them at any time by clearing the extension local data.

1.5 Resumes you generate

Targeted resumes are assembled in your browser / on your own machine from your profile and the job posting. We do not store resume documents or local profile fields on the server. Optional AI polish is off by default; when an operator-configured OpenAI-compatible endpoint is set, only the resume text you choose to polish is sent there, and the feature falls back to rule-based output otherwise.

1.6 Strictly necessary cookies and client storage

After OAuth sign-in we set an HTTP-only session cookie. The extension uses the Chrome storage permission for on-device contact details (1.4). We do not use advertising or cross-site tracking cookies.

1.7 Anonymous product-usage funnel events

To understand whether the service works end-to-end (analysis requested → report viewed → report shared), we record four counters server-side: analyze_enqueued, analyze_cache_hit, report_viewed and share_clicked. Each event stores only an opaque random session identifier (a 24-hour HTTP-only ja_sid cookie, where present), the report id where relevant, the kind of requester (visitor / demo / signed-in user) and a timestamp. These events are not linked to your account, your IP address, the analyzed username, your browser or device, and are used only as aggregate counts to measure the product funnel — never for advertising or individual tracking.

2. Information we do NOT collect

• Your GitHub, Gitee or ATS passwords — the extension never sees or types a password field, and OAuth never asks for one.
• Private repositories, private issues, or any non-public code-platform data.
• Payment or billing information.
• Browsing history outside supported career/job pages; the extension activates only on Greenhouse, Lever, Workday and URLs containing careers or jobs.
• Salary, demographic (EEO), visa-authorization or similar sensitive ATS fields — autofill deliberately leaves these blank for you.

3. How we use information

• To generate, store and display evidence-backed profiles and shareable report pages.
• To match profiles with aggregated public job postings and prefill supported application forms.
• To authenticate sign-in and profile claims.
• To prevent abuse of the anonymous demo quota.
• To operate, secure and debug the service (hosting-platform server logs).

We do not sell personal data, and we do not use it for advertising.

4. Sharing and subprocessors

When you click through to a job posting or submit an application, you leave JobAgent and interact directly with that third-party ATS, whose own privacy policy applies.

5. Data retention and deletion

• Ability profiles and evidence are retained long-term so shared report links stay stable and verifiable.
• Share links do not expire automatically.
• On request we delete a profile/evidence and revoke a share link via the contact email below.
• Demo sessions expire after 24 hours; expired sign-in sessions and unclaimed accounts are purged by a scheduled cleanup job.
• On-device contact details and resumes remain until you clear them locally.

6. International data transfers

The production service is hosted in the Tokyo region (Vercel hnd1, Supabase Northeast Asia). GitHub/Gitee public data is read from their respective APIs. The product is designed for both Chinese and international users.

7. Your rights

• View everything we hold about a username by opening its report page.
• Request deletion and share-link revocation by email.
• Clear all locally stored contact details yourself (extension / browser site data).
• Sign out, which ends your session cookie.

We respond to verifiable requests within a reasonable period.

8. Children

JobAgent is a professional developer tool not directed at children; we do not knowingly collect data from anyone under 16 (or the minimum age in your jurisdiction).

9. Security

Credentials and secrets are held only in server-side environment variables. The extension talks to the API through its background service worker, never touches password fields, and sends on-device contact details only into the form you explicitly submit. Profiles are stored as immutable snapshots so evidence cannot silently change after a report is shared.

10. Changes and contact

We may update this policy; material changes update the last-updated date and this page. Questions, correction/deletion requests and objections:

dispute@job-agent.bayjf.com

11. Recruiter self-declaration

Candidate search and recruiter interview tools are available only to logged-in users who explicitly declare recruiter status. Declaring is a reversible, self-service action with no approval step; it does not make your account visible to candidates, and candidates are not notified when a recruiter views their profile.

We record the declaration timestamp and never reset it silently on re-login; cleanup jobs never delete a declared account. You can revoke the declaration anytime, which removes access to recruiter surfaces but does not delete interview records you created. For objections, contact:

dispute@job-agent.bayjf.com

12. AI-assisted applications

When you use the browser extension’s semi-automatic apply feature, JobAgent pre-fills the application form and prepares a tailored cover letter from your verifiable public code evidence, then stops: the extension never clicks the final submit button, and you submit every application yourself.

Each cover letter produced for a job application ends with a fixed, visible disclosure line stating that the material was prepared with AI assistance by JobAgent and is grounded only in your verifiable public code evidence. This line is appended server-side for AI-polished letters and by the rule-based renderer otherwise, so it cannot be omitted by the model. We do not automate submission, do not create accounts on third-party job sites on your behalf, and do not store the cover letter after it is delivered to you.