Nothing, until you select a provider and press Analyze current job with AI.
Up to that point the PDF is parsed locally by a bundled copy of PDF.js, and the job page is read by a one-time script injected into the tab you are looking at. Both stay in side-panel memory.
Running an analysis sends the PDF-derived CV text and the captured job text directly to the one provider you chose — OpenAI, Anthropic, or DeepSeek — and to no one else. There is no automatic fallback to another provider, and no server of ours in the path.
Only two things reach chrome.storage:
- the interface language
- how long past analyses took, used to estimate the next one
The CV text, the captured job, the analysis, and the API key live in the open
side panel and disappear with it. A generated report is held in
chrome.storage.session, which the browser clears when it closes.
tests/privacy.test.mjs asserts at the source level that nothing writes CV text
or an API key to storage.
The extension requests no host permissions at install time. Access to a provider's API domain is requested when you select that provider, and access to a job site is requested per site, only if the one-time page read is blocked.
activeTab and scripting allow reading the page you are on after you act;
storage holds the two items above; sidePanel shows the workspace; tabs lets
the extension see the active tab's URL so it can ask for that exact origin.
It is placed in the request to the provider you selected and kept in the open panel so repeat analyses do not need retyping. It is never written to storage, files, or logs, and it is gone when the panel closes or the session is cleared.
The redacted preview is informational, not the exact payload — reliable evidence matching needs the original text. Analysis is generated by a model: it is an evidence-based job-search aid, not legal, immigration, or employment advice.