Kareer
GitHub
LEGAL COMPLIANCE & DISCLOSURES

Kareer Privacy Policy

Last updated: September 22, 2026 • Version 1.1

1. Overview

Kareer is an open-source browser extension and productivity tool created to assist users in completing job application forms efficiently and accurately. Kareer operates on the user’s device (Chrome, Firefox, or supported userscript runtimes) to scan application forms, locate inputs, and assist in matching questions with candidate-supplied resume and profile information.

This Privacy Policy describes our strict data handling practices, explains our local-first architecture, and discloses all data flows required for the operation of the extension.

2. Information Stored Locally

Kareer is designed as a local-first application. The following information may be saved directly in your browser’s extension-controlled storage (chrome.storage.local or sandboxed userscript storage):

  • Candidate profile information: Full name, email address, phone number, location, and social or professional profile URLs (e.g., LinkedIn, GitHub, portfolio).
  • Resume context & notes: Plaintext resume excerpts, work history summaries, education details, and applicant notes (e.g., salary expectations, work authorization status, preferred pronouns).
  • Extension configuration: Selected AI model preferences, UI preferences, and feature toggles.
  • AI credentials: User-provided OpenRouter API key.
Key Guarantee: Kareer does not operate a remote server, cloud database, or central backend service. The developers and maintainers of Kareer never have access to your stored profile data or API credentials.

3. Information Transmitted When AI Features Are Used

Kareer does not continuously broadcast data. However, when you explicitly click Autofill or trigger an inline narrative rewrite, Kareer must transmit specific contextual data to generate answers.

Outgoing AI requests travel directly over encrypted HTTPS from your browser extension background worker to OpenRouter (https://openrouter.ai/api/v1/chat/completions). The network payload includes:

  • The extracted labels, descriptions, and option choices of form fields detected on the current application page.
  • Relevant excerpts of your saved profile and resume context required to formulate answers to those fields.
  • System prompts instructing the language model to return structured JSON grounded strictly in your provided profile without inventing experience.

Data transmitted during AI requests is processed by OpenRouter and the specific downstream language model provider chosen by the user (such as Google, Anthropic, or OpenAI) according to their respective privacy terms and data handling practices. Kareer does not proxy, intercept, or record these requests on any intermediary server.

4. API Keys & Credential Isolation

Kareer operates on a Bring Your Own Key (BYOK) model. You supply your own personal API key from OpenRouter.

  • Your API key is stored exclusively in sandboxed browser extension storage.
  • All network requests to OpenRouter are dispatched exclusively from the extension's privileged background service worker (or sandboxed userscript host).
  • The extension is engineered to prevent exposure of your raw API key to visited web pages, content scripts, DOM elements, or page storage (localStorage / sessionStorage).
  • The developers of Kareer have no ability to view, retrieve, or log your API key.

5. Browser Extension Permissions Explained

Kareer requests only the browser permissions strictly required to perform form detection, state synchronization, and secure network dispatch:

  • storage & unlimitedStorage: Used to store your candidate profile, resume text, application settings, and API configuration locally on your computer.
  • tabs: Used to detect when a supported job application page is open, query the active tab, and mount or toggle the floating assistant interface.
  • webNavigation: Used to monitor multi-step application transitions (e.g. moving from Step 1 to Step 2 in Ashby, Greenhouse, Lever, or Workday) so session continuity is maintained without losing answers.
  • host_permissions / optional_host_permissions (<all_urls>): Used to allow the extension content script to detect and fill form fields across arbitrary employer job boards and applicant tracking systems.
  • https://openrouter.ai/*: Used to allow the background worker to communicate directly with the OpenRouter completion API when you initiate autofill.

6. Data Collection Categories (Firefox & Web Store Disclosures)

In compliance with Mozilla Firefox Add-on and Chrome Web Store privacy declarations, Kareer declares the following data collection categories:

  • Authentication Information (authenticationInfo):
    The user's personal OpenRouter API key is required to authenticate outgoing requests to the AI provider. It is stored locally in extension storage and never collected by Kareer.
  • Personally Identifying Information (personallyIdentifyingInfo):
    A candidate’s profile and resume can contain personal details including name, contact information, work history, and education. Relevant portions are transmitted to the user's chosen AI provider only when autofill is explicitly requested.
  • Website Content (websiteContent):
    Kareer reads form labels, placeholders, and question text on job application pages in order to identify required fields, and sends this question context to the AI model to match answers.

7. Analytics & Telemetry

Kareer contains zero analytics SDKs, error reporting telemetry (such as Sentry or Bugsnag), advertising identifiers, tracking pixels, or behavioral telemetry systems. We do not track which websites you visit, how many applications you submit, or which jobs you apply for.

8. Data Selling & Advertising

Kareer does not sell, rent, monetize, or disclose your personal data, resume information, or browsing activity to any third party, broker, or advertiser. We do not display advertisements within the extension or on this website.

9. Data Retention

  • Local Data: All profile data, resume context, and settings remain in your browser’s extension storage until you edit or delete them, or until you uninstall the extension.
  • Third-Party Model Providers: Data transmitted to OpenRouter or downstream model providers (e.g., Google, Anthropic, OpenAI) during an AI completion request is governed by OpenRouter’s privacy policy and the retention policies of the specific model provider selected. Users should review OpenRouter’s Privacy Policy for their current data retention and logging commitments.

10. User Controls & Data Rights

You have full, immediate control over all data handled by Kareer:

  • Edit or Delete Profile: You can edit or clear your saved contact details, resume text, and notes at any time in the extension’s Profile tab.
  • Clear All Data: You can use the extension's reset controls or browser extension management page to delete all local storage.
  • Revoke API Keys: You can revoke, rotate, or delete your API key at any time directly through your OpenRouter account dashboard.
  • Audit Code: Because Kareer is completely open source, you can audit the source code and build the extension yourself from GitHub.

11. Third-Party Services

Kareer connects with OpenRouter to provide access to large language models. OpenRouter is an independent third-party service provider and is not owned, operated, or controlled by Kareer. Use of OpenRouter is subject to OpenRouter's own Terms of Service and Privacy Policy.

12. Security Model & Architecture

For a technical breakdown of our threat boundaries, credential isolation architecture, and human-in-the-loop safeguards, please consult our official Security Policy on GitHub.

13. Open Source Verification

Kareer is maintained in the open. The complete repository, including all manifests, content scripts, background workers, and build scripts, is available at https://github.com/Amro212/kareer.

14. Contact & Vulnerability Reporting

For general questions, bug reports, or feature discussions:
GitHub Issues Tracker

For reporting security vulnerabilities or potential credential risks, please do not open public issues. Instead, submit a private report using:
GitHub Private Vulnerability Reporting