Privacy Policy

Last updated: 27.10.2026

This Privacy Policy explains how job.fail (“the Service”) processes personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. The Service consists of the job.fail Chrome extension (“the Extension”) and the job.fail website at job.fail, including its CV editor, core skills page, job board, and account pages (“the Website”).

The Service keeps as much of your personal data as it can on your device. Your profile and résumé are stored in the Extension, and your CVs in your browser. If you sign in, your account holds your essential fields (your name, contact details, address, links, and languages, encrypted), your job and education history, your saved jobs and job alerts, and your job.fail tokens and subscription.

1. Privacy at a Glance

Your profile, résumé, and sensitive profile fields are stored on your device. If you sign in, your essential fields (name, contact details, address, links, and languages) are also stored in your account, encrypted
CVs you write in the CV editor are stored in your browser
An account is optional. It holds your sign-in identity, your essential fields, your job and education history with what AI read from it and its Recruitability scores, your saved jobs, your job alerts, your email settings, your token balance, and your subscription and purchase records
Data leaves your device only when you use a feature that needs it:
- Drafting with job.fail tokens: via our server to OpenRouter, which runs cover letters and improvements on Microsoft Azure in the EU, and CVs on Anthropic’s Claude and TypeSafe’s Jev, which may run outside the EU
- Reading a job’s core skills: the job posting, via our server and OpenRouter to Claude, without any identifier of you
- Reading and scoring your jobs (what you did, Recruitability, tags, fit scores, and CV tips): via our server and OpenRouter to Claude and Jev
- PDF export: to our PDF service on Google Cloud in the EU
- Emails: your email address and each email, to Lettermint in the EU
- Error reports: to Sentry, which keeps them in the EU, without your name, contact details, or anything you typed
Sensitive profile fields (such as gender, ethnicity, veteran or disability status) are never sent to us or to any AI provider
Purchases and the subscription are handled by Stripe; we never see your payment details
The Website uses Google Analytics only with your consent. The Extension’s usage statistics are off unless you turn them on
Product update emails are sent only with your consent
No advertising and no sale of personal data

2. Responsible Entity

The responsible entity for data processing within the meaning of Art. 4(7) GDPR is:

Christian Konrad
Postfach 50 03 26
22763 Hamburg

Telefon: +49 (0) 121 521 536 32
Telefax: +49 (0) 122 521 536 33
E-Mail: hi@christiankonrad.co

Full imprint: /en/imprint

3. What Stays on Your Device

3.1 In the Extension

The following data is stored locally in the Extension. It leaves your device only as described in sections 4 and 5:

Your profile used for form autofill, such as name, email address, phone number, address, pronouns, links (e.g. LinkedIn, GitHub, portfolio), current company and role, work authorization and sponsorship, start date and notice period, salary expectation, languages, education, any custom fields you add, and the names of form fields the Extension learns so it can fill them next time. If you sign in, its essential fields are also stored in your account (see section 4)
Sensitive profile fields (gender, race or ethnicity, veteran status, disability status), only if you choose to enter them. They are filled into application forms like your other fields and are included in your CSV export. Leave them empty if you do not want to share them
Your résumé file
Experiences you add in the CV flow while signed out, with their Recruitability scores. The next time you use the CV flow while signed in, they move to your account (see section 4) and are deleted from the Extension
Your acceptance of these terms: when you accepted them, which version, and whether you did so in the onboarding or when signing in
Your choice about usage statistics, and, if you turned them on, a random ID and your current session (see 5.8)
Your sign-in session, if you sign in. After you log out, sign out everywhere, or delete your account in the Extension, it keeps your user ID and the time, so that the Website ends its session too
For each open tab, the forms the Extension found on it, with the page’s address, and how many fields it filled. This is kept until you close the tab or restart your browser
On a job site, a note in that site’s session storage that the Extension already offered to fill its form, so it does not ask again until you close the tab

Cover letters and CVs you draft in the side panel are kept only while the side panel shows them. They are not stored.

The Extension stores this data in Chrome’s local extension storage. It does not use Chrome Sync. You can export your profile, and while signed in your job and education history, as a CSV file in the Extension’s settings. Uninstalling the Extension deletes all of its data. Your account is not affected.

3.2 On the Website

The following data is stored in your browser on the Website:

CVs you write in the CV editor, with the template you chose, the company the CV is for, and the job, core skills, choices, and notes it was written from. When the Extension opens a CV in the editor, the CV is passed in the part of the page address that your browser does not send to any server
Your latest CV tips, together with the CV text they were based on, only while you are signed in
Experiences you add in the CV flow while signed out, with their Recruitability scores. The next time you use the CV flow while signed in, they move to your account
What you started before signing in, such as the CV flow with its job, core skills, choices, and notes, a tips request, a job to save, a job alert, an account you were creating, the job list you came from, or a purchase with the page to return to and your token balance before checkout. It is kept in the tab’s session storage until you are back from signing in or close the tab
The core skills you read on the core skills page, in the tab’s session storage, until the CV editor takes them over
Your search and filters on the job board
The width of the CV editor’s panes
Your cookie choice
Your sign-in session, if you sign in
The days you exported a PDF, up to 30, noted by the Firebase library that sends your CV to our PDF service

Clearing your browser’s site data for the Website deletes all of it. The Cookie Policy explains how the Website uses cookies and similar storage.

4. Your Account

An account is optional. You sign in on the Website with your Google or LinkedIn account via Supabase, which hosts our database in Frankfurt, Germany. You need an account to draft cover letters, CVs, and improvements, to keep your essential fields and your job and education history, and for job.fail tokens and the subscription, saved jobs, job alerts, and CV tips. You do not need one for autofill, the CV editor and its PDF export, the job board, reading a job’s core skills, or adding experiences in the CV flow and having them scored.

Your account stores:

Sign-in identity: a user ID, your email address, your name and profile picture as provided by Google or LinkedIn, the sign-in provider, and creation and last sign-in timestamps. Your profile picture is loaded directly from Google or LinkedIn when it is shown
Essential fields: your first name, last name, full name, email address, phone number, address, city, postal code, country, languages, and LinkedIn, GitHub, and portfolio links, as far as you have entered them, and the time of their last change. Our server encrypts each value (AES-256-GCM) before it is stored, so our database holds only encrypted values
Job and education history: for each entry, the company or school, the title or degree, the dates, the description, its place in the list, and the time of its last change. For each job, also its bullets, what each bullet says you did, the tags read from it, and its Recruitability scores (see 5.3). Experiences you added on a device while signed out move here when you next use the CV flow signed in on that device
Saved jobs: the job board postings you save, when you saved them, and how well each fits your job history (see 5.3)
Job alerts: up to five searches of the job board, with their search text and filters, and when you set them up (see 5.6)
Email settings: whether you agreed to product updates, when, and where (the banner or the settings); when you unsubscribed from job alerts or product updates or marked them as spam; when an email to you bounced; and which welcome and product update emails you were sent (see 5.7)
Token balance and history: your free tokens, your monthly tokens and when they expire, your top-ups, refunds, expired monthly tokens, and for each draft its type and the number of tokens it used, never its content
Subscription and purchase records: your Stripe customer and subscription references, the subscription’s status and whether it is being cancelled, and for each payment its Stripe references, the price, the number of tokens, and the amount paid

Your account does not store the rest of your profile, including sensitive profile fields, or your résumé, CVs, the job postings you draft for, or generated text, unless you save an improved job description to your history.

Essential fields. When you sign in, the Extension replaces its essential fields with those in your account; if your account holds none yet, the Extension’s are stored in your account. While you are signed in, every change you make to them in the Extension or on the Website’s Auto-Fill tab is stored in your account. When you sign out, the Extension keeps them on your device. Our server decrypts them to show them on the Website’s Auto-Fill tab, to put your contact details at the top of the CVs it drafts for you, and to suggest jobs on the job board that can be done from your country. The Website does not keep them in your browser, except in those CVs.

Importing from LinkedIn. On the Website’s account page, you can replace your job and education history with the positions and education on your LinkedIn profile, however you signed in. LinkedIn first asks whether you allow job.fail to read your LinkedIn data; LinkedIn offers this only to members in the EU/EEA. If you allow it, LinkedIn sends our server a one-time code, which our server exchanges for an access token. With it, our server reads only your positions (company, title, description, location, and dates) and your education (school, degree, notes, activities, and dates). The token is used for this one import and is not stored, and the location is not kept. The imported entries replace your job and education history and are stored like entries you type, including their Recruitability scores (see 5.3). If LinkedIn returns no entries for one of the two histories, that history stays as it is. You can remove job.fail’s access to your LinkedIn data in your LinkedIn settings at any time. The data LinkedIn holds is governed by LinkedIn’s privacy policy.

When you sign in on the Website, it hands your session to the Extension, if installed, so you are signed in there too. The Extension accepts sessions only from job.fail. Logging out on the Website also logs you out of the Extension, and logging out in the Extension also logs you out of the Website.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

You can log out, sign out everywhere, and delete your account in the settings of the Extension or the Website. Deleting your account first ends your subscription at Stripe, then removes your sign-in identity, essential fields, job and education history, saved jobs, job alerts, email settings, token balance (including unused tokens), token history, and subscription and purchase records from our database. The Extension’s data stays on your device until you delete it or uninstall the Extension. Records of your purchases in our Stripe account are kept only as long as tax and commercial law require (Art. 6(1)(c) GDPR). Lettermint keeps its logs of the emails it sent you, and its note of an address that bounced or unsubscribed, for its own retention period.

5. What Leaves Your Device, and When

5.1 Drafting with job.fail Tokens (OpenRouter, Microsoft Azure, Claude, and Jev)

When you use job.fail tokens to draft a cover letter, a CV, or an improvement of a job in your history, the Extension or the Website sends the following to our server, which forwards it to OpenRouter (OpenRouter, Inc., USA) through OpenRouter’s EU endpoint. OpenRouter passes it to the AI models:

Cover letters and improvements are written by GPT-6 Luna, which Microsoft Azure runs in data centers in the EU
CVs are written by Anthropic’s Claude. TypeSafe’s Jev rates each job’s bullets and the whole CV, so that the weak parts are written again; it is reached through OpenRouter’s global endpoint. The providers that run Claude and Jev may be outside the EU

What is sent:

For cover letters: the job posting (job title, company, page address, and description), which the Extension reads from the job page in your active tab when you start the draft; your full name; your job history (companies, titles, dates, bullets, and comments); and your education history
For CVs: the job posting’s title, company, core skills, and key phrases (see 5.2); your job history with what each bullet says you did (see 5.3) and your comments; the core skills you matched to your jobs and the notes you entered; and, for the ratings, each job’s bullets and the CV’s text without its header
For improvements: the job entry, its Recruitability scores, the company, title, and dates of your other jobs, and your answers to the questions asked. The proposed text is then scored by Jev (see 5.3)

Your email address, contact details, sensitive profile fields, and account are not sent. Our server adds your name, contact details, and education to the CV’s header itself. We send OpenRouter no identifier of you.

We have turned off prompt logging at OpenRouter and allow only providers that keep nothing once they have answered and never train on what they are sent (zero data retention). Our server does not keep the drafting request or the generated text. It records only the type of draft and the number of tokens it used, to update your balance, and stores what your bullets say you did, if it had to read that first (see 5.3). Server logs record your user ID, the type of request, the steps of a CV draft and how long they took, token usage, and error details for a limited period, never the content.

The Transparency page names the AI models currently used.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

5.2 Core Skills of a Job (OpenRouter and Claude)

The CV flow starts by reading the core skills a job posting asks for. You can also read them on the Website’s core skills page. This needs no account and uses no tokens, and no identifier of you is sent:

When you open Draft CV in the side panel, the Extension sends the page address of the job posting in your active tab, with its title, company, and description, to our server
When you paste a job link on the Website, only the link is sent

To find the core skills, our server sends the job posting’s title, company, and description to OpenRouter, which runs Anthropic’s Claude on providers with zero data retention, as described in 5.1. Our server keeps the posting and its core skills, so that everyone who asks about the same job gets the same answer:

If the link points to a job on one of the applicant tracking systems the job board collects from, our server reads the job from the employer’s public job feed. If the employer is not on the job board yet, the employer and its public job postings are added. The core skills are kept with the job
Any other link is kept, with the posting’s title, company, description, and core skills if the Extension sent them, how often the link was submitted, and when it was first and last submitted. These postings are not shown on the job board

A job posting holds no data about you. Server logs record only the domain of the link and the outcome.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

5.3 Reading and Scoring Your Jobs (OpenRouter, Claude, and Jev)

None of these features uses tokens.

What you did. When you save a job with new or changed bullets while signed in, our server sends each new bullet on its own to Claude, which reads what you did in it, how, and with what result. This is stored with the bullet in your account, so that every CV is written from your own words.
Recruitability rates the jobs in your job history against common recruiter criteria. Whenever a job needs a new score, e.g. when you add it or change its text, the Extension or the Website sends it to our server: its company, title, dates, and description, plus the company, title, and dates of your other jobs. This also applies to experiences you add in the CV flow while signed out. The scores are stored with the job in your account, or on your device until it moves to your account.
Tags. When a job in your account gets a new score, our server sends its company, title, and description to Jev, which tags its field and skills. The tags are stored with the job, and the Website uses them, together with the country in your essential fields, to suggest jobs on the job board that may interest you.
Fit scores. When you open a saved job, our server sends its title, core skills, and key phrases, together with your job history (companies, titles, dates, and descriptions), to Jev, which rates how well the job fits you. The score is stored with the saved job.
CV tips in the CV editor rate your CV and require an account. When you ask for tips, the editor sends your full CV text to our server, including the contact details in its header. The tips are stored in your browser.

Our server forwards this data to OpenRouter as described in 5.1: what you did to Claude through OpenRouter’s EU endpoint, and everything else to Jev (TypeSafe AI, Inc., San Francisco, USA) through OpenRouter’s global endpoint. Both run only on providers with zero data retention, which may be outside the EU. Our server keeps nothing it forwards, except the results stored as described above. Server logs are kept as described in 5.1.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

5.4 PDF Export (Google Cloud Functions for Firebase)

When you export a CV as a PDF, the CV editor sends the CV text and the template to our PDF service on Google Cloud Functions for Firebase (region europe-west1, Belgium), which returns the PDF. The service does not store your CV. Its logs record only the template, the number of pages, the file size, and the processing time. No account is needed.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

5.5 Purchases and Subscription (Stripe)

The subscription and top-ups are sold through Stripe Managed Payments. Stripe’s affiliate Sold through Link, LLC collects the payment as merchant of record and issues your receipt and invoice. Checkout shows the purchase as “Sold through Link”. We pass Stripe your user ID, your email address, and the subscription or top-up you chose. Stripe collects your payment and billing details directly; we never receive your payment details.

Stripe informs our server about completed purchases, paid subscription months, changes to your subscription, refunds, and disputes, so that we can update your tokens and your subscription. When you open Cancel subscription or Manage subscription, our server asks Stripe to open its customer portal for your Stripe customer reference, where you manage and cancel your subscription. When you delete your account, or a payment is disputed, our server cancels your subscription at Stripe.

Stripe processes your payment data as an independent controller under the Stripe Privacy Policy.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (statutory retention obligations).

5.6 Job Board and Job Alerts

The job board shows job postings that employers publish on their own career pages and applicant tracking systems. We collect them daily from these public sources, and add an employer when someone reads the core skills of one of its jobs (see 5.2). You can browse the job board without an account. Your search and filters are sent to our server to load matching postings, without any identifier of you.

When you open a posting, you go to the employer’s website, where the employer’s privacy policy applies. Saved jobs are stored in your account (see section 4).

If you are signed in, you can turn a search and its filters into a job alert, up to five. Your job alerts are stored in your account. Every morning, our email service looks for new postings that match them and, if there are any, sends you one email with up to ten of them (see 5.7). You can remove your job alerts in the settings of the Extension or the Website.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).

5.7 Emails (Lettermint)

Lettermint (Lettermint B.V., Netherlands) sends job.fail’s emails and handles them in the EU. For each email, we give it your email address, the email’s content, and your user ID. Lettermint does not track whether you open an email or click its links. Our server and a scheduled function on Google Cloud Functions for Firebase (region europe-west1, Belgium) hand the emails to Lettermint.

We send you:

A welcome email after you create your account
An email confirming each job alert you set up, and the job alert emails with new matching postings (see 5.6)
A thank-you email after you buy a top-up
Product updates, only if you agree to them in the settings of the Extension or the Website

Job alert and product update emails carry an unsubscribe link. Unsubscribing from job alert emails, or marking one as spam, deletes your job alerts; doing so for product updates turns them off. You can also turn product updates off in the settings at any time. If an email to you bounces, we stop sending you emails. We store when any of this happens (see section 4). If you later set up a job alert or agree to product updates again, our server asks Lettermint to remove your address from its list of addresses that unsubscribed.

When you agree to product updates, we store when you agreed and where, so that we can prove your consent. This record is kept until you delete your account, also after you withdraw your consent.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) for the welcome, job alert, and purchase emails; Art. 6(1)(a) GDPR (consent) for product updates; and Art. 6(1)(c) GDPR together with Art. 7(1) GDPR for the record of your consent.

5.8 Analytics (Google Analytics)

On the Website, with your consent, we use Google Analytics (Google Ireland Limited) to count visits and see which pages are used, so we can improve the Service. We have turned off Google signals and ad personalization. Google Analytics may receive:

Pages viewed, without the part of their address after ”?” or ”#”
A few actions: signing up or in and with which provider, starting a checkout and for what, a completed purchase, opening your subscription settings, deleting your account, generating a CV, exporting it as a PDF, reading a job’s core skills, and clicking a link to the Chrome Web Store
Technical data: browser and version, operating system, device type, language, screen size, and approximate location derived from your IP address
Pseudonymous identifiers stored in the cookies _ga and _ga_<ID>, kept for up to 2 years

Google Analytics is off until you opt in. You can withdraw your consent at any time on the Cookie Policy page, with effect for the future.

In the Extension, usage statistics are off unless you turn them on, in the onboarding or in the Extension’s settings. Then the Extension counts the install, finishing or skipping the onboarding, filling an application form and which application system it was (such as Greenhouse or Lever), and generating a cover letter, a CV, or a job’s core skills. It identifies itself with a random ID stored on your device, which is deleted when you turn usage statistics off, and with the time your current session started. The events go to our server, which passes them on to Google Analytics without your IP address or browser details. You can turn usage statistics off in the Extension’s settings at any time, with effect for the future.

Google Analytics never receives your profile, résumé, job history, CVs, job postings, the address of a page you fill a form on, or generated text.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent).

5.9 Error Reports (Sentry)

When something breaks in the Extension, on the Website, or on our server, a report goes to Sentry (Functional Software, Inc., USA), which keeps it in Frankfurt, Germany, so that we can find and fix the error. A report contains the error, where in job.fail’s code it happened, the page’s address without the part after ”?” or ”#”, your browser and operating system, and job.fail’s version. On the Website and our server, one in ten page loads and requests also report how long they took, and the Website tells Sentry about each page load, so that we can see how many end in an error.

A report never contains your name, contact details, cookies, what you typed, or the texts you send us. On a job site, the Extension reports only errors in its own code, with the site’s address cut to its domain and path. We have told Sentry not to store IP addresses. Sentry stores nothing in your browser.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a Service that works).

5.10 Hosting (Cloudflare and Supabase)

The Website and our server run on Cloudflare. When you visit the Website or the Extension contacts our server, Cloudflare processes your IP address, the requested address, date and time, and your browser’s user agent to deliver the Service and keep it secure. To protect the Service from overload, Cloudflare also counts the requests of each signed-in account by its user ID, over a few seconds at a time.

Our database and sign-in run on Supabase in Frankfurt, Germany, which also stores the company logos shown on the job board. When you sign in, or your browser loads a company logo, Supabase processes your IP address and technical data to deliver the Service and secure the sign-in.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure service).

5.11 Feedback

If you send us feedback by email or through our feedback form (Google Forms), we process what you send to read and answer it. When you uninstall the Extension, Chrome opens a goodbye page on the Website; no data about you is attached to it.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering you and improving the Service).

5.12 Chrome Web Store (Google)

The Extension is distributed through the Chrome Web Store under Google’s own terms.

6. How the Extension Works with Web Pages

The Extension asks for the following Chrome permissions:

Permission	Used for
Access to the pages you visit	Detecting application forms and filling them with your profile
Active tab	Reading the job posting while the side panel is open
Side panel	Showing the cover letter, CV, and improvement flows
Storage	Keeping your data on your device

To detect application forms, the Extension looks at the form fields on the pages you visit. This happens locally in your browser. Nothing about the pages you visit is sent to us or anyone else, except that the Extension reports an error in its own code with the page’s domain and path (see 5.9), and, if you turned on usage statistics, counts which application system a form you filled belongs to (see 5.8). When the Extension finds a form, it offers to fill it, and it fills the form only when you choose to. While the side panel is open, the Extension reads the job posting in your active tab to check whether it can draft for it; the posting leaves your device only when you start a cover letter or open Draft CV (see 5.1 and 5.2).

The Extension accepts messages only from job.fail, to sign in and out with the Website and to return from checkout.

When you fill a form, your data is entered into the page of the employer or job platform. What happens once you submit it is governed by their privacy policy.

7. Data Recipients and Transfers

Depending on the features you use, data may be processed by:

Cloudflare (Website and server hosting)
Supabase (account, database, sign-in, and company logos)
Google (sign-in if you choose Google, PDF export and sending emails on Google Cloud, Google Analytics if you consent or turn on the Extension’s usage statistics, Google Forms if you use the feedback form, Chrome Web Store)
LinkedIn (sign-in if you choose LinkedIn, and importing your job and education history from your LinkedIn profile)
OpenRouter and the providers it runs the AI models on, including Microsoft Azure for GPT-6 Luna, the providers of Anthropic’s Claude, and TypeSafe AI for Jev (drafting with job.fail tokens, core skills, and reading and scoring your jobs)
Stripe (purchases and the subscription)
Lettermint (emails)
Sentry (error reports)

Data is shared only to the extent technically necessary for the feature you use.

Some of these providers are based in, or process data in, the United States. Where data is transferred outside the EU/EEA, the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. Children

The Service is intended for users aged 16 and older. It is not directed at children, and we do not knowingly collect data from users under 16.

9. Your Rights

Under GDPR, you have the right to:

Access your data (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Deletion (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR)
Withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)
Lodge a complaint with a supervisory authority (Art. 77 GDPR)

You can view, change, export, and delete your profile in the Extension’s settings, your essential fields, your job and education history, your job alerts, and your email settings in the settings of the Extension or the Website, and your CVs in the CV editor. You can delete your account in the settings of the Extension or the Website. For anything else about data held in your account, contact us using the address below. Data held by the providers listed in section 7 can also be addressed via their respective channels.

10. No Professional Advice

The Service, the AI-generated text it produces, and its core skills, Recruitability scores, fit scores, job suggestions, and CV tips do not constitute career, legal, or other professional advice. Generated text may be inaccurate, incomplete, or fabricated. Review everything before you submit it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on this page. Material changes will be communicated on the Website or in the Extension.

12. Contact

For privacy-related questions:

Email: hi@christiankonrad.co
Developer: Christian Konrad