Clear boundaries for your profile and application pages.

You choose when to connect

Joblet Apply Assist receives a limited copy of your Joblet profile only after you start the connection from the extension, sign in on Joblet, review the categories being shared, and explicitly approve the connection. If Joblet makes it available and you approve it, that copy may also include your primary PDF resume. Joblet authentication happens on joblet.ai; your password and login token are never messaged to or stored by the extension.

Profile and resume storage on your browser

After the profile is checked and reduced to the allowed fields, Joblet Apply Assist stores that copy in chrome.storage.local for this Chrome profile on this device. An optional PDF resume of at most 10 MiB and its safe metadata are stored together in extension-origin IndexedDB. You can select the PDF in the extension popup or explicitly approve an import when Joblet makes your primary resume available. The profile and PDF persist across Chrome restarts and Joblet Apply Assist updates. They are removed when you choose Disconnect, uninstall Joblet Apply Assist, or clear Joblet Apply Assist's extension data; you can also remove or replace the PDF separately. Clearing ordinary browsing history or cache does not remove extension data.

The saved profile and PDF are not synced to other devices, placed in application-page storage, or synchronized back to Joblet. Joblet Apply Assist is not available in Incognito mode and restricts its saved data to extension contexts. Browser-local extension storage is not a password vault; Joblet Apply Assist does not add separate application-level encryption to the saved profile or PDF.

The connection itself uses a random, one-use value tied to the Chrome tab that started it. That request is held in memory-backed chrome.storage.session for at most ten minutes. It clears sooner if Chrome restarts or Joblet Apply Assist is disabled, reloaded, updated, or removed, and it cannot be reused after a successful transfer.

What happens on an application page

Scanning and filling begin only when you choose Scan and fill active page. That one action examines field metadata, such as labels, names, input types, autocomplete purposes, and nearby form headings, freezes a safe fill plan, and fills eligible empty fields. The extension does not return or transmit the current values already present in those fields.

Ordinary scanning runs locally in the active page’s top frame. If that page embeds an application from exactly https://jobs.ashbyhq.com, Joblet Apply Assist first reports that access is needed. Only a separate Allow Ashby form access click can ask Chrome for that optional origin; declining leaves the frame unread and unchanged. After approval, Joblet Apply Assist sends a short-lived, one-use random challenge directly to the one rendered Ashby iframe and probes child-frame identity without profile or PDF data. It repeats that check immediately before transfer and proceeds only when the same unique child proves it received the fresh challenge and still matches the employer/job path. The challenge is never echoed through page messaging. Joblet Apply Assist does not add Joblet tracking code to employer application pages. The popup’s deliberate links back to Joblet can include Joblet Apply Assist campaign parameters so Joblet can identify extension-originated visits.

Filling stays under your control

Joblet Apply Assist fills only empty fields that remain safe and unchanged within the frozen plan. For a tightly paired split-phone widget, it may set the country-code selector to your profile's exact available dial-code option before filling the empty national-number input; if that option is unavailable or ambiguous, both phone controls stay unchanged. Generic uploads and cover-letter inputs stay untouched; only an explicitly identified resume/CV input can receive the validated PDF saved in Joblet Apply Assist. Joblet Apply Assist does not invoke page-control click or submission APIs. You must review every answer and submit the application manually.

When you choose Scan and fill active page, the selected profile values are written into the employer's application page. That site and its scripts can access them just as if you typed them, and its privacy terms apply. If Joblet Apply Assist assigns the saved PDF to a recognized resume input, it dispatches a file change event; the employer site may react by uploading the resume immediately, before you manually submit the application. Joblet Apply Assist itself never calls or clicks Submit.

Why Chrome asks for permissions

activeTab

Temporary access to the page you choose to scan.

scripting

Runs the scanner and filler only after your action.

storage

Keeps the approved profile for this Chrome profile on this device, stores the PDF and its safe metadata in extension-origin IndexedDB, and holds one-use connection state temporarily.

Optional Ashby access

Reads and fills an embedded jobs.ashbyhq.com application only after Chrome receives your separate approval.

Joblet Apply Assist does not request broad access to every website, required host access, browsing history, cookies, downloads, or file-system access. Chrome may retain approved Ashby access until you revoke it in Joblet Apply Assist’s site-access settings or uninstall the extension, but Joblet Apply Assist uses it only after you request a scan.

A connection bridge runs only in marked connection mode on https://joblet.ai/profile?extension=connect to transfer the profile you explicitly approve.

Limited use commitment

Joblet Apply Assist uses the connected profile and optional PDF only to provide the application-field assistance you request. The extension does not sell the connected data, use it for advertising or unrelated profiling, or transfer it to an employer page until you choose Scan and fill active page. Access is limited to what is necessary to operate, secure, and support this single purpose.