Privacy

Last updated: 2026-08-20

career-path is built so your resume stays yours. This page lists exactly what is stored and what is not, on the web app and in the browser extension.

What we never store

• Your resume file, or the text extracted from it.
• Job descriptions you paste, link, or screenshot.
• Tailored resumes — unless you sign in and click “Save this version”. The browser extension keeps a copy on your own device; see below.

These pass through our servers to reach the language model that processes them, and are not written to any database.

What we do store

• Usage counters — quota and rate-limit counts keyed by your account, an anonymous ID your browser stores for the web app, your IP address, or, for a signed-out extension, a device ID our server issues and signs into a token kept on your device. In the extension, that is the difference between 5 runs a day, counted against your account, if you are signed in, and 3 runs every 30 days, counted against that device ID, if you are not. We store a running count against each of these; we do not keep a directory of devices.
• Versions you explicitly save while signed in — deletable at any time from “My resumes”.
• Your email, plus an anonymous session ID and timestamp, if you join the waitlist.
• Aggregate model timing and token counts, with no user content attached.

The browser extension

The extension stores your resume in your browser’s local extension storage (chrome.storage.local). It is never written to our servers for storage — it is sent with a request only when you ask for an analysis, and is discarded once that request completes.

The extension also keeps the results it generates — the match analysis, the tailored resume, and anything you add about experience your resume omits — in that same local storage, each one keyed by the posting’s address, so up to 20 job-posting URLs are kept on your device alongside them. Returning to a job posting shows what it produced there before instead of charging you for it again. They are never uploaded, and the panel has a button that clears them — it shows how many are cached, and removes all of them.

If you sign in, signing out asks whether to also remove your resume and cached results from this device — the box is checked by default. Leave it checked and both are cleared from chrome.storage.local along with your session. Uncheck it and only your session ends; the resume and cached results stay on this device.

The extension reads the job posting on the page you are viewing, and only when you open the panel there. It does not read any other page, and it does not collect your browsing history. A background service worker exists only to keep your device sign-in token fresh and to open the side panel — it does not scan pages or run analyses on its own.

Third parties

Language models are accessed through OpenRouter. Sign-in is handled by Clerk. Usage counters, saved versions, and aggregate stats live in Upstash Redis. The site is hosted on Vercel.

For the browser extension, that Clerk relationship is direct: the side panel and its sign-in page contact Clerk’s servers over the network themselves, to authenticate you and keep your session current. That is different from OpenRouter, Upstash, and Vercel above, which our servers talk to on your behalf — the extension does not contact those directly.