Legal
Privacy Policy
Last updated: June 28, 2026
canvasjob helps users evaluate job postings against their preferences and keep track of applications. This policy explains how the canvasjob website and Chrome extension handle information.
1. Scope and contact
This Privacy Policy applies to the canvasjob Chrome extension and the web application available at https://www.canvasjob.com.
For privacy requests or questions, contact canvasjob@gmail.com.
2. Information we handle and why
Account and authentication information
We process your email address, account identifier, login method, and authentication session information so you can create an account, sign in, and securely access your data. Authentication is provided through Supabase. If you choose Google sign-in, Google participates in that sign-in flow.
Filter profiles and preferences
We store the profile names and free-text job criteria you create, their order, active status, and enabled state so canvasjob can apply your chosen criteria to job postings.
Job evaluation information
When the extension evaluates a supported job page, it processes the job source and identifier, title, company, location, URL, description, your applicable filter criteria, and the generated results. The backend sends the job description and criteria to the configured AI provider, Anthropic or OpenAI, to produce the verdicts and evidence shown in the side panel. We store evaluation results, job metadata, usage counts, and caching information to operate the feature and avoid unnecessary repeat AI calls.
CV and job-fit information
If you upload a CV for the job-fit feature, the backend sends its text to the configured AI provider, Anthropic or OpenAI, to extract a non-identifying professional profile — skills, years of experience, seniority, generic role titles, domains, education level, languages, and a short summary. We store only that profile. The uploaded file and its raw text are processed in memory and are not stored, and the profile deliberately excludes your name, contact details, and the names of specific employers or schools. When you open a job, your profile and the job description are sent to the provider to produce a match score with strengths and gaps, which we cache to avoid repeat AI calls. You can view, edit, or delete the profile at any time. If you also use the cover-letter feature, your CV's contact details may be read once to pre-fill the cover-letter fields you have left blank.
Diagnostic AI call records
To operate and troubleshoot the AI features, restricted backend diagnostic records may include the AI prompt and output, which can contain job descriptions, your filter text, your non-identifying CV profile, and your cover-letter instructions — your raw CV text and contact details are redacted — along with provider, model, cost, duration, status, and timestamp information.
Extraction diagnostics
Supported job pages change their layout frequently, which can stop the extension from reading a listing. When that happens, the extension automatically sends a diagnostic report so we can detect and fix the breakage quickly. The report contains technical telemetry — which page elements the extension could and could not read, the extractor version, the page address and title, and your browser's user-agent — together with a sanitized snapshot of the job-posting section of the page. That snapshot keeps the page structure and the listing's own text (the same kind of public job content already used to generate evaluations) so we can locate where the information moved, but it is processed on your device to exclude LinkedIn's navigation, feed, and messaging areas and to remove images and personal details — including your own name and profile, and any email addresses or phone numbers — before it is sent. At most one report is sent per browsing session. The backend analyzes the report with the active AI provider and stores the result in restricted diagnostic records for troubleshooting.
Tracked applications and information you add
When you click Track this job or add a job manually, we store the job title, company, location, URL, source, original description, application status, dates and deadlines, notes, contact details you enter, and interview schedule details. This information powers your tracker, calendar, and job-detail views.
Cover-letter details and generated letters
If you use the cover-letter feature, we store the details you provide for it — your name, contact details, location, and your default writing instructions (which may include achievements you want emphasized) — so we can produce a complete, ready-to-send letter with your header and signature. To save you typing, when you upload a CV we may read its contact details to pre-fill any of these fields you have left blank. When you generate a letter, your job description, your stored CV profile, and your instructions are sent to the configured AI provider, Anthropic or OpenAI, to write it. The generated letter is returned to your browser for download and is not stored on canvasjob servers.
Plan, usage, and billing information
We store your plan, monthly usage totals, and subscription status to apply account limits and provide Pro access. If you choose a paid subscription, Stripe processes payment and billing details; canvasjob stores associated Stripe customer and subscription identifiers and billing status.
Technical information
The website and API hosting providers may process standard technical information associated with requests, such as IP address, browser or device information, request time, and diagnostic logs, in order to provide, protect, and troubleshoot the service.
3. Chrome extension disclosures
The Chrome extension runs on supported LinkedIn job pages at https://www.linkedin.com/jobs/*. It reads the visible job-listing information needed for its user-facing job evaluation and tracking features. canvasjob does not use that access to build a general browsing-history profile or to serve advertisements.
The extension uses Chrome local storage to keep your authentication session, onboarding preferences, and the most recent evaluation shown in the side panel. That most recent local evaluation can include the scraped job information and its results. Local extension data remains in your browser until it is replaced, cleared, or the extension is removed.
If a supported job page changes in a way that prevents the extension from reading it, the extension automatically sends us a diagnostic report so we can fix the breakage quickly. As described under Extraction diagnostics above, that report contains technical telemetry plus a sanitized snapshot of the job-posting section — processed on your device to exclude LinkedIn's navigation, feed, and messaging, and to remove images and personal details such as your name, profile, and any emails or phone numbers — and is limited to at most one report per browsing session.
5. Retention, deletion, and security
Your account, saved filters, tracker data, and related application records are kept while your account is active or until you remove them. You can delete tracked jobs, contacts, and interview records from the web application. Deleting a tracked job also removes the contacts and interview records attached to that job. Your uploaded CV's professional profile and the job-fit results derived from it are kept until you delete your CV — which removes both — or your account. Cover-letter details you save are kept until you change or remove them; generated cover letters are not retained by canvasjob.
Evaluation cache records and diagnostic AI call records are retained on canvasjob systems until they are deleted administratively or as part of account deletion. Stripe and other service providers may retain records under their own legal and operational retention obligations.
You may request access, correction, or deletion of your account and associated data by emailing canvasjob@gmail.com.
canvasjob uses HTTPS in transit, authenticated access to account features, and database access controls intended to limit each user to their own application data. No internet service can guarantee absolute security.
6. Chrome Web Store Limited Use disclosure
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Data collected through the extension is used only to provide or improve its user-facing job evaluation, filter-management, account, and application-tracking functions. Human access to user data is limited to cases where you give consent for support, where access is necessary for security or abuse investigation, where required by law, or where data has been aggregated and anonymized for internal operations.
7. Children
canvasjob is a job-search productivity service and is not directed to children under 13. We do not knowingly collect personal information from children under 13.
8. Changes to this policy
We may update this Privacy Policy as canvasjob evolves. We will post the updated version on this page and change the last updated date above. If a change materially affects how user information is handled, we will provide additional notice where appropriate.
9. Contact
Questions or privacy requests can be sent to canvasjob@gmail.com.