Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name and email address through Firebase Authentication (Google OAuth or email/password sign-in).

Profile Data

You provide resume text, work experiences, skills, projects, and certifications. This data is stored in your user profile to power job matching and resume optimization.

Job Data

Jobs you manually add or import are stored alongside AI-generated analyses, match scores, and keyword extractions.

Match Previews Without an Account

On the job posting checker you can paste resume text to preview your match for one job before signing up. We send that text and the job description to our AI provider (Google Gemini) once to calculate the score, then discard it. We do not store the resume text or the job link, and we do not write either to our logs.

Job Age Checker

When you paste a job posting link into the free Job Age Checker at /check, we fetch that one posting, either from the job board's own public API (Greenhouse, Lever, Ashby, SmartRecruiters, Workday, Workable, Teamtailor, JazzHR, Breezy, Recruitee, or BambooHR) or, for other company career pages, with a single read of the page itself, looking only for its structured job-listing data (the schema.org JobPosting format most job boards publish). This works without an account.

When we can't read a posting's date ourselves, we may send the job link, and only the job link, to a third-party date-lookup service, and show the date it returns labelled as coming from a third-party source. Nothing else is sent: no account data and no IP address of yours.

We store the result (the posting's title, company, dates, and whether it is still open) under a one-way hash of the link, so checking the same link again is instant and does not fetch it twice. We reuse a stored result for up to 6 hours for an open or unclear posting, or 24 hours for a closed one; after that, checking the link again fetches it fresh. Separately, we keep a small, anonymous log of each check (the same hash, the job board, the dates, and whether the posting was open) to see how the tool performs across job boards over time. That log never includes the link itself, your IP address, or the job's title.

We do not check LinkedIn or Indeed links. If you paste one, we ask you to paste the company's own application link instead, and we never fetch a page from LinkedIn or Indeed on your behalf. A LinkedIn short link (lnkd.in) is followed only to find the address it points to.

The Job Age Checker itself never uses AI, and using it does not require or create an account.

Usage Data

We track which features you use (analyses, resume rewrites, cover letters, automated applications) for subscription billing and service improvement.

2. How We Use Your Information

• Provide AI-powered job matching, keyword extraction, and match scoring
• Generate optimized resumes and cover letters tailored to specific roles
• Store your profile for consistent matching across sessions
• Track token usage for subscription billing and tier enforcement
• Improve matching algorithms and service quality

3. Data Storage and Security

Your data is stored securely in Google Firestore with encryption at rest and in transit. User profiles, job data, analyses, and billing records are kept in your personal Firestore document and subcollections.

Some data is also stored locally in your browser via localStorage (Zustand store persistence), including your profile, settings, job list, and cached analysis results.

4. Third-Party Services

Cursu integrates with the following third-party services:

• Google Gemini — Your resume text and job descriptions are sent to Google Gemini for AI analysis, resume optimization, and cover letter generation. Data is processed per Google's API terms and is not used to train their models.
• Firebase (Google Cloud) — Authentication, database storage, and cloud functions for background processing.
• Google reCAPTCHA and Firebase App Check — To protect Cursu against abuse such as automated scraping and spam, the website uses Firebase App Check with Google reCAPTCHA v3. reCAPTCHA runs in the background on our pages and collects hardware and software information, such as device and browser data, which it sends to Google for analysis. Its use is subject to the Google Privacy Policy and Terms of Service.
• Stripe — Payment processing for subscriptions. We do not store your credit card details; Stripe handles all payment data directly.
• Sentry — Error tracking in production to identify and fix bugs. Personal data is automatically redacted from error reports.

5. Cursu — Job Search Assistant Browser Extension

Cursu — Job Search Assistant is an optional Chrome extension with two parts. One adds a job posting to your Cursu account when you click "Add to Cursu" on it. The other fills application forms on supported job boards with details you already confirmed in Cursu. Neither is required to use Cursu, and neither does anything until you click something. This section describes exactly what each part does with your data. The first subsections below cover autofill; job capture is described after them.

What autofill reads

On the job board domains listed below, and nowhere else, autofill reads the application form: field names, labels, input types, the options a dropdown offers, and whether a field already holds a value, so that it never overwrites something you or the site already entered. Autofill reads the form, not the page around it (job capture, described below, reads the page you click "Add to Cursu" on). It does not read your other tabs, your browsing history, or any site that is not listed below.

The job board domains are boards.greenhouse.io, job-boards.greenhouse.io, boards.eu.greenhouse.io, job-boards.eu.greenhouse.io, jobs.lever.co, jobs.eu.lever.co, and jobs.ashbyhq.com. A second, smaller script runs on the Cursu app itself; its only job is to hand the extension the job you clicked Apply on and a short-lived sign-in token. It reads nothing else on the page.

What autofill writes

It writes the contact details you confirmed in Cursu — first and last name, email, phone, location, and your profile links such as LinkedIn, GitHub, or a personal site — into the form fields it matched to them with high confidence, and it attaches the tailored resume you approved for that job. Where it is not confident, it leaves the field untouched and lists it under "Needs you" in a panel it shows on the page. It never submits an application and never clicks a Next or Continue button. You review what was filled and submit the form yourself.

What autofill stores

Two things, both in browser session storage, which is cleared when you close the browser and is never written to disk or synced between your devices:

• A short-lived Cursu sign-in token. It is also cleared when you sign out of Cursu, and it expires on its own about an hour after it is issued.
• The job id and application URL for a tab the extension opened on your behalf. This entry expires on its own and is removed when that tab closes.

Nothing else for autofill. Your profile, your resume, and the values it fills are not kept by the extension: they are requested from Cursu for one application and discarded. (Job capture can keep a job waiting on your computer; see "When a job can't be added right away" below.)

What leaves your browser after a fill

After a fill, the extension sends Cursu one reliability report about that run: which job board it was and the job board hostname, how long the run took, how many fields were found, matched, filled, skipped, and failed, the reasons fields were skipped, which matching strategies were used, which standard fields were filled by name (for example "email"), whether you edited a filled field afterwards, whether the resume attached, and the version numbers of the rules that ran. This is what tells us a job board has changed its form.

A field it did not recognize is reported as a one-way hash of its label plus a word count. That is enough to see the same unrecognized question recurring, and not enough to read the question back.

The report never contains the value of any field, the text of any label, placeholder, or dropdown option, the job id, the employer, your resume or its filename, the page address beyond the job board hostname, or the text of any error. Nothing you type is transmitted to us by the extension.

What autofill never does

• It never answers demographic, EEO, race, gender, disability, or veteran questions; work authorization or visa sponsorship questions; criminal history questions; government identifier fields such as a Social Security or national insurance number; salary or compensation questions; availability or start date questions; "how did you hear about us" questions; or consent and attestation fields. It detects these and deliberately leaves them blank for you.
• It never ticks a checkbox or selects a radio button on your behalf.
• It never writes a free-text response, such as a cover letter box or a "why do you want to work here" question.
• It never fills a hidden, disabled, or read-only field, and it never fills the invisible decoy fields some job boards use to catch automated form filling.
• It never submits an application.
• It never reads or fills a form on any website outside the domains listed above.
• It never sells or shares your data, never uses it for advertising, and sends no data to any third party. The only places your details go are the form in front of you and the Cursu servers described above.

A note about other extensions and scripts

The Cursu site hands the extension a sign-in token when you start an application. Any script running on the Cursu site can ask for one the same way, and so can another browser extension you have granted access to the Cursu site, because an extension with access to a page can run scripts on it. This is a property of the browser rather than something the extension can prevent, and it is true of every site you sign in to. Only install browser extensions you trust.

Removing it

Uninstalling the extension from your browser removes everything it stored. Signing out of Cursu clears its token. Cursu works without the extension.

What job capture reads

When you click "Add to Cursu" (the toolbar button or its keyboard shortcut), the extension reads the job posting on the page you clicked on: its structured job listing data if the page provides one (the schema.org JobPosting format most job boards publish), the main text of the page, its social-preview tags, and, only to recognize a job board embedded in the page (such as a Greenhouse or Ashby form loaded inside an employer's own site), the web addresses of the page's embedded frames and scripts. It never reads the text or addresses of your other tabs.

When you right-click a link and choose "Add link to Cursu", the extension reads no page content at all. It sends only the address of that link, and Cursu fetches the posting the same way it does for a link you paste into the app.

It reads only the page you clicked on, only at the moment you click, and only once per click. It does not run in the background, and it does not watch pages you have not clicked Add on.

On LinkedIn and Indeed, it reads none of this. It reads only the web address of a direct "Apply on company site" link on the page, if the posting has one, so it can add that link instead. If there is no such link, it adds nothing and tells you to open that link yourself and click Add there. We are still working out with our legal counsel whether reading more of a LinkedIn or Indeed page is something we should do; until that is settled, we do less, not more.

Where job capture sends it

What was read is sent once, directly to Cursu's own servers, to parse into a job in your list. It is not sent to any other company, used for advertising, or used to train a general-purpose AI model beyond parsing the one job you asked us to add. The web address of the page you clicked on is sent along with it, so Cursu can store it as the job's link and, on a later visit, recognize you've already added it.

When a job can't be added right away

If you're signed out, your sign-in has expired, you're offline, our servers are briefly unavailable, or you've used your plan's AI allowance for the period, the job is kept on your own computer instead, in the browser's local extension storage, which is not synced to your other devices and is never sent anywhere on its own. Up to 50 jobs can wait there at a time. Each one is tried again automatically the next time you're signed in to Cursu with a working connection, and it is removed from local storage as soon as that succeeds. A job that has waited 30 days without succeeding is deleted automatically. You can also dismiss a waiting job yourself at any time, which deletes it from local storage without sending it anywhere. Uninstalling the extension deletes anything still waiting.

What job capture never does

• It never adds a page you didn't click a button or link for. There is no "add everything on this search results page," and it never runs without you clicking something first.

Limited Use

The extension's use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• We use the data the extension handles only to provide and improve the job capture and autofill features you asked for.
• We do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We never use it for advertising, and we never sell it.
• No human reads it, except with your explicit consent, to investigate abuse or a security incident, or where the law requires it.

6. Cookies and Local Storage

Cursu itself uses browser localStorage (not cookies) to persist your application state, including:

• User profile, settings, and onboarding status
• Scraped job data and cached AI analyses (24-hour staleness window)
• Firebase authentication session tokens
• How you found us (described below)

Google reCAPTCHA (see Third-Party Services) may set its own cookies and use local storage to tell people from automated traffic. Cursu doesn't read them.

How you found us

When you first land on the site, we store, in your browser only: any campaign tags in the link you clicked (if any), the general source of your visit (for example, a search engine, Reddit, or a link from another site, stored as just the site's domain, never the full page you came from), which page you landed on, and a random id that isn't tied to your name or account unless and until you sign up. This is stored for 90 days and refreshed each time you visit. It is not a cookie, and no other company can read it.

If you create an account, the two touches we have on file (how you first found us, and how you found us most recently, if different) are copied once onto your account, so we can tell which channels bring people who actually sign up. After that copy, this information on your account doesn't change, even if you visit again from somewhere else.

We also record a small number of events as you use the site, for example that a page was viewed or that a checker result was shown. Each event is tagged with the random id above and, once you are signed in, your account id. Events never include your name, your email, or the job link you checked. They help us understand which channels bring visitors who go on to sign up; they are not shared with, or bought from, any advertising company, and there is no cross-site tracking id that follows you to other websites.

To clear this: clearing your browser's site data for Cursu removes it, the same way it removes your other locally stored Cursu data above. If you'd like the copy already saved on your account deleted, contact us the same way you would to delete any other account data (see "Your Rights").

7. Data Retention

• Account and profile data — Retained until you delete your account.
• Token usage events — Server-side audit logs retained for 90 days.
• AI analyses — Cached locally with a 24-hour staleness window; server-side copies retained with your account.
• Billing records — Retained for 13 months per standard accounting requirements.

8. Data Sharing

We do not sell, rent, or share your personal data with employers, recruiters, or data brokers. Your job search activity remains private. Data is only shared with the third-party service providers listed above, strictly for the purpose of delivering the service.

9. Your Rights

• Access: You can view and export all your data at any time through your profile settings.
• Correction: You can update your profile, resume, and other information at any time.
• Deletion: You can delete your account and all associated data. Contact us if you need assistance with complete data removal.
• Portability: Your resume and profile data can be exported in standard formats.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notice. Continued use of Cursu after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, contact us at support@cursu.ai.