Skip to content

Privacy Policy

Last updated: October 23, 2026

ShouldApply (“we,” “our,” or “us”) is operated by Jesse Johnson, doing business as The Dope Art. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application at shouldapply.com (the “Service”). Please read this policy carefully. By using the Service, you agree to the practices described herein.

1. Information We Collect

Account Information

When you create an account, we collect:

  • Email address
  • Full name (if provided)
  • Avatar/profile picture (if uploaded or provided via OAuth)
  • Authentication credentials (managed securely via Supabase Auth)

Profile & Resume Data

To provide job matching, we collect information you voluntarily provide:

  • Resume text (extracted from uploaded documents)
  • Skills, job titles, and professional experience
  • Years of experience
  • Location and desired work locations
  • Minimum salary preferences
  • Search radius preferences
  • Dealbreaker settings (e.g., work authorization, remote preferences)

Voluntary Self-Identification (Optional)

The equal employment opportunity questions that appear on some job applications (gender, Hispanic or Latino identity, race or ethnicity, veteran status, disability status) are optional, and declining is always allowed. If you choose to store answers so the extension can fill them in, they are kept only in the ShouldApply Chrome extension on your own device. We do not collect them, and the extension never transmits them to us or to anyone else.

  • Earlier versions of ShouldApply saved these answers to your account. The extension moves any saved copy to your device and then asks our servers to delete it. You can also delete it yourself from Settings, then Self-identification
  • They are never sent to the Gemini API, and are never used for scoring, resume tailoring, or screening-question answers
  • They are never used to rank, filter, or score you, and never shared with employers by us
  • Autofill is off by default. When it is on, the extension enters your stored answer into an application form only when it exactly matches an option that form offers
  • You can delete them any time from the extension’s Settings tab, and uninstalling the extension removes them

Job & Scoring Data

When you use the Service to evaluate jobs, we store:

  • Job descriptions you submit or search for
  • AI-generated match scores and analysis results
  • Your save, archive, and interaction history with jobs
  • Notes you attach to jobs

Job Posting Data

We aggregate job postings from third-party job boards (JSearch, Remotive, Adzuna, Wellfound) to build the job pool users search against. These postings are publicly available listings, not private user data.

Automatically Collected Information

  • Browser type and version
  • Pages visited and features used
  • IP address (for security and analytics). When you create an account we also store the IP address you signed up from, to catch fake and duplicate accounts
  • Cookies and similar technologies (see Section 6)

ShouldApply Chrome Extension

Our Chrome extension (“ShouldApply - Job Fit Scores & Autofill”) only works on the job sites it lists in the Chrome Web Store, and only after you connect it to your ShouldApply account and agree to a notice in the extension that lists what it reads. Until you agree, it sends nothing from any page. You can turn page data sharing off again in the extension’s Settings tab.

What the extension reads and sends to shouldapply.com:

  • The job posting you’re viewing: on supported job boards (LinkedIn and Indeed) and employer application sites. When a posting opens, its page URL, title, and company, so we can show whether it’s already in your dashboard. When you press Scan, also its location, description, salary if shown, applicant count, and date posted, so we can score it against your profile
  • Application status: the status you set for a job (for example Saved or Applied), and a record that you submitted an application after the extension filled it in, so your dashboard stays in sync
  • Sign-in wall signals: on supported apply pages, whether the page asks you to create an account or sign in, and which sign-in options it offers (for example “Sign in with LinkedIn”), with the page address minus its query string. This is read-only. The extension never reads what you type into a password field and never fills in or submits a login form

Posting text you scan may also be added to our shared job database, without anything that identifies you, so other members see the same posting and its details.

What the extension receives from shouldapply.com:

  • Your profile details (name, email, phone, location, links, work history, salary expectation, screening answers) and your resume and cover letter files, used only to fill in an application form when you click autofill. It fills the form on the page; you review it and click the site’s own submit button

What the extension stores on your device (in Chrome’s local extension storage): your ShouldApply sign-in token, a cached copy of your profile, your theme choice, your cached apply queue, and up to 5 application drafts you’ve reviewed, including their resume files. You can clear reviewed drafts from the extension’s Settings tab, and uninstalling the extension deletes all of it.

Voluntary self-identification answers are stored in the same local extension storage, only if you enter them, and stay on your device. The extension never transmits them. We receive nothing about them.

What the extension doesn’t collect: your browsing history, pages on sites it doesn’t support, passwords, what you type into forms, or files on your computer. We don’t sell extension data, use it for advertising, or use it for anything other than scoring jobs and filling out applications you choose to fill out. Our use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and improve the Service
  • Generate AI-powered job match scores by comparing your profile and resume against job descriptions
  • Personalize your experience and surface relevant job insights
  • Communicate with you about your account, updates, and support requests
  • Detect and prevent fraud, abuse, and security incidents
  • Comply with legal obligations

3. AI & Third-Party Data Processing

We use Google’s Gemini API to generate job match scores and analysis. When processing your data through the Gemini API:

  • We send only the minimum data necessary (relevant resume excerpts and job description text)
  • Data sent to the Gemini API is processed according to Google’s API Terms of Service
  • We do not use your data to train AI models
  • Voluntary self-identification answers (gender, race or ethnicity, veteran status, disability status) stay on your device in the extension and never reach the Gemini API or us
  • AI-generated results are stored in our database so we do not need to re-process the same data

4. Data Storage & Security

Your data is stored securely on Supabase, which provides:

  • SOC 2 Type II compliance
  • AES-256 encryption at rest
  • TLS encryption in transit
  • Row-Level Security (RLS) ensuring users can only access their own data
  • Regular security audits and monitoring

While we implement industry-standard safeguards, no method of electronic storage is 100% secure. We cannot guarantee absolute security but will notify affected users within 72 hours in the event of a data breach.

5. Data Sharing

We do not sell, rent, or trade your personal information. We may share data only in these cases:

  • Service providers: Supabase (hosting/database), Google Gemini API (AI processing), Vercel (hosting), Stripe (payment processing), and Resend (email delivery service, receives your email address and message content for transactional and product emails). Each bound by their own privacy commitments
  • Map providers: The job map loads map tiles from OpenFreeMap (built on OpenStreetMap data), or from OpenStreetMap's own tile servers if your browser can't draw the vector map, and looks up some job locations through OpenStreetMap Nominatim. Your browser contacts them directly, so they receive your IP address and the map area or place name being requested
  • Legal requirements: When required by law, subpoena, or government request
  • Safety: To protect the rights, safety, or property of our users or the public
  • Business transfers: In connection with a merger, acquisition, or sale of assets (you would be notified)

6. Cookies & Analytics

What runs depends on where you are. We read your region from your IP address when a page loads and keep the result in a cookie for one day. If you can't be placed, we treat you the way we treat visitors in the European Economic Area, the United Kingdom, and Switzerland.

Visitors in the EEA, the United Kingdom, and Switzerland

We show a cookie banner. Google Analytics (through Google Tag Manager), the Meta Pixel and Meta Conversions API events, Microsoft Clarity, and the ad attribution cookies described below start only after you click OK. Before you answer, these do run:

  • Google Tag Manager loads, with Google's analytics and ad storage set to denied. Google's tags follow that setting until you click OK.
  • The Ahrefs Web Analytics script loads. It does not wait for your answer.
  • Vercel Analytics loads for page performance. It does not wait for your answer.
  • Our own page view counts run in anonymous form: no user ID, session ID, hashed IP, or browser user agent. They keep UTM tags and the referring site's domain.
  • Essential cookies: sign-in and session cookies, the region cookie above, and the cookies that remember your cookie choice.
  • Security cookie: a random device ID (sa_did, up to 400 days) that lets us limit scoring abuse and spot multiple accounts made from one browser. It holds no personal information and is not used for advertising.

Decline, or Global Privacy Control in your browser, keeps Google Analytics, the Meta Pixel, Clarity, and ad attribution off. If you click OK, they start right away without a reload. Ad attribution cookies are only written after you click OK, so the landing page, referrer, and campaign tags from visits before that aren't saved.

Everywhere else

There's no banner. Tracking is on by default, the way most US sites work. You can turn it off any time with the Cookie settings link in the footer, or by turning on Global Privacy Control in your browser. Either one turns off the Meta Pixel, the Meta Conversions API events, Microsoft Clarity, and Google Analytics all at once, and our own page view counts switch to the anonymous form above. Essential cookies aren't affected.

Changing your answer

The Cookie settings link in the footer opens a dialog where you can click OK or Decline at any time, from any region. Your answer is saved in your browser. If your browser sends Global Privacy Control, we treat that as your answer, and the dialog says so instead of offering OK.

What we use

  • Analytics: Google Analytics to understand how the Service is used (anonymized/aggregated data), Vercel Analytics for page performance, and Ahrefs Web Analytics for page views.
  • Advertising (Meta Pixel and Conversions API): We use the Meta (Facebook/Instagram) Pixel in your browser and its server-side Conversions API to measure the ads we run. These send Meta page views and specific events (account signup, purchase) along with a hashed version of your email or user ID, the _fbp and _fbc cookies, your IP address, and your browser's user agent string. Meta uses this to tell us whether an ad led to a signup or purchase; we don't use it to build a profile of you outside that measurement. You can also opt out directly through Meta's own ad preferences page.
  • Microsoft Clarity: Clarity records mouse movement, clicks, and scrolling so we can see where people get stuck. We mask the signed-in app (resumes, job data, and other personal content aren't recorded), and we never load it on admin pages.
  • Preferences: Local storage to save your theme preference (light/dark mode)
  • Ad attribution: If you land on the site from a specific ad or link, we remember which one and save it with your account when you sign up, so we can tell which ads bring in real users. This follows the same choice as the tools above.

You can also disable cookies in your browser settings, though some features may not function properly.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate information in your profile
  • Delete your account and all associated data
  • Export your data in a portable format
  • Opt out of non-essential data processing

To exercise any of these rights, contact us at mail@shouldapply.com. We will respond within 30 days.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information.

European Residents (GDPR)

If you are located in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR), including data portability (Article 20) and the right to lodge a complaint with a supervisory authority. Our legal basis for processing is your consent (provided at account creation) and legitimate interest in providing the Service.

8. Data Retention

We retain your data for as long as your account is active. Specifically:

  • Account & profile data: Retained until you delete your account
  • Job scoring data: Retained until you delete your account or remove individual jobs
  • Archived jobs: Automatically removed after the period you set in your preferences (default: 14 days)
  • Server logs: Retained for up to 90 days for security and debugging

When you delete your account, all personal data is permanently removed from our systems within 30 days, except where retention is required by law.

9. Children’s Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

← Back to home