Privacy, in plain English
Effective 11 September 2026. ApplySidekick is independently operated. Contact: support@applysidekick.com.
Your saved copy stays on your device
Your profile, reusable answers, CV and application history are saved in this browser. A free email-and-password account is required for real applications. Account details are described below. ApplySidekick has no advertising trackers. Our aggregate traffic reporting is described below. Local storage and exported profiles are not encrypted by this application; protect access to your device and exported files.
Cloud mode: what leaves your device
When you agree to cloud processing and start a job, your saved answers are sent over HTTPS through Cloudflare to fill the employer’s page in a remote browser. Your CV is sent when you choose Attach saved CV or enable auto-apply with a saved CV. We do not save your profile or CV in D1 or Durable Object storage, and do not send them to an AI service. Cloudflare processes the running browser session. Session recording and application request logging are disabled in our deployment.
A live-view link gives access to that application session. Keep it private. The browser closes after two minutes per job; its working state is not saved for later resumption. The employer and its scripts can read or autosave fields and files before you submit. Their privacy notice applies to that processing.
Optional extension
The extension receives your profile locally and fills matching fields on permitted employer pages. It does not send profile answers to ApplySidekick’s backend and does not receive your saved CV; attach that yourself on the employer page. Its working profile is cleared after completion, stop or browser shutdown.
Allowance, security and spending records
Cloudflare handles your IP address and request metadata to serve and protect the site. The application stores daily keyed hashes of your random device ID and IP network, batch IDs, counts and timestamps. Cloud batches also store job URLs, progress, question labels and browser identifiers for recovery; never put personal details in job URLs. Profile answers, CV contents and live-view links are not saved in these records. IP rate limiting and daily limits help prevent abuse; they do not identify a unique person.
Retention and deletion
Allowance records are removed after approximately four days. Cloud batch metadata is removed three days after completion; inactive batches close after one day. The shared browser-time budget keeps pseudonymous start records for up to 32 days. Cloudflare’s service metadata and backups may have separate retention under its terms. Deleting local data removes your saved profile, CV and history from this browser; it does not erase submissions already sent to employers or immediately remove security and budget records. Your random device ID and current allowance are retained unless you clear this site’s browser storage.
Optional equality answers
Equality and diversity answers are optional and are not guessed or preselected. They are excluded from cloud profile transfers unless you explicitly enable sharing. When enabled, your chosen answers are processed in cloud mode and filled only for recognised matches. You can withdraw that choice for future applications at any time; this does not remove information already shared with an employer.
Why we process information
We process the details you choose to share to provide the application assistance you request, and keep limited security, allowance and budget records to protect the service. Cloud processing is optional and requires your agreement. Cloudflare is our hosting and browser-processing provider; data may be processed internationally under its applicable data-protection terms.
Questions and privacy requests
Contact support@applysidekick.com to ask about access, correction or deletion of information we hold. Most profile information is held only in your own browser and can be changed or deleted there. You may also contact your local data-protection regulator. For UK users, this is the Information Commissioner’s Office.
Accounts and subscriptions
Our legal seller is the controller of account information. Supabase verifies your email and securely hashes your password. Passwords are sent over HTTPS to authenticate or create your account and are not stored in the ApplySidekick database, saved profile or browser storage. We store your account ID, email, hashed session token, subscription and checkout references, acceptance of subscription terms and billing status in Cloudflare D1 to provide your account and subscription. Stripe processes payments and card details; we do not store card numbers. Free and paid allowance records are linked to your account across devices. Device and IP-network checks continue to protect daily allowances. Password reset signs out existing ApplySidekick sessions. A necessary secure session cookie expires after 12 hours. Your CV and answers are not copied into your account. We retain account records while your account is active and payment, consent and dispute records as needed to fulfil contracts, resolve claims and meet legal accounting requirements. Contact support for deletion requests; records that must legally be kept cannot immediately be removed. Expired sessions and sign-in rate limits are cleaned periodically, and processed billing event identifiers are kept for up to 30 days. Supabase, Cloudflare and Stripe may process information internationally under their data-protection safeguards. In clearly labelled test mode, never enter a real card.
Optional auto-apply
When you enable auto-apply for a cloud batch, you authorize the service to fill and submit your selected supported applications using your saved answers and any saved CV. Check these before starting. Some employer layouts need manual review. Missing answers pause the run; CAPTCHA-blocked jobs are skipped, not submitted. Confirmed submissions close promptly and the next queued job starts while this workspace stays open. Browser time already used still counts toward shared capacity.
Automatic Submitted status requires detected employer confirmation. If confirmation is unclear, the job needs your attention and is never automatically submitted a second time. Check with the employer before retrying. Manual mode remains available. Use Stop batch to stop the remaining run.
Traffic and owner reporting
We count page views by day, approximate country, page and a broad traffic source such as Instagram or Google. Country is estimated by Cloudflare from the connection; we do not collect GPS location or save raw IP addresses, full referrer URLs, query strings, visitor IDs or cookies for this reporting. Views are not unique people. We honour Do Not Track and Global Privacy Control signals; blocking scripts also prevents these counts. Referrers and optional source tags can be missing or inaccurate, and some automated traffic may remain.
For 90 days, our private owner dashboard also retains account-linked batch counts, attempts used, and cloud outcome totals to operate and improve the service. It contains no CVs, answers or employer URLs. Automatic confirmation and user-reported submission are distinguished. Account and billing records keep their existing retention periods. Older detailed operational records still expire as described above.