Skip to content
ApplyCoveApplyCove

Extension Privacy

What the ApplyCove browser extension collects and how it's handled, for both session sync and Job Matches auto-apply.

Last updated: June 2026

No portal passwords

The extension never asks for or stores your Naukri or LinkedIn password. It only mirrors a session you already created.

Applies on your device

For Job Matches, the extension fills applications on supported ATS pages (Greenhouse, Lever, Ashby) from your profile, on your own browser.

Delete any time

Disconnect a platform in the ApplyCove dashboard and the synced session is wiped from S3 immediately.

1. What the extension does

The ApplyCove browser extension has two functions, both started by you from a signed-in ApplyCove account:

  • Session sync (Naukri and LinkedIn). It mirrors a job-portal browser session you already created (cookies for Naukri or LinkedIn) to your ApplyCove account, so the cloud automation can apply on your behalf. Your portal password is never collected.
  • Job Matches auto-apply (ATS pages). When you pick a matched role, the extension opens that company's application page on its applicant tracking system and fills the form from your ApplyCove profile. This runs on your own browser. Supported ATS platforms today are Greenhouse (greenhouse.io), Lever (lever.co), and Ashby (ashbyhq.com), with more added over time.

2. Data we collect

  • Portal session cookies. When you click "Sync", the extension reads cookies on naukri.com or linkedin.com via the chrome.cookies API. This may include authentication cookies (for example nauk_at on Naukri or li_at on LinkedIn). For LinkedIn it also reads your public member id once via LinkedIn's own session to label the connection.
  • Portal localStorage. If a portal tab is open, the extension reads localStorage from that tab via chrome.scripting.executeScript.
  • ATS application form fields. On a supported ATS application page that you chose to apply to, a content script reads the page's form fields so it can fill them with values from your ApplyCove profile (such as name, email, experience, and screening answers). It acts only on the application page you opened from Job Matches.
  • ApplyCove auth token. The extension reads the existing refreshToken cookie set by api.applycove.com to authenticate requests. It is never copied or stored outside the cookie store.

3. What we do not collect

  • Your Naukri or LinkedIn password.
  • Your browsing history outside the explicitly synced portals and the ATS application pages you choose to apply to.
  • Cookies from any site other than naukri.com, linkedin.com, and api.applycove.com. The extension does not read or upload cookies from ATS sites; it only fills the application form there.
  • Your keystrokes, or anything you type on pages other than the application form being filled.

4. How it is stored

On upload, the Naukri or LinkedIn cookies and localStorage are encrypted with AES-256-GCM before being written to ApplyCove's S3 bucket. The decryption key is held only on ApplyCove's job worker, which uses the session to log in to the portal for automated applications. The blob is keyed by your user ID and the platform name (browser-sessions/<userId>/<platform>/session.json).

ATS application data is different: the values used to fill a Job Matches application come from your existing ApplyCove profile and are submitted to the employer's own application page. The extension does not capture, re-upload, or separately store the contents of ATS forms.

5. Retention

We retain a synced session until you remove it. From the Connected Accounts page in the ApplyCove dashboard, click Disconnect platform to wipe the encrypted session blob from S3 and clear the related session metadata on your account. Disconnect is immediate and permanent. There is no second "keep credentials, drop session" state because ApplyCove does not store portal credentials in the first place.

On your device, the extension uses chrome.storage.local only to keep a random anonymous install id that helps prevent abuse. It does not store your portal sessions, your ATS form data, or your access token there (the access token is held in memory only).

6. Sharing

We do not sell, rent, or share the captured session data with third parties. The data is accessible only to ApplyCove's automation worker, scoped to your account.

7. Permissions explained

  • cookies: read auth cookies on the supported portals and read ApplyCove's refresh-token cookie to authenticate requests.
  • scripting: read localStorage from an open portal tab, and run the applier on a supported ATS application page to fill its form from your profile.
  • tabs: find or open a portal tab, and open the application page for a match you selected.
  • storage: keep a random anonymous install id on your device. No portal session or form data is stored here.
  • sidePanel: show the ApplyCove side panel where you manage connections and matches.
  • notifications: show a toast when a sync or apply completes.
  • host_permissions on naukri.com / linkedin.com: required to read cookies and localStorage on the portals you choose to sync.
  • host_permissions on greenhouse.io / lever.co / ashbyhq.com: required to fill the application form on a supported ATS page you apply to from Job Matches.
  • host_permissions on api.applycove.com and amazonaws.com: required to talk to your ApplyCove account and to read or write the encrypted session blob in S3.

8. Your rights

You can delete a synced session at any time from the Connected Accounts page in the dashboard. To request full deletion of your ApplyCove account (which includes any synced sessions), email support@applycove.com.

9. Contact

Questions about this policy or the extension's data handling can be sent to support@applycove.com.

This page applies specifically to the ApplyCove browser extension, covering both session sync and Job Matches auto-apply. For the ApplyCove platform's broader policy, see the main privacy policy.