JobAI – Jobby 求職助手：Chrome Extension Privacy Policy / 外掛私隱政策

Updated / 更新：2026-10-06 · Version / 版本：3.0.1

English

Scope and contact

This policy covers the JobAI – Jobby 求職助手 Chrome extension, operated under the JobAI brand at https://jobai.hk. Contact support@jobai.hk or https://jobai.hk/contact for questions and data requests. The separate website policy is at https://jobai.hk/privacy. This is a local browser helper, not an unattended cloud browser; compatibility with every recruitment site is not promised.

Pairing and storage

You sign in on JobAI and choose One-click pair Chrome. The exact-origin connect-device page passes a one-time code through a restricted bridge to an independent extension confirmation page. The code, request/tab identifiers and expiry are held in chrome.storage.session. Expired requests cannot be redeemed and are cleared when next handled; cancellation or page closure clears pending requests. Nothing redeems the code until you confirm in the extension. A manual code entry in the side panel remains a fallback. Only confirming or pressing manual Pair sends the code and device name to https://jobai.hk/api/v1/devices/pair/claim. The returned device credential, device details and pairing time are stored in chrome.storage.local, restricted to trusted extension contexts. The website bridge returns status and a device identifier, not the device credential or profile. Recruiting-page content scripts cannot directly read credentials. The extension does not read your website login session or password.

The credential authenticates scoped requests to jobai.hk for profile fields, saved jobs, queued tasks, authorised résumé versions and receipts. It is sent only to jobai.hk as an Authorization header. Revoke it in JobAI's device list. Unpair deletes the local copy, not the server credential. Uninstall removes extension-local storage, not your JobAI account records.

Job pages and task polling

On supported LinkedIn, JobsDB and CTgoodjobs pages, a content script parses visible job information on page load/change to display a save button and preview. The side panel reads the active tab's URL and cached preview to show the current site and match queued tasks. This is local processing, not general browsing-history collection. Only choosing Save sends the title, company, location, salary, description and URL to your JobAI account. Saving is not submitting an application.

While the paired side panel is open, it periodically reads your queued tasks and their context from JobAI, including employer, role, application URL, state and authorised document-version information. It does not run a separate closed-panel polling timer or autonomously visit employers.

Form filling and résumé attachment

Choosing Fill reads your JobAI profile fields such as name, email, phone, location, current job title, employer and skills and places matching values in empty fields on the active application page. Existing values are not overwritten. Sensitive questions, password and payment fields remain for you. The extension never clicks Submit; you review and submit yourself.

If you separately authorised a specific résumé version for that task on JobAI, Fill downloads only that version, checks its fingerprint and places it in a suitable empty résumé upload field. Without a grant it does not download a résumé. Document contents may include personal or sensitive information you provided. Recruitment pages may transmit filled values and attached files immediately through their own scripts, before you press Submit; their policies apply. Filling or attaching therefore discloses data to the page you chose, not merely to local storage.

LinkedIn, JobsDB, CTgoodjobs, Greenhouse and jobai.hk have declared site access. Another HTTPS employer origin is requested individually through Chrome when you choose Fill; optional access is not granted to all sites at once. Remove site access in Chrome settings.

Reports and confirmation receipts

After filling a queued task, its ID, fill count, outcome and blocker reason are reported to JobAI. This is operational evidence, not proof of submission. Choosing Record confirmation page reads the current URL and up to 1,000 characters near a confirmation message, and sends that observation, the entry URL, outcome and attempt identifier to JobAI. The excerpt may include names, email addresses or application identifiers shown by the page. No recognised confirmation means an unknown result, not success. A device observation is not independent proof of employer delivery.

Recipients and limited use

JobAI and its current hosting provider Railway process data sent to JobAI. Receiving infrastructure necessarily receives connection information such as the source IP address for delivery/security. The recruitment site you choose receives filled fields and authorised attachments; we do not claim 'no third-party sharing' for these deliberate transfers. Chrome and Chrome Web Store operate under Google's policies.

The extension embeds no advertising or analytics SDK, remote executable code, keystroke logging or general browsing-history collector. Extension-accessed data is used for the disclosed job-saving, user-directed form preparation and application records and their necessary security/support operation. It is not sold or used for advertising, data brokerage, creditworthiness or lending. Human access is limited to user-consented support, necessary security/legal purposes or other uses permitted by the Chrome Web Store Limited Use policy. JobAI's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. AI or billing services you separately choose on JobAI are covered by the website policy, not silently invoked by this extension's save/fill operations.

Retention, controls and changes

Device credentials, device details and pairing time remain locally until unpair, uninstall or invalidation handling. Profile, document and task content is processed in memory during use; there is no separate local CV archive. Saved jobs, task reports and confirmation excerpts remain in JobAI after unpair/uninstall. Use available account controls or contact support@jobai.hk for access, correction, export or deletion. Saving a request does not mean deletion has completed. Ask support about backup retention, infrastructure processing locations and legal retention obligations; no unverified deletion deadline or international-transfer certification is promised. Policy changes are dated here; new access or materially different uses require corresponding disclosure and, where needed, permission.

香港粵語

範圍及聯絡

呢份政策適用於 JobAI – Jobby 求職助手 Chrome 外掛，由 https://jobai.hk 嘅 JobAI 品牌營運。查詢、查閱、更正、匯出或刪除資料，可電郵 support@jobai.hk 或用 https://jobai.hk/contact。網站政策另見 https://jobai.hk/privacy。呢個係本機瀏覽器助手，唔係無人值守雲端瀏覽器，唔保證全部招聘平台都適配。

配對及本機資料

你喺 JobAI 登入並撳一鍵配對，指定來源嘅連接電腦頁會經受限橋接，將一次性配對碼交去外掛獨立確認頁。配對碼、請求／分頁編號及到期時間放喺 chrome.storage.session。過期要求唔可以兌換，下次處理時清理；取消或關頁會清掉待確認要求。未喺外掛確認唔兌換，手動打碼仍可作後備。只喺確認或手動撳配對後，配對碼同裝置名稱先送去 jobai.hk 換裝置憑證。本機 chrome.storage.local 保存裝置憑證、裝置資料及配對時間，只容許可信外掛頁面存取，招聘頁內容腳本唔可以直接讀。網站橋接只收到狀態及裝置編號，唔會收到憑證或求職檔案。外掛唔讀主站登入憑證或密碼。

裝置憑證只向 jobai.hk 認證已批出範圍內嘅操作：讀填表資料、存職位、讀派工單、讀已授權履歷及回報收據。你可以喺網站裝置清單撤銷。「喺呢部電腦取消配對」只刪本機副本，唔撤銷伺服器憑證；移除外掛亦唔會刪走帳戶資料。

職位頁、填表及履歷

支援嘅 LinkedIn、JobsDB、CTgoodjobs 職位頁載入或改變時，內容腳本會喺本機解析可見資料，以顯示儲存掣及預覽。側邊欄會讀目前分頁網址及預覽，喺本機比對派工單，唔係收集整份瀏覽紀錄。只有你選擇儲存，先會將職位名、公司、地點、薪酬、描述及網址送入 JobAI；儲工唔等於投遞。

已配對側邊欄打開時，會定期讀你排咗嘅派工單及詳情，包括公司、職位、申請網址、狀態及履歷授權版本資料。關閉後冇獨立背景輪詢，亦唔會自行去僱主網站。

你撳填表後，先會讀姓名、電郵、電話、地區、現職、公司、技能等資料，填入目前申請頁嘅對應空白欄。已有值唔覆蓋，敏感問題、密碼及付款欄留畀你。Jobby 唔撳提交，由你自己核對及提交。

已喺 JobAI 為該派工單授權履歷版本，填表先會下載該版本、核對指紋，放入適合嘅空白履歷欄；未授權就唔下載。履歷可能含你提供嘅個人或敏感資料。招聘頁自己嘅程式可能喺填欄或夾檔後立即傳送資料，唔一定等撳提交；所以填表／夾檔已會向你揀嘅網站披露資料，受對方政策管。

外掛已聲明 LinkedIn、JobsDB、CTgoodjobs、Greenhouse 同 jobai.hk 嘅權限。其他 HTTPS 僱主網站會喺你選擇填表時逐個問 Chrome 授權，唔會一次批晒所有網站；可以喺 Chrome 設定移除。

回報及確認頁

填完派工單會向 JobAI 回報單號、填欄數、狀態及阻礙，唔當成提交證明。你親手撳記錄確認頁，先會讀目前網址及確認字眼附近最多 1,000 字，連同原申請網址、結果及嘗試編號送去 JobAI。摘錄可能含姓名、電郵或申請編號；冇確認字眼就記錄未知，裝置觀察唔係獨立僱主送達證明。

接收方及用途

JobAI 收到嘅資料由 JobAI 及現時代管平台 Railway 處理；接收方亦會收到來源 IP 等連線資料以送達及保障安全。招聘網站會收到填入欄位及授權附件，唔會聲稱完全冇第三方分享。Chrome 同商店本身按 Google 政策運作。

外掛冇內置廣告、分析追蹤套件、遠端執行程式、按鍵紀錄或一般瀏覽歷史收集。外掛取得嘅資料只用於披露嘅儲工、人手指示填表、申請紀錄及必要安全／支援，唔出售、唔用作廣告、資料轉售、信用評估或貸款。人員查閱只限用戶同意支援、必要安全／法律處理，或商店 Limited Use 政策容許嘅情況。JobAI 使用 Google API 資料會遵守 Chrome Web Store User Data Policy，包括 Limited Use。你另外喺主站選擇嘅 AI 或付款服務受網站政策管，外掛儲工／填表唔會暗中啟用。

保留及刪除

本機裝置憑證、裝置資料及配對時間保留到取消配對、移除外掛或失效處理。檔案及派工資料喺記憶體處理，冇另建本機履歷庫。帳戶職位、工作回報及確認頁摘錄唔會隨移除外掛自動刪除。用網站提供嘅控制或聯絡 support@jobai.hk 提出資料要求；保存咗要求唔等於刪完。備份保留、代管地區及法律保留義務需向支援確認，唔承諾未核實刪除時限或跨境認證。政策更新會標日期，新增權限或重大用途改變會另作披露，按需要問你授權。