Extension privacy policy

The Coverage extension does two things, both only when you click its button: on a LinkedIn page it sends that page's text to your own Coverage dashboard, and on a job application it fills the form from the application info you saved in your dashboard. This page explains exactly what that involves. The dashboard itself is covered by the Coverage Privacy Policy.

1. What it reads

Only when you click a button in its popup, and only in the tab you're looking at:

• On a LinkedIn profile: the text shown on that page (name, headline, location, experience, education and similar sections) and the profile's address.
• On a LinkedIn People search: the names, headlines and profile addresses of the people listed on the page.
• On a LinkedIn job page (“Track this job”): the job's title, company, location, description and, when LinkedIn shows it, the employer's own application link.
• On a job application (“Autofill this page”): the form's questions (labels, field types and answer options, never the contents of password fields) and the page's visible text, so the dashboard can tell what each field asks and what the job is. To read the choices of a custom dropdown it opens the dropdown and closes it again.

That's website content you can already see. The extension doesn't read pages you haven't clicked it on, other tabs, your browsing history, passwords, messages, saved passwords or anything else. On LinkedIn it never clicks, scrolls, types or loads pages for you. On a job application it only types into the form fields it read, picks the matching choice in dropdowns and suggestion lists, and, on Workday when you click “Fill the next pages too” or Fill selected, presses the page's Next / Continue button. For Fill selected it also presses the buttons that open the form (Workday's Apply / Apply Manually, Lever's “Apply for this job” link) and, if you turned on saved logins, the sign-in form's Sign in button. It never presses Submit or any button that sends an application, signs a document or creates an account, never fills Social Security numbers, bank or card details, fills a password only from your own saved logins, and you review the application before you submit it yourself.

Fill selected (1.3): when you press it on your dashboard's Applications page, the extension opens those jobs in a “Coverage” tab group and does the same reading and filling there, on application sites you allowed, without another click per job. On Workday it presses the job's own Apply / Apply Manually buttons to open the form. With Watch it work it fills one tab at a time in front of you and shows a banner with a Stop button.

2. Where it goes

The extension opens your dashboard (https://banker-dashboard-three.vercel.app, or another address you set) in a new tab, with the text in the address's fragment (the part after “#”). Browsers never send the fragment to a server, so the text goes straight from the LinkedIn tab to your dashboard in your browser, which keeps it in your browser's storage.

For autofill, the extension passes the form's questions and the page text to your open Coverage tab (through a small script that runs on Coverage's own pages only, never on other sites). Your dashboard decides each answer from the application info you saved there and sends back only those values (and your resume file for upload fields), which the extension types into that form. If you have an AI key connected, open questions are drafted by your AI provider as described in the Coverage Privacy Policy, section 4. The employer receives your application only when you submit it. The extension sends nothing to us, to analytics services or to anyone else.

3. What it stores

One setting: your dashboard's address, in your browser's extension storage (it follows your browser profile if you use browser sync). After an autofill it keeps a short summary for that tab (how many fields were filled and which questions were left for you) in session storage, which the browser clears when it closes. Your application info stays in your dashboard, not in the extension.

Saved logins (optional, off by default): if you turn them on in the extension's settings, the sign-ins you add (site, email or username, password) are encrypted on your device with a key made from your PIN (AES-GCM, PBKDF2 with 600,000 rounds) and kept in the extension's storage. You unlock them with your PIN once per browser session. The extension types a login only into the sign-in form of the exact site you saved it for. From 1.3.1, so your logins follow you to your other browsers, the extension keeps that encrypted copy in your Coverage account through your dashboard tab; your PIN never leaves the extension, so neither the dashboard nor our server can read a login (unlock it with the same PIN in the other browser). Logins are never sent to any AI provider or to any other site, and you can delete them all from the extension's settings at any time (that removes the account's copy too). The extension never reads your browser's own saved passwords and never creates accounts.

4. What it never does

• Sell or transfer your data to anyone, or use it for advertising, credit or lending decisions.
• Run on any site before you click it there (the only exception is the bridge script on Coverage's own pages).
• Submit an application for you. The only buttons it presses are a multi-page form's Next / Continue, the ones that open an application form, and a sign-in form's Sign in with your saved login, and only when you started a fill.
• Load code from the internet: everything it runs ships inside the extension.
• Track you, or include analytics.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Permissions

• activeTab: access to the current tab only, granted by your click, and only until you leave that page.
• scripting: runs the read-only function that collects the visible text from that tab.
• storage: saves your dashboard's address, the last autofill summary for a tab until the browser closes, and, only if you turn them on, your encrypted saved logins.
• tabGroups: puts the jobs Fill selected opens into one “Coverage” tab group, so they're easy to find and close.
• Access to Coverage's own site (https://banker-dashboard-three.vercel.app): runs the bridge script that connects the extension to your dashboard tab for autofill. It doesn't give access to any other site.
• Optional: application sites (Workday, Greenhouse, Lever, iCIMS, Taleo, SuccessFactors and similar application systems): asked one site at a time from the popup (or all at once from the extension's settings, for Fill selected), only when you choose page-by-page filling, batch filling or need to fill a form embedded from that site. Nothing is granted at install, and you can remove a site at any time from the extension's details page.

6. Removing it

Remove the extension from chrome://extensions (or edge://extensions) and its one setting is deleted with it. To delete profiles you sent to your dashboard, use the dashboard (Settings → Backup → Clear all data, or delete the contact).

7. Changes and contact

If what the extension does changes, this page changes first, with a new date at the top. Questions or requests: nagong1@g.ucla.edu.