Privacy policy

Quiet Mountain Consulting Pte. Ltd. is the data controller for HoneyJobs. This policy explains what we collect, why, where it goes, and your rights under Singapore's Personal Data Protection Act and, where it applies, the UK and EU GDPR.

1. What we collect

• Account: email, password hash (managed by our authentication provider), sign-in times.
• Profile and documents you provide: resume files and their extracted text, work history, education, skills, contact details, work-authorisation status, salary floor, application answers, and any voluntary self-identification answers you choose to store for autofill.
• Activity in the app: searches, saved and hidden jobs, applications you track, feedback, and error reports needed to keep the Service working.
• Payments: handled by Stripe; we store your customer and subscription identifiers, never card numbers.
• Email connection (optional): if you connect Gmail or Outlook, we read only the messages needed to detect employer replies; tokens are encrypted and can be disconnected at any time.

2. Why we use it

• To match and score jobs, rewrite your resume, draft letters and answers, and fill forms you open, all at your request.
• To run your account, plan and payments, and to send the alerts and lifecycle messages you have turned on (Settings › Email).
• To keep the Service secure and reliable (rate limits, abuse prevention, crash reports).

We do not use your resume, answers or documents to train machine-learning models, and we do not sell personal data.

3. Who processes it for us

Supabase (database and authentication), Cloudflare (hosting and edge network), Stripe (payments), Resend (email delivery), and AI model providers that process the text of a document only for the request you make and do not retain it for training. Each is bound by a data-processing agreement. Data may be processed outside Singapore; we rely on the providers' standard contractual safeguards.

4. Identifiers

National identifiers (NRIC, FIN, passport numbers) found in uploaded resumes are stripped at upload and never stored.

5. Retention

Your data is kept while your account exists. Deleting the account (Settings › Your data) removes your account, documents, applications, answers and stored files immediately. Backups roll off within 30 days. Aggregate statistics that cannot identify you may be kept.

6. Your rights

You can access, export (Settings › Your data › Export), correct, and delete your data yourself at any time. You can withdraw consent to email by turning alerts off. For anything else, or to complain, write to hello@honeyjobs.ai; we answer within 30 days. You may also complain to the Personal Data Protection Commission of Singapore or, in the UK/EU, your local supervisory authority.

7. Cookies

We use cookies and local storage to keep you signed in, remember preferences, and measure visits and campaign performance. Our public landing page uses the Meta and TikTok pixels to measure advertising. These platforms receive page-view and browser information, such as the page URL, IP address, and advertising cookie identifiers. For consenting Singapore visitors acquired through our TikTok signup campaign, we also send TikTok a completed-registration event, a hashed email address, and the advertising click identifier when available. We do not send resume or application contents through these integrations. Where consent is required, the pixels wait until you have accepted cookies and visit or reload the landing page. You can block advertising cookies through your browser settings. See Meta’s privacy policy at https://www.facebook.com/privacy/policy/ and TikTok’s at https://www.tiktok.com/legal/page/row/privacy-policy/en.

8. Changes

We will post changes here and, for material changes, tell you by email or in the app before they take effect.

The browser copilot (HoneyJobs Autofill extension)

The extension detects supported application forms and fills them with your profile, resume and saved answers. It processes the current job URL, title, employer, form questions and relevant page content to match the role, provide autofill, draft answers and track applications. On supported job boards it reads listing details to show matches. It does not read your browser history database. By default you review and submit yourself; Automated mode may submit only after you enable it and start an Agent run.

Data is sent over HTTPS to HoneyJobs infrastructure operated through Cloudflare and Supabase. Requested AI features send relevant profile and form text to our AI processing providers. Data entered into an employer form is available to that employer under its own privacy policy. Voluntary self-identification answers, including disability information if you provide it, are used for the fields you choose to fill. Saved employer credentials are kept on your device and used only to sign in to the employer site, not sent to HoneyJobs. Extension storage also contains your session, cached profile, resume, answers and preferences. Remove the extension to clear its local storage.

In extension version 0.5.25 and later, optional diagnostics are off by default. If you select Allow diagnostics in the panel settings, we collect installation ID, version, form type, fill results, error categories and installation activity to improve reliability. These events do not contain resume text or field answers; they can be linked to your account when paired. Requests expose an IP address, and our infrastructure derives approximate location, device information and a rotating IP hash. Turn diagnostics off in the same settings to stop future diagnostic events and uninstall tracking. Earlier development versions sent these events without this control.

When you choose to send feedback, we receive your message, the relevant page path, form type and extension version to investigate the issue. Do not include passwords or unnecessary sensitive information in feedback. Extension account data follows the retention and deletion controls above; optional diagnostic records are used for internal reliability analysis.

HoneyJobs Autofill complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide or improve its stated features. It is not sold or used for personalized advertising, and is not passed to the website's advertising pixels. Transfers are limited to providing these features, security, legal requirements or a permitted business transfer. Human access is limited to your explicit consent, security or legal purposes, or aggregated and anonymized internal analysis.

The debugger permission supplies keyboard and mouse input to forms that reject synthetic events. It attaches to the form tab during filling and is released afterward; Chrome displays its own debugging indicator.