Privacy Policy
Effective: 10 October 2026
This policy explains what personal data RoleQuest collects, why, who we share it with, and the choices you have. It covers the website at rolequest.app, the RoleQuest web app at app.rolequest.app, and the RoleQuest Apply Chrome extension (together, the “Service”).
1. Who we are
RoleQuest is operated by RoleQuest, an Ontario, Canada corporation (“RoleQuest”, “we”, “us”). We are the controller of the personal data described in this policy.
For all enquiries, including privacy questions and data requests, email support@rolequest.app.
2. The data we collect
Account data (Google sign-in)
You sign in with Google. Google shares your name, email address, profile picture and Google account identifier with us. We request only these basic profile details. Signing in does not give us access to your Gmail, Google Drive, Contacts or Calendar.
Your CV and career profile
When you upload a CV or résumé we store the file and the information we extract from it, such as your work history, education, skills and the contact details it contains. We also store profile details you add or edit: headline, location, compensation target, target roles, preferences, answers to profile questions, and stories about your experience.
Jobs and applications
We store the jobs you discover or save, the CVs and answers tailored for each posting, and a record of each application: the posting, the answers and documents submitted, its status, and its outcome (submitted, skipped or failed, with the reason). To make each application verifiable, we keep a log of what the RoleQuest agent read on the application page and the actions it took. In that log, the values typed into form fields are replaced by a marker.
The Chrome extension
The RoleQuest Apply extension carries out applications in your own browser, using the sessions you are already signed in to. It connects only to RoleQuest's own server (api.rolequest.app), using a temporary token that the RoleQuest web app hands it when you are signed in. It requests these Chrome permissions:
- Access to all websites (
<all_urls>): job applications happen on many different employer and job-board sites, so the extension must be able to work on whichever site a job is hosted on. Its scripts are present on every page but stay idle until RoleQuest sends an instruction for the tab used for an application. During an application it reads the form and the visible text of that page, fills in fields, clicks buttons, uploads your CV, and takes screenshots of that tab. - Tabs: to open, find and focus the tab an application runs in, and to take screenshots of it.
- Storage: to keep the extension's token, its connection status and which tab an application is using.
- Alarms: to reconnect to RoleQuest after Chrome pauses the extension.
What the extension reads from an application page, and the screenshots it takes, are sent to RoleQuest and to our AI provider to decide how to fill in the form. Screenshots are used for that step and are not stored by RoleQuest.
LinkedIn. While the extension is connected, it checks about once a minute whether you have a LinkedIn tab open and whether you are signed in to LinkedIn there, so RoleQuest can tell you when LinkedIn needs you to sign in. It sends RoleQuest that sign-in status together with the address and title of that LinkedIn page; we keep only the sign-in status. When you ask RoleQuest to search LinkedIn for jobs, the extension opens a LinkedIn job search in your browser and reads the job titles, companies, locations and links shown on the results page.
The extension does not read your browser cookies or saved passwords, does not keep a history of the sites you visit, and does not read or change any page except as described above. If a site asks you to sign in, solve a captcha or confirm a code, RoleQuest hands the tab back to you instead of entering credentials.
Connected accounts (optional)
If you choose to connect your Gmail account, we connect it through our provider Unipile so that RoleQuest can show you recruiter and application emails inside the app. Emails are fetched from Unipile when you open them and are not stored by RoleQuest. You can disconnect at any time in Settings.
Payments
Paid plans are billed by Stripe. Your card details go directly to Stripe and are never stored by us. We store your Stripe customer ID, your plan and subscription status, and the billing history needed for accounting.
AI usage
For each AI request we record the feature, the model, token counts and cost, so that we can show your usage against your plan's fair-use budget.
Technical data
When you use the Service our servers and Cloudflare process technical data such as your IP address, browser type and request times, to deliver pages, keep the Service secure and diagnose errors. Our application logs redact names, email addresses, phone numbers and LinkedIn profile links.
Cookies
This website (rolequest.app) sets no cookies and loads no analytics or third-party trackers. The web app (app.rolequest.app) uses only strictly necessary cookies: a session cookie that keeps you signed in, and short-lived cookies that protect the sign-in flow. We do not use advertising or analytics cookies.
3. How we use your data, and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account; providing job discovery, CV tailoring and applications you request | Performance of our contract with you |
| Sending your information to the employers and job sites you ask us to apply to | Performance of our contract with you, on your instruction |
| Connecting optional accounts such as Gmail | Your consent, which you can withdraw by disconnecting |
| Billing, tax and accounting records | Contract; legal obligation |
| Security, abuse prevention, fair-use budgets and fixing errors | Our legitimate interest in a secure, reliable service |
We do not sell your personal data, we do not use it for advertising, and we do not use it to train AI models.
4. AI processing
RoleQuest uses large language models to read your CV, tailor documents, answer application questions and fill in forms. To do this, relevant parts of your profile, your CV, the job posting and the application page are sent to OpenRouter, which passes each request to the company that runs the model (currently OpenAI and Google). The output is generated by a model and can be wrong; you can review tailored documents and choose whether applications are submitted automatically.
5. Who we share data with
Employers and job sites. When you ask RoleQuest to apply to a job, the information in that application is sent to the employer and the site it is hosted on (for example an applicant tracking system). They handle it under their own privacy policies.
Service providers. We use the following providers to run the Service. They process data on our behalf and only for that purpose.
| Provider | What they do | Data involved |
|---|---|---|
| Sign-in | Name, email, profile picture, Google ID | |
| Cloudflare | DNS, network security, the encrypted connection between your browser and our servers, hosting this website | Technical data; all Service traffic in transit |
| Railway | Application hosting, in the EU (Amsterdam) | All Service data in transit and in processing |
| Neon | PostgreSQL database and file storage, in the EU (Frankfurt) | All stored account, profile, CV and application data |
| OpenRouter | AI model access (passes requests to model providers) | Profile, CV, job and application page content sent for processing |
| Stripe | Payments and subscriptions (only if you buy a paid plan) | Name, email, payment details, billing history |
| Unipile | Gmail connection (only if you connect it) | Gmail account access and messages you view |
We may also disclose data if required by law, or to a successor if RoleQuest is reorganised or sold, in which case this policy continues to apply.
6. International transfers
Your stored data is kept in the European Union: our database is in Frankfurt and our application servers are in Amsterdam. RoleQuest itself is based in Canada, which the European Commission recognises as providing adequate protection for personal data. Some providers process data outside the European Economic Area, in particular in the United States: OpenRouter and the model providers it uses, Google, Stripe, and Cloudflare's global network. Where they do, we rely on safeguards such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
7. How long we keep data
- Account, profile, CV and application data: for as long as your account exists. When you ask us to delete your account, we delete this data from our live systems within 30 days.
- The agent's step-by-step log of an application: 30 days. The summary of events in each application run: 180 days, or until your account is deleted.
- Database restore history kept by our database provider: deleted data drops out of it within 30 days.
- The extension's token: it expires after 24 hours, and signing out of RoleQuest cancels it straight away.
- Billing records: as long as accounting law requires, typically 7 years.
- Server logs: up to 30 days.
8. Your rights and choices
Depending on where you live, you have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent at any time. You can edit your profile and disconnect connected accounts in the app, and remove the extension from Chrome at any time. To delete your account or make any other request, email support@rolequest.app. We respond within 14 days. If you live in the EU or UK you can also complain to your local data protection authority.
You also have the right to complain to a data protection authority, in particular the one in the country where you live or work.
9. Security
We use encryption in transit, store session tokens only as hashes, keep each person's data isolated from everyone else's, and limit access to production systems. No system is perfectly secure; if a breach affects your data we will notify you without undue delay and, where the law requires, within 72 hours.
10. Children
RoleQuest is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes to this policy
We will post any changes on this page and update the date above. If a change is significant, we will tell you by email or in the app before it takes effect.
12. Contact
Email support@rolequest.app.