Quarrion Assisted Apply — Privacy Policy

This extension is a task executor for your Quarrion account. It runs only the job applications your paired account has already queued, and it communicates with one server: the Quarrion API at https://quarrion.ai, unless you deliberately point it somewhere else with the Advanced setting on its options page.

What leaves your browser

• The device token created when you pair the extension. It authenticates every API call, and it travels alongside the version number of the running extension so the server can refuse to hand work to a build too old to run it correctly. Task-scoped calls also echo an opaque delivery timestamp supplied by the server, which prevents a delayed call from an earlier run changing a task that has since been requeued.
• A request to replace the device token as it nears its expiry. It carries the current token and nothing else, and the reply is a new token; the previous one keeps working for 24 hours so nothing already in flight is lost.
• A per-task outcome report. It carries the status (completed, failed, or needs_user_action when a gate only you can clear stopped the run), a typed failure category such as login_required, captcha_detected or missing_field, a short technical diagnostic, which gate is blocking and the address of the page it is on, and, when a submission is confirmed, the confirmation wording matched on the page or the address the submitted form landed on.
• A fill checkpoint: the canonical field KEYS already filled, such as first_name or work_authorisation, so an application you resume carries on instead of starting again. Keys only. The answers themselves already live in your Quarrion account and are never sent back to it.
• A screenshot of the job-application tab, captured as a JPEG at the end of a task and used as evidence that the application was really submitted. It is a picture of the page as it stood, so it can show the details you gave Quarrion as they appear in the filled-in form. It is sent to the Quarrion API and kept in a private storage area belonging to your account. It is never public, and it is shown back only to you, through signed links that expire after five minutes. An image larger than roughly 1.5 MB is dropped rather than sent, and a capture that fails never stops the rest of the report.
• Any question the live form asked that your prepared answers did not already cover: the wording of the question, the kind of control it is (a text box, a dropdown, a set of radio buttons) and the option labels it offers. That is sent so Quarrion can answer it, either during the application or by asking you afterwards. What is then typed into the field is not sent with it.
• A heartbeat while a gate only you can clear is open: the task identifier and which kind of gate it is. It exists so a task is not mistaken for a stalled one while you are signing in, entering a code or solving a CAPTCHA.

What is stored on your device

• The device token, in chrome.storage.local. It is the only secret the extension keeps.
• Working state for the polling loop, also in chrome.storage.local: the timestamp of the newest queued task already seen, a summary of the last task and its outcome, when the last poll reached the API and why it last failed, the task currently running and any gate it is waiting on, the quiet-mode setting, and the API address you entered on the options page if you entered one.
• The date the device token expires, and how long the polling loop is waiting before its next attempt after a run of failures. Both are kept in the same local storage area as the token, and neither is sent anywhere.
• The fill checkpoint described above, in chrome.storage.session. Chrome empties that area when the browser closes, so a half-finished application is never carried into another day.

What never leaves your browser

• The content of the pages you visit, beyond the specific items listed above.
• The values typed into application forms.
• Your browsing history and your bookmarks.
• Your cookies. Version 0.2.3 removed the cookie permission altogether, so the extension can no longer read a cookie at all.
• Anything from tabs the extension did not open itself. It opens one tab for the queued task it is running and injects its code only into that tab.

What it is allowed to reach

• https://quarrion.ai/* is granted when you install the extension. That is its own API, and every call it makes goes there.
• Access to job sites is a separate, optional grant that Chrome will only accept from a click inside the extension popup, and it is a BLANKET grant to every site you visit. Two things force it to be that broad. Job applications live on thousands of employer and applicant-tracking domains that cannot be listed in advance, and the Chrome screenshot API accepts the literal all-sites pattern and nothing narrower, so the submission evidence above cannot be captured without it. The grant is what Chrome enforces, not what the extension does with it: it still only ever opens and fills the page of an application your Quarrion account queued.
• The page at https://quarrion.ai is allowed to send messages to the extension. That is how pairing completes in one click, and how a button in Quarrion can hand an application straight to this browser instead of waiting for the next poll. No other website can do this.

No remote code, no analytics, nothing sold

The extension contains no remote code: all of its logic is bundled into the package you install, and what it runs against a form is a declarative fill plan supplied by your Quarrion account. It performs no advertising, no analytics and no tracking of any kind. It shares nothing with third parties and sells nothing.

Contact

Contact: support@quarrion.ai.