Last updated August 26, 2026.
Two ways to run aplyx
aplyx works two ways: fully local, with no account, or signed in to a hosted account that also keeps a copy of your profile and resumes in the cloud so you can pick up from another machine. This page covers both: the "Local" and "Hosted account" sections below tell you which parts apply to you.
Local: nothing leaves your machine
Running aplyx locally (the TUI or the desktop app with no account signed in) keeps your profile, resumes, and application history entirely on your own machine, in files under your own install directory. None of it is uploaded anywhere by aplyx itself.
Hosted account: what's stored in the cloud
Signing in to a hosted account stores your profile (name, contact info, and the other fields you fill in during setup) and your resume file(s) in our cloud database, so they're not stuck on one machine.
ATS account credentials you add are stored separately in Supabase Vault, encrypted at rest and scoped to your account. Ordinary account data queries return only masked account details; the password is not stored in a regular database column or shown on this website.
A few fields (gender, ethnicity, and date of birth) are always optional. Some employers ask for these on voluntary self-identification forms; skip them if you'd rather not answer, and it won't affect anything else aplyx does.
Your hosted data is scoped to your account: database access rules mean only requests authenticated as you can read or write it. We can't browse across accounts, and neither can any other user.
What hosted does not do yet: nobody but you runs the actual job search, tailoring, or application steps. Those still happen on your own machine, driven by your own coding agent, exactly like local mode. A fully server-run version (no machine required at all) is planned. If it ships, it gets its own explicit heads-up and consent step here first. It won't be folded silently into today's hosted tier.
What goes to your coding agent's model provider
aplyx drives whichever coding agent you have installed (opencode, Claude Code, and others). Resume tailoring sends the relevant job description and your resume content to that provider's API to generate the tailored text, the same way using the coding agent directly would. This is inherent to how the tailoring step works, not something aplyx adds on top, and it's the same for local and hosted accounts. Cover-letter and application-essay drafting is a hosted-plan feature and runs on aplyx's own servers (see the hosted-accounts section).
The browser extension
The aplyx browser extension activates only on the four job-application platforms it supports (Greenhouse, Lever, Ashby, and Workday), and only once it detects an actual application form on the page, not on every page you visit. When it does, it reads that page's form field labels and, if you ask it to, the job posting's title, company, description, and location, so it can offer to autofill the form and check whether the role fits your profile.
Everything the extension does today talks only to your own local bridge process
(http://127.0.0.1) running on your own machine: the same local
data flow as the rest of local mode, described above. Nothing it reads from a page is
sent anywhere else. It fills form fields for you to review but never clicks submit;
you always decide when (or whether) to send an application.
Discord and Google Sheets: both opt-in, both off by default
- Discord status updates (applied / needs-review / failed) are opt-in during setup, and send only outcome-level information to a webhook URL you provide.
- A Google Sheets internship tracker sync is available for successful applications, using only user-facing fields, never internal-only data.
What this website stores in your browser
This marketing site (the pages you're reading right now) remembers your light/dark theme choice and, just for the current browser tab, which inline links you've clicked, so they look visited. Both stay entirely in your browser and are never sent to us. This site sets no cookies and loads no analytics, advertising, or third-party scripts of any kind.
Two pages are the exception, and both only ever read public data: the install page
fetches GitHub's public releases API, client-side, to show a download button matched
to your OS; the changelog page fetches this repository's public CHANGELOG.md
the same way. Neither request includes or returns anything about you.
Billing
aplyx doesn't charge for anything yet: there's no billing system live today, so no payment or billing information is collected. When paid hosted plans launch, this page will describe exactly what that adds, before it applies to you.
Security measures
In transit, every connection aplyx makes (to your coding agent's provider, Discord, Google Sheets, or hosted-account storage) uses HTTPS.
At rest, hosted data sits in a database with per-account access rules and standard disk-level encryption. Local data's protection is your own machine's file permissions, the same as any other file you own.
This website is served over Vercel. The physical region for hosted-account storage hasn't been finalized yet. This section will be updated with specifics once it is.
Your data, your call
Locally, everything aplyx stores lives under your install directory's
data/ and src/config/ folders. Delete the install directory
and it's gone.
For a hosted account, there's no self-serve delete button yet. Reach out (see Questions below) and we'll delete your account data by hand, every request handled personally, until self-serve deletion exists.
How long we keep it
Local data stays until you delete it yourself. aplyx never expires or removes it on its own. Hosted data stays for as long as your account exists, or until you ask us to remove it.
Not for children
aplyx is built for job seekers old enough to be applying for jobs. It's not intended for anyone under 16, and we don't knowingly collect information from children.
If this page changes
If what we collect or how it's handled changes, we'll update this page and the date at the top. For any change to what's stored server-side specifically, we'll also show you a heads-up inside the app, not just bury it here.
Questions
Email support@aplyx.app for anything private, including a request to see or delete your data. For everything else, an issue or discussion on GitHub works too.
docs/legal.md in the repository for that context. Nothing here should be
read as a guarantee of compliance with any specific law; if that matters for your use
case, consult your own counsel.
1. Scope and applicability
1.1. This policy applies to aplyx's local software (the command-line tool and desktop application) and, separately, to the hosted account service described in Section 2.2, both operated by the individual maintainer of the aplyx project as of the date at the top of this page.
1.2. aplyx is not currently operated by a registered company. This policy will be updated if and when that changes.
1.3. If you use aplyx entirely locally with no account, Sections 3 and 5 are the ones that meaningfully apply to you, since we do not collect or receive any information in that mode.
2. Information we collect
2.1. Information you provide, local mode: if you run aplyx locally, you enter your own name, contact information, resume content, and job-search preferences directly into files on your own computer. We do not receive or see this information.
2.2. Information you provide, hosted accounts: if you create a hosted account, we collect your email address (via our authentication provider), the profile fields you enter during onboarding (name, contact details, address, LinkedIn/GitHub usernames, education details, and work-authorization status) and any resume file(s) you upload. Gender, ethnicity, and date of birth are also collected if you choose to provide them; these fields exist because some employers request them on voluntary self-identification forms, and providing them is always optional.
2.3. Information collected automatically: our marketing website stores a theme
preference and, for the current browser tab only, which inline links you've clicked,
both in your browser's local storage. Neither is transmitted to us. We do not use
cookies, analytics, advertising, or crash-reporting tools anywhere in aplyx. The
install page and the changelog page each make a client-side request to a public GitHub
endpoint (the releases API and a raw CHANGELOG.md file, respectively) to
display current content; neither request carries or returns any information about you.
2.4. Information from third parties: we do not receive information about you from third parties beyond what you provide directly, or what naturally results from using a service listed in Section 5 (for example, your coding agent's model provider processes resume and job-description text on your instruction, not on ours).
2A. The browser extension
2A.1. The extension activates only on pages matching Greenhouse, Lever, Ashby, or Workday application-form URLs, and only once it detects a fillable application form on the page.
2A.2. When active, it reads that page's form field labels (to identify which of your profile fields, if any, map to them) and, at your request, the job posting's title, company name, description text, and location.
2A.3. As of this policy's date, the extension communicates only with a bridge process
running on your own machine at http://127.0.0.1; it does not send any of
the above to us or to any third party. If a hosted (no-local-bridge) mode of the
extension ships in the future, this section will be updated first, with its own
explicit disclosure, before that applies to you.
2A.4. The extension fills form fields for your review but never submits a form on your behalf under any circumstance.
3. How we use your information
3.1. Local mode: aplyx uses the information on your machine to search job boards, evaluate fit, tailor your resume per posting, and fill out job applications, as instructed by you, entirely on your own computer. Cover letters and application essays are not generated in local mode; they are a hosted-plan feature.
3.2. Hosted accounts: we use your profile and resume data to make your job-search information available to you across devices. As of this policy's date, no infrastructure operated by us performs job searching, resume tailoring, or application submission on your behalf. Those actions still run on your own machine using your own coding agent, for hosted accounts exactly as for local ones. If that changes, this policy will be updated first, and a separate consent step will apply before it affects you.
4. How we share or disclose your information
4.1. We do not sell your personal information.
4.2. We share information with the service providers listed in Section 5, only as needed to provide a feature you've enabled: a Discord webhook you configure, a Google Sheet you connect, or your coding agent's model provider generating tailored text on your behalf.
4.3. We may disclose information if required by law, or to protect the rights, property, or safety of aplyx, its users, or others. We have not received such a request to date.
5. Third-party services
5.1. Your coding agent's model provider: receives job-description and resume text to generate tailored application content, under that provider's own terms.
5.2. Our authentication and database/storage provider: provides sign-in and storage for hosted accounts.
5.3. Discord: if you opt in, receives outcome-level status messages via a webhook URL you provide.
5.4. Google Sheets: if you opt in, receives the user-facing application-tracking fields you choose to sync.
5.5. Vercel: hosts this public website; no account or personal information passes through it beyond standard web-server access logs kept by Vercel, not by us.
5.6. GitHub's public API and raw-content endpoints: queried client-side by the install page (releases, for download links) and the changelog page (CHANGELOG.md); neither request includes personal information.
5.7. We do not use any analytics, advertising, or crash-reporting service.
6. Data retention
6.1. Local mode: data persists on your machine for as long as you keep it there. aplyx does not delete it automatically; deleting your install directory removes it.
6.2. Hosted accounts: we retain your profile and resume data for as long as your account exists. Deleting your account removes your profile and application-history records automatically; your uploaded resume file(s) currently require a manual step on our part, handled by request (Section 12) until self-serve deletion is built.
6.3. A separate, non-personal cache of publicly available job postings, used to speed up search for all users, refreshes on the order of hours and is never associated with your personal information.
7. Security measures
7.1. Data in transit between aplyx and any service listed in Section 5 is encrypted (HTTPS/TLS).
7.2. Hosted-account data at rest is stored with per-account access controls, so that only requests authenticated as you can read or write your data, plus standard disk-level encryption from our infrastructure provider.
7.3. Local-mode data's protection is the security of your own computer and its file permissions, the same as any other file you keep on it.
7.4. No security measure is perfect. We will disclose any confirmed data breach affecting hosted accounts to affected users without undue delay.
8. International data transfers
8.1. The physical region where hosted-account data is stored has not yet been finalized; this section will be updated with specifics once it is.
8.2. If you access aplyx from outside the country where our service providers operate, your information may be processed in a different country than your own.
9. Your rights and choices
9.1. You may access, correct, or request deletion of your hosted-account information at any time by contacting us (Section 12).
9.2. If you are located in the European Economic Area, the United Kingdom, or a US state with its own privacy law, you may have additional rights under those laws, including the right to know what's collected, to request deletion, and to not be discriminated against for exercising these rights. We intend to honor these rights for anyone who asks, regardless of location, even though we have not formally confirmed which specific laws apply to a project of this size.
9.3. For local-mode use, since we never receive your data, these rights are already fully in your own hands: deleting the install directory is a complete deletion.
10. Children's privacy
10.1. aplyx is intended for individuals old enough to be seeking employment and is not directed to children under 16. We do not knowingly collect personal information from children under 16, and we will delete any such information if we become aware of it.
11. Changes to this policy
11.1. We may update this policy as aplyx changes. The date at the top reflects the most recent update.
11.2. For any change affecting what's stored server-side for hosted accounts, we will also provide notice inside the application, not only on this page.
12. Contact
12.1. For any question about this policy, or to request access to, correction of, or deletion of your information, email support@aplyx.app. You may also open an issue or discussion on our GitHub repository for non-sensitive questions.
12.2. We will respond to a rights request within the time required by applicable law, and within 45 days where no specific period applies. We may ask you to verify control of the account's email address before acting on a request.