Privacy Policy
Last updated October 16, 2026
Who we are
Acorn is an AI auto-bid agent for job seekers. It is a website and a browser extension that tailor resumes, fill in job applications, and track recruiter replies. This policy explains what information Acorn handles, why, and the choices you have.
The short version: Acorn uses your information only to do the job you ask of it. We do not sell it, we do not use it for advertising, and we do not use it to train AI models.
Information we collect
- Account details: your name, email address, and a hashed password if you sign up with email.
- Profile and resume content you provide: work history, education, skills, answers to screening questions, and the resumes and cover letters you upload or generate.
- Application activity: the jobs you apply to through the extension and their status.
- Settings you save, including the OpenRouter API key you add to your profile and the default password you choose for accounts the agent creates on job sites for you.
- Google account data, only if you choose to connect it. See the Google user data section.
- Billing details: your plan and payment status. Card numbers are handled by our payment processor, not stored by us.
- Basic technical data such as browser type and error logs, used to keep the service working.
What the extension reads and sends
The Acorn extension works on the page you are on, and only when you start an action from the Acorn side panel (a Run, Fill, Generate, or Recommend). When you do, it can read that page's text, form fields, and structure, and the Agent Run also takes screenshots of the page and acts on it with mouse and keyboard input, the way you would.
To decide what to fill and click, that page content and the relevant parts of your profile are sent to the Acorn servers, and from there to the AI model provider. The model providers are reached through OpenRouter, using the API key in your profile, so the AI usage is billed to your own OpenRouter account.
Your Acorn sign-in is sent with the request so the server can read your own profile and resumes. The server that plans an Agent Run keeps the run in memory only: it does not save screenshots or your profile to disk, and it forgets the run when it ends.
The extension does not read pages you have not asked it to work on, does not record your browsing, and does not collect your browsing history.
The run log and support reports
While a run goes on, the extension keeps a detailed log of what it did in your browser (the last five runs of each tab, at most 50 MB). The log stays on your device. Passwords, emailed codes, tokens, and keys are replaced before anything is written to it.
For an Agent Run the log also holds the screenshots the agent was shown, what the AI model was sent and answered, and how long each step took. The Download button in the Logs tab saves all of it as a file on your device. The log leaves your device only if you press Submit on a support report. It is then attached to that report so we can find out what went wrong, and it can contain page text and details from your profile. A report carries the text of the log, not the screenshots. Opening the report form uploads nothing.
AI model providers
Acorn sends resume text, job-posting text, form content, and page screenshots to AI models so they can write answers, choose options, and read pages. The requests run on the OpenRouter key you saved in your profile, and OpenRouter and the model provider it routes to process them under their own terms and privacy policies. We do not send your data to any model provider for purposes other than your request.
The account password you set as your default for new job-site accounts is filled straight into the page. It is never put in a prompt or a log.
Google user data
You can sign in with Google and, separately, connect a Gmail mailbox and Google Calendar. We request only the access each feature needs:
- Sign-in (openid, email, profile): to identify you and create your account.
- Gmail read access (gmail.readonly): to find replies to your job applications and show them next to the application, and, while a run is waiting on a job site, to find the verification code or link that site emailed you.
- Gmail label access (gmail.modify): to apply labels to application-related messages. We never send email, and we never permanently delete messages.
- Google Calendar events (calendar.events): to add interviews and follow-ups you schedule to your calendar.
How we use Google user data
We use Google user data only to provide and improve the user-facing features described above: sign-in, reply tracking, finding the verification code a job site emailed you, labeling, and calendar events. To find a verification code, the sender, subject, and text of your newest messages are read by an AI decision model, which picks the one email that holds the code. We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI or machine-learning models. We do not allow humans to read your email unless you give explicit permission for specific messages, it is needed for security or to comply with law, or the data is aggregated and anonymized for internal operations.
Acorn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Chrome Web Store limited use
The use of information collected by the Acorn extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:
- We use the data only to provide or improve the single purpose of the extension: applying to jobs for you.
- We do not sell or transfer the data to third parties, except to the service providers named in this policy that are needed to do what you asked, to comply with law, or as part of a merger or sale with notice to you.
- We do not use or transfer the data for personalized advertising, or to determine creditworthiness or for lending.
- People do not read the data, except with your permission for specific items, for security, to follow the law, or when it is anonymized and aggregated for internal operations.
Extension permissions
These are the permissions the extension asks for and the only reasons it uses them:
| Permission | Why the extension needs it |
|---|---|
| Access to all websites (host permissions and content scripts) | Job applications live on thousands of company sites and applicant-tracking systems, so Acorn has to read and fill the application form wherever you open one, including forms inside embedded frames. It acts only when you start it. |
| activeTab and scripting | To read the page you are on and to fill and click its fields when you ask. |
| debugger | To take screenshots of the page and send real mouse and keyboard input for the Agent Run. It is attached only to the tab that is running, and detached when the run ends. |
| webNavigation | To notice when a job site moves to a new page or frame in the middle of an application, so the next step works on the page that is actually showing. |
| sidePanel | To show the Acorn controls, progress, and logs beside the page. |
| storage and unlimitedStorage | To keep your settings, the per-tab state of a run, and the local run log on your device. |
| alarms | To keep a long run going and to check on it while the browser is idle. |
How we use other information
- To run the service: build resumes, autofill forms, and answer screening questions on your behalf.
- To process payments and manage your plan.
- To secure accounts, prevent abuse, and fix problems.
- To contact you about your account and important changes to the service.
Storage and security
Data is stored on servers we control or rent from reputable hosting providers and is encrypted in transit. Google access tokens are stored encrypted and used only to carry out the features you enabled. Runs are planned in server memory and are not written to disk. No system is perfectly secure, but we work to protect your data from unauthorized access.
Retention, deletion, and your choices
- Stop the extension from acting at any time: press Stop in the side panel, or remove the extension.
- Disconnect Gmail or Calendar at any time from the Gmail page in Acorn. Disconnecting removes the stored Google tokens.
- You can also revoke Acorn's access from your Google account permissions page.
- Delete your account from Acorn at any time. This removes your profile, resumes, application history, and any stored Google data.
- Backups and logs are purged on a rolling basis, and we may keep limited records where the law requires.
- You may ask us to access, correct, or delete your information by contacting us below.
Children
Acorn is not intended for anyone under 16, and we do not knowingly collect their information.
Changes
We may update this policy. When we make a material change we will update the date above and, where appropriate, notify you in the app or by email.
Contact
Questions about this document? Contact us through the Acorn website.