Privacy Policy
Last updated: July 4, 2026
- Your resume, documents, preferences, and application history live in your browser, not on our servers.
- Our backend stores no user data — it has no database.
- HandShook never sees, asks for, or stores your Handshake password.
- Uninstalling the extension deletes everything.
What HandShook is
HandShook is a Chrome extension that automates eligible one-click job applications on Handshake from your own logged-in browser session, and can generate tailored cover letters and other application documents with AI assistance. It is operated by an individual developer; contact yash.ponnaganti@gmail.com with any privacy questions.
Where your data lives
| Data | Where it is stored |
|---|---|
| Resume, transcript, and other uploaded documents | Your browser's extension storage (chrome.storage.local). Never uploaded for storage. |
| Google profile (name, email, picture) after sign-in | Your browser's extension storage. |
| Screening-question preferences (work authorization, relocation, etc.) | Your browser's extension storage. |
| Run history (counts of applied/skipped jobs) | Your browser's extension storage. HandShook does not keep a list of the specific jobs you applied to. |
| Handshake username or password | Nowhere. HandShook never collects them; automation runs inside the Handshake tab you already signed in to. |
What is sent to our server, and when
Our backend is a stateless service: it processes requests and keeps no database. It receives data only in these moments:
- Google sign-in: your Google access token is verified with Google to confirm your identity, then discarded. We receive your name, email address, and profile picture URL from Google and return them to your browser; we do not store them.
- AI document generation (only when you click Generate): the job posting text and the text of your locally stored resume (or other selected documents) are sent to the backend, which forwards them to OpenAI's API to draft the document. The result is returned to you for review. Neither we nor the request content is retained by the backend.
Standard technical logs (timestamps, request paths, status codes — not document contents) are kept briefly in AWS CloudWatch for debugging and abuse prevention.
Third-party services
- Google — sign-in (OpenID, email, basic profile scopes only).
- OpenAI API — processes the text you submit for document generation. Per OpenAI's API policy, API data is not used to train their models.
- Amazon Web Services — hosts the stateless backend.
HandShook is not affiliated with Handshake. It contains no ads, no analytics trackers, and never sells or shares your data with anyone.
Data retention and deletion
Because everything lives in your browser, removing the extension (chrome://extensions → Remove) permanently deletes your documents, preferences, profile, and history. There is no server-side copy to delete.
Changes
If this policy changes materially, the "Last updated" date above will change and the new version will be posted at this address.