What we do with your data.

• October 20, 2026: changed AI processing to Anthropic only; OpenAI is no longer used to process resumes, profile answers or job postings.
• October 9, 2026: said that session recordings include what you type into Litos forms, so we can diagnose errors, with passwords and card numbers excluded; changed the wording about sending an application to match the Send button.
• October 9, 2026: named Anthropic and OpenAI as the AI companies that read your resume, profile and the job posting to write your applications; said they do not use what we send them to train their AI by default; added the list of companies that handle your data for us.
• October 8, 2026: some pages now test two versions of one thing, such as where a comparison page's main button goes; a cookie holding a random identifier picks your version, and analytics receive which version you saw.
• October 7, 2026: analytics and your account now keep the campaign a first visit arrived with: the standard utm tags in the link, the ad click identifier if an ad sent you, and the name of the site that linked to us, never the full address you came from.
• October 7, 2026: said which emails Litos sends about your own account, when, and how to stop them.
• October 6, 2026: the extension, like the dashboard, now fills in your work authorization and sponsorship answers from what you told Litos, and does not keep them in your browser.
• September 29, 2026: analytics now receive one word for the kind of site a visit came from, never the address.
• September 29, 2026: removed contact finding, outreach emails and the LinkedIn connections import, which ended on September 8, 2026; said what happens to data stored before then; moved export and deletion requests to admin@trylitos.com.
• August 14, 2026: added LinkedIn connections import, trial and Litos+ billing behavior, and paid automatic-submission access.
• August 11, 2026: disclosed the filled-form and confirmation-page pictures, and set a 7-day window for the filled-form one.
• August 10, 2026: added the cookie inventory and control path.
• July 31, 2026: clarified analytics identity, deletion, and connection-code handling.

Only the page you are looking at, and only when it is a job on Greenhouse, Lever, Ashby, Workday or LinkedIn, or a LinkedIn profile you opened. We do not read anything in the background. If you are not on a job page, we read nothing.

We store your email. If you sign in with Google, we store an ID that tells us it is you. Signing in never gives us your Google password, your files, or your inbox. (Connecting your email so Litos can find a sign-in code is a separate thing you switch on yourself. “Codes sent to your email”, below, says exactly what that lets us see.) We store the facts we read out of your resume. We read the file once to get them, then we throw the file away. We store your answers, which reach us two ways: what you type in Settings, and what Litos watches you type into your first form. The next part explains that. We also store the resumes we made, so your dashboard can show them to you.

We also take two pictures of the company's own page. One is of the form after Litos fills it in, so you can check every answer before you send it, and so you can see what happened if it stops partway. The other is of the confirmation page after you send, so you have proof it arrived. Both are pictures of a whole page with your details already on it, so treat them as you would the application itself. “How long we keep it”, below, says how long each one lasts.

Private answers are locked up: your phone, where you live, your citizenship, your birthday, when you can start, and the pay you want. Your yes or no answers about being allowed to work are stored as plain yes or no, not locked.

To read your resume, tailor it, write cover letters, answers to application questions and interview prep, and fill in application forms, Litos sends your resume (the text, or the file itself when it has no readable text, such as a photo), your profile answers and the job posting to Anthropic, our only AI processor. Its AI reads it and sends back the writing. We do not send it your password or your card.

We use Anthropic through its API, the way businesses connect to it. Under Anthropic's API terms, what we send that way is not used to train its AI models by default.

We also measure numeric page loading times, interaction delays and visual layout shifts to diagnose website performance. These events include a general page category and device class, with the same analytics identifiers described below. They are linked analytics, not anonymous statistics. We discard the performance library's element details, resource addresses and full measurement objects. We limit these measurements to the initial document before navigation and omit ambiguous measurements after navigation or browser-page restoration.

We use PostHog to understand which Litos website pages and Chrome extension actions are useful, such as opening the extension, completing sign-in, generating or filling an application, recording a submission outcome, or starting checkout. When a page fails to load and shows you a recovery screen, we send the name of that screen, a reference code, a general failure category, and the affected component or loaded script location, without the error text, form contents, or URL parameters. When a job-title search returns no matches, we also send the normalized job title and selected location, remote, and visa-sponsorship filters so we know which job sources to add. Entries that resemble an email address, phone number, or website are discarded instead. PostHog receives a random browser or extension installation identifier, the website page path, basic browser and device information, and the named action with limited context. When a page is testing two versions of one thing, such as where a comparison page's main button goes, PostHog also receives which version you were shown. A random identifier in the litos_xid cookie picks the version, and this browser remembers it; neither holds anything about you. When you arrive from another site, it also receives one word for the kind of site you came from, such as google, chatgpt or reddit, and that site's domain name, such as github.com, but never the full address you came from. When the link you followed carries campaign tags (utm_source, utm_medium, utm_campaign, utm_term or utm_content) or an ad click identifier from Google, Meta, TikTok, LinkedIn or Microsoft (gclid, fbclid, ttclid, li_fat_id or msclkid), PostHog receives those values too, read once from that link by Litos itself and checked against the same rules our server uses, so we can tell which list, post or ad brought you. When a new account is created, our server and this website both send PostHog the path of the first Litos page this browser opened, together with that word, domain and those tags if the browser retained them, and our server keeps the same values with your account so we can count sign-ups and subscriptions by where they came from. For extension fills, that context can include the application platform, field counts, and whether an opt-in submission completed. It does not include the job URL, company or role name, resume, or form answers. The extension queues up to 50 sanitized events on your device while delivery is unavailable and removes each one after PostHog accepts it. The extension identifier changes when you sign out.

When you are signed in on the website, we send PostHog your Litos account identifier so that the pages you visit before signing in and the actions you take afterwards can be read as one journey. That identifier is the random internal ID your account already has in our database. We do not send your email address, your name, or anything you have typed. Our backend also reports that an account was created, with where its first visit came from as described above, against the same identifier, because ad and privacy blockers stop that report reaching us from the browser and we would otherwise be unable to count sign-ups accurately. If you delete your account, we delete the linked PostHog profile as part of the same request.

Automatic tracking records clicks, changes, and submissions on interactive elements such as links, buttons, and forms. It does not record the values typed into form fields. Automatic error capture is on for errors the website code does not handle: PostHog receives the type of error, a general operation category when recognized, and the place in our code where it happened. The message of the error is sent only when it is one of the standard messages of the browser itself, which name a part of our code and never your data; any other message is withheld. It never receives form values or anything you typed, and errors the website writes to the browser console are not sent as error reports. When a request fails on our side, our backend reports the kind of request, the status code and the type of error, never its text. Session recording is on: PostHog stores a recording of what happens on your screen during a visit, including what you type into Litos forms, so we can diagnose errors. Passwords and card numbers are excluded: password fields are masked, and card details are entered on Stripe's own page, which Litos does not record. Content already on screen, such as a resume or application details, can also appear in a recording. We do not send resume text, job descriptions, application answers, contact messages, passwords, codes, or other form contents as analytics events. PostHog acts as our analytics service provider and may process network information needed to receive these events.

From version 0.4.0, Litos learns by watching instead of asking. The first job form you fill in by hand teaches Litos your answers. While setup is open and you are on a real form, Litos reads what you type and saves it, so you never type it again. Older versions do not do this. They only save what you type in Settings.

Litos only watches. It never types, clicks, or sends anything on its own. It only saves what you typed yourself. There are seventeen things it can learn, and nothing else:

• Phone, city, state, zip, country
• LinkedIn link, GitHub link, portfolio link
• Citizenship and birthday
• Start date, and how long you can work
• The pay you want
• GPA, GPA scale, major
• How you heard about the job

Anything else, including anything that looks like an essay, is not saved.

Three promises. One: it never learns your answers about being allowed to work, needing sponsorship, or your race and gender. The extension says no, the server says no again, and there is nowhere to put them even if it tried. Those answers only ever come from what you tell Litos yourself. Two: it never writes over you. What you type in Settings always wins. Three: it stops. Learning ends when setup ends, and it never starts again.

Applications are sent only when you press Send, unless you have active trial or paid Litos+ access and have turned on the separate setting that lets Litos send without asking you each time. Free filling never requires this setting: Litos fills the form, then waits for you to use the employer's own button on the employer's site. With the setting on, Litos may send an application you started once it has checked that every answer is backed up and that the page puts nothing in the way. In the extension you get a 15-second countdown, and one click cancels it. From the dashboard it can go as soon as those checks pass. Missing or conflicting facts, anything you have to swear to, a check that you are human, a page Litos cannot drive, and any confirmation it is unsure of all stop it and wait for you.

Many job forms ask if you are allowed to work in that country, and if you need a visa sponsor. When you choose to fill a form, the Chrome extension and the dashboard both write your answer into the employer's form. That answer comes from what you told Litos during setup, or from a change you made later in Settings. Litos never guesses it from your school, where you live, or the job. Litos leaves the question for you when you have no answer saved for that country, or when the job does not name a clear country. The Chrome extension also leaves it for you when the box asks you to type your answer, when the question also asks about something else (like citizenship, a security clearance, or your start date), or when the question is already answered.

Your answer goes to an employer only inside an application you chose to fill. The extension gets it from our servers each time it fills a form. It does not save the answer in your browser.

In the Chrome extension, the first time it fills this answer, it shows what it used, for example “Work authorization: Yes (from your onboarding answer)”, with an Edit link. Even if you turned on sending without asking, Litos waits until you press Looks right once before it sends.

To change your answer, open Settings, then Application details. Litos uses the new answer the next time it fills a form.

On September 8, 2026, Litos stopped finding contacts, writing outreach emails and importing LinkedIn connections. Nothing new of that kind is collected or created.

If you used them before then, what they stored stays with your account until you delete it, and it is not used for anything else. Previews of imported LinkedIn connections expire on their own. To have any of it removed sooner, email us from your account address using the address under “Export and deletion”.

Litos emails you about your own account: when an application it built is ready, if you leave setup unfinished (twice at most, about an hour and about a day later, then never again), two days before a trial turns into a charge, if a payment fails, and if an application is waiting on a check only you can do. These are on unless you turn them off. If you have not made an account yet, they go only to the email on your resume, and only after setup has shown you that address and the switch to stop them.

Job-match alerts are separate and off unless you turn them on. Every email has an unsubscribe link that works without signing in, and you can change any of this in Settings. Links in these emails carry a tag naming the email they came from, so we can tell whether an email helped. They carry nothing about you.

Some job sites email you a code before they will take your application. If you turn this on, Litos can look in the Gmail or Outlook you connected and find that code while the form is waiting for it. It only takes a code that just arrived, and only from the site you are applying to. It uses the code once. It never saves it, and it never uses this to read or send any other mail.

You choose this, and you can turn it off in Settings. If it is off, Litos stops and waits for you whenever a code is needed. It also stops for the puzzles that check you are human, for a code sent to your phone or your authenticator app, and for any step it is not sure about. Litos never sneaks past those checks.

Sending applications without asking, and finding codes, are two separate choices. You can turn either one off in Settings.

You connect Gmail or Outlook on a page run by Composio, a company we use to hold that connection for your account. Your password never goes through Litos. If you disconnect in Settings, we ask Composio to cut the connection and we remove it from our side.

The extension's setup screen asks for these, and they are optional. Whatever you enter is stored and used to answer the same questions on application forms, so you never type them twice. Leave them blank, which is what happens if you skip that section, and Litos picks “I would rather not say” every time. It never works an answer out from anything else about you.

Stripe handles payments. We never see or keep your card number. A new account's seven-day Litos+ trial does not require a card and does not schedule a charge. Paid Litos+ renews for the selected one-week, one-month, or three-month period until you cancel. Cancelling takes the same number of clicks as signing up. The link is in Settings.

These companies do work for Litos, and only for that. Each one gets only what its job needs.

• Anthropic: our only AI processor; reads your resume, profile answers and job postings to write your resumes, cover letters and answers, and to fill in forms.
• Railway: runs our servers, our database and our file storage, so everything Litos keeps about you is stored there.
• Stripe: takes payments for Litos+.
• PostHog: product analytics, as described above.
• Resend: sends our emails to you, including sign-in codes, and receives the emails employers send to the address Litos gives an application.
• Composio: holds your Gmail or Outlook connection, only if you turn on finding codes in your email.
• Upstash: keeps a short-lived list of which jobs fit you best, so the Jobs page loads fast. It holds job numbers and scores, not your resume.
• TikTok: tells us whether our TikTok ads work. Our pages load TikTok's pixel, and when you create an account or pay, TikTok gets a scrambled copy of your email that it can only match, not read.
• Google and LinkedIn: only if you choose to sign in with them.

We delete each original rendered resume file after 30 days. The immutable generated content stays with its application. If you later choose Download, Litos creates a fresh, short-lived rendering from that content. Old capability links still expire and stop working.

We delete the picture of the filled-in form after 7 days. You only need it while you are checking the form, or working out why it stopped, and it holds everything that was on the page at once, so it goes sooner than anything else.

We keep the picture of the confirmation page for as long as your account is open. It is your proof the application arrived, and that is worth having long after you sent it. Deleting your account deletes it with everything else.

A link to a resume file stops working after about an hour. If a link ends up somewhere it should not, it is already dead.

The resume you upload is read once to build your profile and is not kept as a file. Account-linked product data described above is kept for as long as your account is open. Product analytics is retained separately by PostHog. Events recorded before you sign in are not linked to your account; events recorded while you are signed in on the website carry your account identifier, and that profile is deleted when you delete your account.

A file you attach to an application yourself, like a transcript, is different. We encrypt it and keep it until you remove it or delete your account, so a later application can use the same file without us asking you for it again.

Email admin@trylitos.com from your account address to export or delete your account-linked Litos data.

Deleting removes all account-linked product data. Your account. The facts we read from your resume. Your answers, both the ones you typed and the ones we watched you type. Your emails. Your form history. Every resume we made, files and all. The files you attached yourself. Your PostHog analytics profile goes too, along with the events recorded against it while you were signed in. Events recorded before you ever signed in carry no account identifier, so there is nothing there to find or remove. You cannot undo this.

If you used contact finding before September 8, 2026, the people it found at a company are the one thing that stays. A person at a company is a real person, saved once and shared by everyone who looked up that company, so it is not yours to delete. Which people you saw, and what you wrote to them, is yours, and that does get deleted. Notes kept from that time on which kinds of emails got replies have your name stripped off, so they cannot lead back to you.

Same address: admin@trylitos.com. You will get an answer from a person.