commuter
privacy policy

Your resume is the product's input, not its product.

0pon, LLC (Washington, DC) · last updated 2026-10-20

1. What we collect

2. How we use it

Solely to operate the Service for you: parse your resume into the fact source, search compliant job sources, score matches against your gates, generate tailored documents, and bill your plan. We do not sell your personal data, use it for advertising, or use your resume or documents to train AI models.

3. Who touches your data (sub-processors)

Fonts are self-hosted; pages make no requests to Google or any font CDN.

4. Cookies

One essential authentication cookie keeps you signed in. A pseudonymous analytics identifier is stored in your browser and sent to PostHog through commuter.dev; no third-party analytics script runs on the page. One first-party cookie (cm_land, 30 days) records how you first arrived: the address of the page you landed on, the site that linked you here, and the time. We use it to learn which communities bring people to Commuter; it holds no name, email, or anything from your resume, and it is read only when you join the waitlist or sign up. There are no advertising trackers or third-party advertising cookies.

4a. The autofill browser extension (optional)

If you install the Commuter autofill extension, it works only when you open its panel and click Fill on the page in front of you, and never on LinkedIn; nothing runs in the background except opening the panel when you click its icon and finishing a fill you started, so closing the panel mid-fill does not leave a form half done. On a site other than Greenhouse, Lever or Ashby, the first Fill asks Chrome for permission for that one site; when the form sits in an embedded frame from another site, the same click also asks for that frame's site. It fetches your own profile (name, contact details, the city, state and country from your application facts, work history, education, skills) and the CV and cover letter Commuter rendered for that posting, and fills the form fields it can answer from that material. It never invents an answer: a field your profile cannot support is left blank and highlighted. It never submits an application; you do. It is part of the Professional and Scale plans and of the free period. It sends nothing to anyone but Commuter. It authenticates with a personal token you generate in Settings, stored only in your browser; generating a new one replaces the old one, and revoking it disables the extension at once.

What it sends Commuter. It sends the page address, so we can find your documents for that posting. On Greenhouse, Lever and Ashby it first fills what it can from built-in rules; for the fields still empty after that, and on any other form (Workday, iCIMS, a company career page), it also sends those empty fields' labels, types, placeholder text, and the choices in their dropdowns, never anything already typed or selected in the form. Commuter passes those field details (not the page address), your fact source and contact details (name, email, phone, links), and the posting to our model provider (Anthropic, under our API agreement, not used to train their models), which proposes an answer for each field; Commuter then checks every proposed answer against your fact source and drops any it cannot support. Each call counts against your monthly assistant budget. We keep the page address, the field details we sent, every answer the model proposed (including those we rejected) and the answers we returned, with your tailored documents, for as long as your account exists (section 5); they are deleted with it (section 6), so you can see exactly what was asked and answered. Fill can also send the text of free-text questions the form left blank, on the same terms, so Commuter can draft answers you review in the form before you submit anything. If you click "Remember these" in the panel, the answers you typed into fields it left for you are sent to Commuter together with those questions, kept in your fact source (plain text, up to 100 of them), and used to answer the same question on later forms; nothing you type leaves the browser without that click.

We log the calls (which endpoint, when, which account) for abuse control. When you click Fill, the extension also reports to our analytics (PostHog, routed through commuter.dev, as in section 4) that a fill started, completed, or failed, with the name of the applicant-tracking system when it is one of the three above, and counts of fields filled and left, tied to your Commuter account. On a failure the event also carries which step failed and an error: Commuter's own message, or Chrome's permission error with any address removed; any other error is reported by its type alone, so nothing read from the page can travel with it. Those analytics events never include the page address, a field value, or page content.

4b. Seeding a sograph profile (optional)

sograph (getsograph.com) is another 0pon, LLC product: an anonymized skills graph where members record their skills and employers ask for introductions. From Settings you can ask Commuter to seed a sograph profile for you. Nothing happens unless you click that button. When you do, Commuter sends sograph your sign-in email, the time you clicked, the country your connection came from, and the list of skills from your locked fact source. It sends nothing else: no resume text, no employers, no titles, no name. sograph refuses the seed if that country is in the UK, EU, EEA, or Switzerland, or if the email already has a sograph account that was not created this way. sograph creates a member for that email, marks every imported skill as unconfirmed until you confirm it there, and sends you its own sign-in link. From then on that profile is governed by sograph's privacy policy, and you delete it there. Commuter keeps only the fact that you seeded it, when, and how many skills were accepted, so Settings can show you; that record is deleted with your account (section 6).

5. Where it lives and how long

Your live data is stored on infrastructure we control, isolated per account. We keep it while your account is active. Accounts inactive for 12 months are deleted after an email notice. Waitlist emails are kept until launch outreach completes or you ask us to remove yours. Encrypted disaster-recovery archives expire within 30 days; deletion tombstones prevent an older archive from restoring a deleted account during that window.

One thing survives deletion. To stop a deleted account from being re-created to reset a free trial, we keep a small anti-abuse record: hashed forms of the identifiers on the account (pseudonymized, not anonymous) - email address, phone digits, and name - plus a similarity fingerprint of the resume that cannot be turned back into its text. This record holds no resume, documents, job pool, or billing data. It lets us recognize the same hashed identifier if it is submitted again and flag a substantially similar resume; it is not used for anything else and is not shared. We keep it unless and until we stop running the free-trial abuse check.

6. Deletion and your rights

Delete your account yourself from Settings: one click immediately removes everything associated with it, including your live resume, derived profile, generated documents, job pool, sign-in email, and billing record - everything except the anti-abuse record described in section 5. Encrypted backup copies age out within 30 days and cannot be restored as a live account because the restore process reapplies a non-identifying deletion tombstone. Your generated documents can be exported before you go. Deletion is a real, tested operation, not a manual promise, and you can also email mike@0pon.com to have it done for you. We honor access and deletion requests for everyone regardless of jurisdiction.

Where we operate. The Service is operated from and directed to the United States. We do not currently accept signups from the United Kingdom, the European Union, the wider EEA, or Switzerland, and requests from those regions are refused at the door rather than accepted and stored, because we would rather turn someone away than hold their resume under terms that do not properly cover them. If you reached us from one of those regions and believe we hold data about you, email mike@0pon.com and we will find and delete it.

7. Security

All access is authenticated; every user's data is isolated from every other user's, and that isolation is covered by automated tests and independent adversarial review. Data moves over TLS everywhere, including between our edge and backend over an encrypted private network (Tailscale).

8. Children

Commuter is for adults seeking employment and is not directed to anyone under 18.

9. Changes and contact

Changes are posted here with an updated date. Questions: mike@0pon.com, 0pon, LLC, Washington, DC.