Effective Date: February 10, 2026
Apply ("we", "us", "our") provides a web dashboard and Chrome extension that help startup founders auto-fill accelerator applications. This policy covers both the website at applyin.oqim.com and the Apply Chrome Extension.
1. What We Collect
From the Web Dashboard
- Account information (email, name) via Supabase authentication
- Startup details you enter (company info, team members, traction data)
- Application answers you write or that AI generates for you
- Documents you upload (pitch decks) for AI data extraction
- AI chat conversations (messages you send to the AI assistant)
- Usage data (feature usage, AI token consumption per session)
From the Chrome Extension
- Screenshots of application form pages — captured temporarily during the fill process for AI-powered field analysis and visual review. Screenshots are sent to our server, processed, and not stored permanently.
- Form field content — question text, field types, and surrounding HTML of form fields on supported accelerator portals, used to match fields to your pre-written answers.
- Page URLs — the URL of the active tab is read to detect which accelerator program you are on.
- Your authentication token is stored in
chrome.storage.session (cleared when the browser closes). - Your startup data and answers are cached in
chrome.storage.local for up to 1 hour to reduce API calls. This cache is cleared on sign-out.
2. How We Use It
- To provide the auto-fill service across supported accelerator portals
- To extract structured data from your uploaded documents using AI
- To generate, polish, and refine your application answers using AI
- To match form fields to your pre-written answers using AI analysis
- To visually verify filled fields for accuracy (screenshot review)
- To track your usage against plan limits (token budgets)
3. Chrome Extension Permissions
The extension requests the following permissions, each for a specific purpose:
- storage — Store your authentication token and cache startup data locally
- activeTab — Detect which accelerator portal you are currently visiting
- tabs — Navigate multi-page application forms and capture screenshots for AI field analysis
- scripting — Re-inject the content script after page navigation within multi-step forms
- identity — Authenticate you via your Apply account using a secure web auth flow
- offscreen — Maintain the service worker during long-running fill operations
- Host access — The extension only activates on specific accelerator portals: Y Combinator, Typeform-hosted forms, Airtable forms, Google Forms, and a curated list of accelerator websites. It does not run on any other websites.
4. Third-Party Services
- Supabase — Database, authentication, and file storage (hosted on AWS)
- Google Gemini API — AI processing for document extraction, answer generation, field matching, answer polishing, and chat conversations. Your data is sent to Google's API for processing but is not used to train their models.
- Upstash Redis — Rate limiting (no personal data stored, only request counts)
- Vercel — Web application hosting
- Polar.sh — Payment processing (we never see or store your card details)
5. Data Storage & Security
Your data is stored in Supabase (PostgreSQL) with row-level security — each user can only access their own data. Documents are stored in Supabase Storage with per-user access policies. All data is transmitted over HTTPS. The Chrome extension communicates exclusively with our API at applyin.oqim.com over HTTPS.
6. Data Retention
- Account data is kept as long as your account is active
- Screenshots captured during fill are processed in memory and not stored permanently
- Extension local cache expires after 1 hour or on sign-out
- When you delete your account, all data is permanently removed within 30 days
7. Your Rights
- Export all your data at any time (Settings → Export Data)
- Delete your account and all associated data (Settings → Delete Account)
- Edit or remove any stored information at any time from the dashboard
- Sign out of the extension to clear all locally cached data
8. What We Never Do
- Sell or share your data with third parties for marketing
- Share your data with other users
- Auto-submit applications — you always review and submit manually
- Access websites outside the supported accelerator portals
- Read form data on websites other than the listed accelerator portals
- Store payment card details (handled entirely by Polar.sh)
- Use your data to train AI models
9. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice. Continued use of the service after changes constitutes acceptance.