Chrome extension privacy
Published 23 October 2026. Covers Pegel: Jobs from the source, version 0.1.2, currently in pre-release testing. Publishing this notice does not make the extension available in the Chrome Web Store.
Your contact details stay in Chrome until you choose to fill fields on a page. Filling shares the selected values with that page. Its scripts may save them before you press Submit. Pegel never attaches a CV or submits an application.
1. Publisher and privacy contact
Pegel is a service of Maj Labs UG (haftungsbeschränkt), represented by Elie Majorel, Riehlstraße 9, 14057 Berlin, Germany. Maj Labs is responsible for the extension service and the processing described in this notice. Company registration: Amtsgericht Charlottenburg, HRB 290131 B.
Email: pegel@mail.pegel.berlin. Full legal details: Pegel's Imprint.
This policy covers the Chrome extension. Pegel's website and support email are also covered by Pegel's website privacy policy. The application site you choose and Google's Chrome services have their own privacy policies. Installing the extension does not create a Pegel account.
2. Data the extension handles
| Data | Source and purpose |
|---|---|
| Contact details | Details you enter and confirm: full name, email and any optional first name, last name, phone number, LinkedIn profile or website. Pegel uses them to fill only the supported empty fields you select. First and last names are not inferred. |
| Vault passphrase | A secret you enter to create or unlock remembered details. Pegel derives an encryption key locally and never stores the passphrase or sends it outside the extension. |
| The selected page | The current URL, tab/window identifiers and document identity, used to bind assistance to the page you chose. Pegel does not request the history API or build a browsing-history log. |
| Form information | Form and field labels, input attributes, form action/method and whether eligible inputs are empty. Pegel checks this information locally to detect supported fields and changes to the form. Existing input values are checked for emptiness but are not copied into the preview. |
| Local control information | Random revision/authority identifiers, remembered-field choices and an interrupted-fill receipt containing a running flag and completed-field count. These prevent stale operations and report incomplete work. They are not sent to Pegel or used to track you across sites. |
URLs and form labels may contain personal information supplied by an application site. Pegel does not analyze them to infer health, finances or other sensitive characteristics. Avoid entering private access links as contact URLs.
Pegel does not read your CV, email inbox, website passwords or authentication cookies. The only password-like value it asks for is the vault passphrase you choose. It does not fill sensitive application answers, declarations or file fields. Embedded forms and custom controls stay manual. No advertising, usage analytics or hosted AI service is included.
3. Purpose and legal bases
Pegel uses this data only to provide the contact-field assistance you request and the local controls needed to keep that assistance accurate. Contact details are optional to provide, but Pegel cannot fill a value you have not supplied. Remembering is optional; session-only assistance remains available.
The legal bases for the requested service are:
- Requested assistance: Article 6(1)(b) GDPR, processing necessary to provide the service you request, including page binding and local recovery controls.
- Optional remembering: Article 6(1)(a) GDPR, your consent to keep only the fields you select in a passphrase-encrypted vault across Chrome sessions. You can stop remembering at any time as described below. Withdrawal does not affect earlier lawful processing.
- Support correspondence: Article 6(1)(f) GDPR, the legitimate interest in answering your request. The extension does not send a support message automatically.
Remembering is a separate, optional device-storage choice. Pegel asks you to choose the fields and a passphrase before storing the encrypted vault. You can use the session-only service without remembering anything. Browser permissions do not replace this choice.
4. Sharing and limited use
When you select fields and press Fill, Pegel inserts those exact values into the chosen HTTPS page. The page's scripts can read or save them immediately. Its operator and service providers process that information under their own policies. Read those policies before filling. Pegel cannot guarantee where the application site stores data or whether it transfers data outside the EEA.
The extension sends no contact details, page previews or operation receipts to a Pegel server. It has no developer-operated cloud backup or account sync. Pegel does not sell user data, provide it to data brokers, or use it for advertising, model training or creditworthiness/lending decisions.
Pegel limits its use of data obtained through Chrome APIs to the disclosed contact-field assistance and related local safety controls, in accordance with the Chrome Web Store's Limited Use restrictions. This statement concerns data use; it does not claim that an unpublished build has passed Google review or every security requirement.
Google separately handles Chrome/Web Store installation, account and browser information under its own policies. Data you send in a support email leaves the extension and is handled as correspondence under Pegel's website privacy policy. Do not send a CV or private application contents just to report a problem.
5. Storage and retention
| Storage | What remains and for how long |
|---|---|
| Chrome session storage | Confirmed contact details, the current unlock key, remembered-field choices and revision information. This is Chrome's memory-only session storage, not persistent local storage. The running/count receipt also stays in session storage until replaced or the session storage is cleared. Chrome clears this area when the browser restarts or the extension is disabled, reloaded or updated. It survives ordinary service-worker suspension. |
| Optional local storage | An authenticated encrypted vault containing only the confirmed contact fields you select under Remember details. Its random salt/IV and revision/invalidation metadata are also stored locally. No passphrase or unlock key is stored here. The encrypted saved fields remain until you change or remove them, or uninstall the extension. A new Chrome session requires your passphrase to unlock them. There is no automatic expiry. Deselecting a remembered field removes its persistent copy when the operation succeeds; its current-session copy remains. |
| Loaded extension/page memory | The current page identity, preview and conditional Undo values. They are used while a page operation is valid and cleared or replaced as that context changes. Page-side memory may remain until cleared or the page is unloaded; this is not a secure-erasure guarantee. |
| Support email | If you contact Pegel, the email address and message are retained for 12 months from the last reply, under the website privacy policy. There is no automatic upload of extension data. |
Chrome sync is not used. Closing only a window may leave Chrome running, so it is not a reliable way to clear session data. Clearing browsing history does not remove remembered extension data. Browser-profile backups and copies made outside the extension are not controlled by Pegel.
6. Your controls
Correct details: open the contact editor, change the values and choose Confirm details. Corrections invalidate the old page preview. Click the toolbar action again before filling.
Create or unlock a vault: choose a strong passphrase of at least 15 characters, confirm it and choose Remember selected. Only the checked contact fields are encrypted. Later Chrome sessions require Unlock before those saved details can be used. Pegel cannot recover a forgotten passphrase. Use Forget to remove the vault and enter your details again.
Lock: Lock saved details clears current contact details and the unlock key from extension session storage while keeping the encrypted vault. It also invalidates the page preview and clears open contact drafts. A failed lock is reported; do not assume session data is gone after an error. Restart Chrome before relying on session clearing.
Stop remembering: while the vault is unlocked, deselect fields under Remember details and choose Remember selected. Deselect all fields to remove the encrypted vault and return the current values to session-only storage. Review any reported storage error before assuming removal succeeded.
Forget: Forget in this extension clears active contact state, invalidates page authority and attempts to remove the encrypted vault, any legacy plaintext contact record and the session unlock key. It can leave non-contact revision metadata and the minimal operation count. If deletion fails, Pegel reports that retained copies may remain. Clear the extension's owned storage or remove the extension through Chrome before assuming those copies are gone.
Undo: while the page operation remains valid, Undo clears only unchanged values Pegel inserted. It preserves later human edits. Cancel stops remaining fill requests; an already dispatched field may still finish.
Undo, Forget and uninstalling cannot withdraw information the application site already received, including through autosave. They do not remove copies you made to the clipboard or elsewhere. Ask the recipient site about its retained information.
7. Security and limits
The extension restricts storage access to its trusted extension contexts. It requires an explicit toolbar action for the current HTTPS page, bundles its code locally and requests no persistent host access.
Remembered details use AES-256-GCM authenticated encryption. The key is derived from your passphrase with PBKDF2-SHA256 and 600,000 iterations, using a random 16-byte salt. Every encrypted write uses a fresh 12-byte nonce. A copy of the unlock key remains in Chrome's memory-only session storage while unlocked so an ordinary service-worker suspension does not require another passphrase. It is never stored beside the encrypted vault in persistent storage.
This protects the locked vault's persistent contents. It does not protect an already-unlocked browser or a compromised device. Someone with a vault copy can attempt offline passphrase guesses, so use several unrelated words or another strong passphrase. Protect the device and avoid unlocking on a shared profile. Pegel does not promise secure erasure from JavaScript memory, operating-system swap or backups.
On first use of this replacement build, Pegel removes the older unencrypted contact record from its live extension storage and invalidates the older session record. You need to enter those details again. Removal is checked; if it fails, Pegel blocks contact changes and reports that a retained copy may remain. Existing backups or copies outside the extension are not erased by this upgrade.
HTTPS on the selected page does not guarantee that the site is trustworthy or that its scripts will handle filled values safely. Review the destination and every proposed value before filling. CV attachment and final submission remain your actions.
8. Your rights and privacy requests
Where applicable under the GDPR, you can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You can withdraw consent for optional remembering at any time. These rights have statutory conditions and exceptions.
Use the controls above for your local contact details. Maj Labs does not receive a hosted copy of those details and cannot remotely retrieve or erase your Chrome profile. For help, or for data Maj Labs does hold such as support correspondence, contact pegel@mail.pegel.berlin. Do not send extra application data merely to make a rights request.
Pegel responds without undue delay, normally within one month. If a lawful extension is necessary, Pegel explains it within that month. Rights requests are generally free; statutory exceptions apply to manifestly unfounded or excessive requests.
You may complain to a supervisory authority, including the Berliner Beauftragte für Datenschutz und Informationsfreiheit, or the authority where you live or work.
9. Automated decisions and changes
This extension does not rank candidates, score employability or make hiring decisions. It uses deterministic field matching and does not generate application answers.
Changes to the extension's processing require an updated policy and, where required, a new choice before the changed processing begins. The date at the top records the latest published version of this notice.