Legal

Privacy Policy

Last updated: May 20, 2026

Short version: Yang's Upwork Toolkit is local-first. Your Upwork profile, job history, and proposal drafts live in your browser, not on our servers. We do not collect your Upwork account or proposal history. We process your payment email only for billing and subscription restore.

1. What we do not collect

• Your Upwork username, account ID, or login credentials
• Your real name
• Your email address, except for Pro billing and explicit subscription restore
• Your payment card details (handled by Creem, our payment processor)
• The text of jobs you view, except in the narrow case described in section 4

2. The only identifier we use

When you install the extension, it generates an anonymous install_id (a random UUID) and stores it in your browser. We use this ID to:

• Check whether you are on the Free or Pro plan
• Enforce per-install rate limits on AI-assisted reviews

The install_id is not linked to your real identity. Two installations on different devices are two different IDs to us.

3. What stays on your device

The following is stored in your browser's local extension storage and is never sent to our servers:

• Your profile snapshot: title, overview, skills, proof assets, strong/weak stack lists
• Your screening rules (auto-reject thresholds, banned skills, etc.)
• Your review history
• Proposal drafts you generate
• UI preferences (language, expanded sections, etc.)

Uninstalling the extension removes all of this data.

4. What gets sent to our Worker

Our backend (a small Cloudflare Worker at upwork-toolkit-api.yangworks.dev) receives the following account and usage data:

• Your install_id
• Subscription metadata returned by Creem (plan, status, expiry)
• Your payment email when Creem returns it for billing, or when you enter it to restore a subscription
• Device binding metadata used to restore Pro on another browser profile
• A hashed restore code when you request subscription recovery
• An HMAC signature on AI-review requests to prevent replay attacks
• Hosted AI usage events and quota counters

When hosted AI is disabled, job content, profile content, and proposal drafts do not go to the Worker.

When you explicitly enable hosted AI and run an AI action, the Worker also receives a whitelisted, trimmed payload for that one action: the current job fields, a profile summary, and the local review result. The Worker uses that payload to call the AI provider and enforce quota. We do not store raw job text, profile text, or proposal drafts in our database.

5. What gets sent to the AI provider

AI-assisted review is off by default. It runs only when you:

1. Have hosted AI quota available (Free trial quota or Pro quota)
2. Have explicitly enabled AI assist in the extension settings
3. Click a specific review or rewrite action

When all three are true, we send only the fields needed for that action to our AI provider (an OpenAI-compatible endpoint):

• For job review: the current job's title, URL, trimmed description, budget, type, skills, and visible payment / proposal / hire facts
• For job review: a summary of your profile and the local review result we already computed
• For profile rewrite: the selected profile section, current value, profile summary, and action hint

We do not send: your local review history, your proposal drafts, browser exports, or raw Upwork page data.

6. Third parties

We share data with the following third parties:

• Creem — payment processing for Pro subscriptions. Creem receives the data needed to bill you (your card details and email). See Creem's privacy policy.
• Resend — email delivery for one-time subscription restore codes. Resend receives the payment email and restore email content only when you request restore.
• Our AI provider — only when you actively use hosted AI, and only the fields listed in section 5.
• Cloudflare — hosts the Worker and this site. Standard infrastructure logs apply.

We do not sell or share data with advertisers, analytics platforms, or data brokers.

7. Your choices

• Stop using the extension: uninstall it; all local data is removed.
• Delete subscription records: email [email protected] with your install_id and we will delete it from our Worker within 7 business days.
• Restore a subscription: enter your payment email in the extension and confirm the one-time code sent to that email.
• Opt out of AI assist: disable the toggle in the extension settings. The toolkit still works fully on local-only review.

8. Children

Yang's Upwork Toolkit is not directed at children under 16 and we do not knowingly collect data from them.

9. Changes

We will post material changes to this page and update the "Last updated" date. Continued use of the extension after changes are posted constitutes acceptance.

10. Contact

Questions or requests: [email protected]