Extension Privacy Policy

1. What the Extension Does

The extension replaces your browser's new-tab page with a personal ZiadaKamao dashboard: your daily tasks, recommended job opportunities, your listed services, recent blog posts, quick sticky notes, a simple to-do checklist, quick-access shortcuts, and a Job Board of admin-posted job listings you can apply to. It requires an existing ZiadaKamao account — there's no separate extension-only account, and it never creates one on its own.

AI-drafted Job Board applications are free for every account, with no daily limit. Nothing is sold inside the extension.

2. Information the Extension Accesses

• Your session token — once you sign in, the extension stores an access token and a refresh token so you stay signed in between browser sessions. Your password is never stored by the extension, at any point — it's sent once, directly to ZiadaKamao's login endpoint, the same way the website itself handles it.
• Your profile — name, email, avatar, and skills, read from your existing ZiadaKamao account to personalise the dashboard and to match job recommendations to your profile.
• Your tasks, opportunities, services, sticky notes, to-dos, quick links, and blog feed — the same data already associated with your account, shown here for convenience. Sticky notes, to-dos, and quick links you create in the extension are the same ones shown in (or specific to) your ZiadaKamao account — never a separate copy visible to anyone else.
• Your Bookmarks Bar — only if you click "Import Bookmarks Bar" in Quick Access. When you do, the extension reads the titles and URLs in your Bookmarks Bar folder (including any subfolders in it) once, to copy them into your Quick Access shortcuts. It is never read automatically, in the background, or at any other time — and nothing is ever added, changed, or removed from your actual bookmarks.
• Your resume — if you've uploaded one to your profile on the website, the extension reads it only at the moment you choose to apply to a Job Board listing, so it can attach it to that application email. It is never read or used for any other purpose.
• Your connected Gmail account's email address — once you connect Gmail (see section 5), the extension shows "Connected as you@gmail.com" so you always know which account your applications send from. This is separate from, and requests more than, the identity check used for Google Sign-In in section 4.
• Usage activity within the extension — which features you use (e.g. opening a job listing, sending an application, viewing a sticky note) is recorded against your account so we can understand how the extension is used and improve it. See section 8 for how this is stored and shared.
• Theme preference — whether you last used light or dark mode, remembered locally so it doesn't reset every time you open a new tab.

3. Signing In Without Asking Twice

If you're already signed into ziadakamao.com in your browser, the extension can detect that and sign you in automatically — you're never asked to log in twice. It does this by checking for one specific, existing login token that the ZiadaKamao website already stores on its own site when you sign in there.

To be precise about what this does and doesn't do: the extension only runs this check on ziadakamao.com and www.ziadakamao.com — no other website, ever. It reads one specific stored value (your existing login token), not your browsing history, not page content, and not anything you type or view on the site. If that token isn't present — meaning you aren't signed in on the website either — nothing happens, and you'll see the normal sign-in screen.

4. Signing In With Google

The "Continue with Google" option on the sign-in screen opens ZiadaKamao's existing Google sign-in flow — the same one the website uses — through Chrome's built-in identity feature. This lets you approve the request in the standard Google consent screen, exactly as you would on the website. This sign-in step alone does not request or receive access to your Gmail, Drive, contacts, or any other Google data — only enough to confirm your identity and complete sign-in to your ZiadaKamao account.

Connecting Gmail to send job applications, described next, is a completely separate, opt-in action — it is never triggered by, or required for, signing in.

5. Applying to Jobs Through Your Own Gmail Account

The Job Board shows job listings our team posts for every ZiadaKamao user. If you choose to apply to one, the extension uses AI to draft a personalised application email from your profile, which you can review and edit. To actually send it, you connect your own Gmail account once (via "Connect Gmail" or the first time you hit "Send") — this requests Google's gmail.send permission, a narrow, send-only scope.

With that permission, the extension can only:

• Send the one application email you explicitly review and click "Send" on, from your own Gmail account, to the employer contact address shown on that listing, with your resume (if uploaded) attached.

The extension cannot, and never does, use this permission to:

• Read, search, or view any email already in your inbox, Sent folder, or anywhere else in your Gmail account.
• Modify, label, forward, or delete any existing email.
• Access your Google Drive, Google Contacts, Google Calendar, or any other Google product or data.
• Send any email automatically, in the background, or without you explicitly clicking Send on that specific application.
• Send marketing, promotional, or bulk email of any kind.

ZiadaKamao's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. Where Your Data Is Stored

• On your device — your session token and theme preference are stored using Chrome's extension storage, sandboxed to this extension. No other extension or website can read it, and it's separate from your browser's regular history or cookies.
• On ZiadaKamao's servers — your account data (profile, tasks, opportunities, services, sticky notes, to-dos, usage activity) lives in the same secured database that powers the main website, described in full in the main Privacy Policy.
• Your Quick Access shortcuts (including any imported from your Bookmarks Bar) — stored using Chrome's extension storage on your own device, scoped to your ZiadaKamao account. Bookmarks you import are copied in as plain shortcuts at that moment; nothing keeps reading or syncing from your actual Bookmarks Bar afterward.
• Your resume file — stored via Cloudflare R2, our secure file storage provider, accessed only through short-lived, authenticated links generated on demand — never a public URL.
• Your sent application emails — sent directly through Google's Gmail API using your own credentials; ZiadaKamao's servers never see or store the email content, and a copy lands in your own Gmail Sent folder exactly as if you'd sent it yourself, because you did.

7. Permissions the Extension Requests

Chrome requires every extension to declare exactly what it can access. Here's what each one is for:

• Storage — to keep you signed in and remember your theme, as described above.
• Identity — used for two separate things: completing Google Sign-In (section 4), and — only if you choose to — connecting Gmail to send job applications (section 5).
• Bookmarks — used only when you click "Import Bookmarks Bar" in Quick Access, to read your Bookmarks Bar once and copy it into your shortcuts, as described in section 2. Never used automatically or in the background.
• Access to ZiadaKamao's own backend — the primary server the extension talks to, to load and save your dashboard data.
• Access to Gmail's API and our file storage provider (Cloudflare R2) — used only to send an application email you trigger (section 5) and to fetch your resume for that same email.
• Running on ziadakamao.com — to check whether you're already signed into the website, so the extension doesn't ask you to log in a second time.

The extension does not request access to your browsing history, your other tabs, or any website other than ziadakamao.com.

8. Data Sharing

The extension does not sell, rent, or share your data with any third party for advertising or marketing purposes. It communicates with three parties, each for one specific purpose:

• ZiadaKamao's own backend — to load and save your dashboard data, and to record the usage activity described in section 2, which our team can review (tied to your account) to understand feature usage and improve the extension. This is not shared onward with anyone else.
• Google's Gmail API — used only to send an application email you explicitly trigger, as described in section 5, governed by Google's own privacy terms for that request.
• Cloudflare R2 — our file storage provider, used only to store and retrieve your uploaded resume.

There are no advertising networks or third-party marketing trackers of any kind bundled in the extension.

9. Your Choices

• Disconnect Gmail — click "Disconnect" next to your connected account in the Job Board at any time; this revokes the extension's access and it can no longer send anything until you connect again.
• Remove your resume — delete it from your Profile page on the website at any time.
• Log out — from the profile menu in the extension, which immediately clears your session token from this browser.
• Uninstall — removing the extension from chrome://extensions deletes everything it stored locally on your device.
• Delete your account — deleting your ZiadaKamao account from the website's Settings page removes your underlying data everywhere, including anything the extension displays. See the main Privacy Policy for details.

10. Children's Privacy

The extension is not intended for use by anyone under 18, consistent with ZiadaKamao's main Privacy Policy.

11. Changes to This Policy

If how the extension handles your data changes, we'll update this page and the effective date above. Significant changes will also be reflected in the extension's Chrome Web Store listing.

12. Contact Us

Questions about the extension specifically, or about your data generally, can be sent to: support@ziadakamao.com