简历助手 · 雏鹰
浏览器扩展隐私政策

Effective date: 2026-10-03 · Last updated: 2026-10-03 · Applies to: the 简历助手 · 雏鹰 (Resume Helper · Eaglet) extension for Microsoft Edge.

1. What the extension does, and where data goes

The extension does three things: it signs in to the backend with your own account and reads the resumes under it; it fills the resume you selected into the web form you are looking at (自动填充当前页面, "fill the current page"); and it offers an optional AI 辅助填充 ("AI-assisted fill") that sends your resume and the current page to an AI so it can propose values (a membership feature — see 2.2).

It talks to exactly one backend address, https://eaglet.net.cn/apply/api by default. That address is a constant compiled into the package, and there is no user interface for changing it (the About page only displays it). The extension sends requests to no other server.

This table is the complete data flow; the sections below expand each row:

2. Data that leaves your browser

Three cases: signing in; AI-assisted fill, which happens only when you actively use it; and a config read that sends none of your data.

2.1 Signing in: username and password

The username and password you type into the extension's side panel are sent to the backend your own account lives on (the source default is https://eaglet.net.cn/apply/api) to obtain a session token. Reading your resumes and sending chat messages afterwards are authenticated with that token (a Bearer token in the request); the password is not sent again.

2.2 When you use "AI-assisted fill"

Four things are needed for this feature to work. It happens only after you click that button and actually send a message:

1. The fields in your selected resume that are already filled (empty fields are neither listed nor sent). They include what a Chinese graduate recommendation form or job application asks for — gender, date of birth, ethnicity, native place, political status, marital and parental status, height and weight, second major, thesis title, English test level and score, emergency contact. But never the national ID number: it is the one field in that group where a leak cannot be undone, and it is not worth handing over whatever the form asks. Rule-based fill still fills an ID-number field; the model simply never sees it.
2. The Chinese labels, control types and already-filled flags of the fillable controls on the current page (not the values already typed into them).
3. The current page's title and body text (usually that job posting; capped at 4000 characters by default, configured by whoever operates the backend).
4. Whatever you type into that chat box.

This is sent first to the backend above, which forwards it to the AI provider you selected in the extension (the choices are configured by whoever operates that backend and may include third-party model providers). The request also carries the id of the one provider you selected — a random id that tells the backend where to forward, and contains none of your identity information.

Whether to use this at all is your choice. If you never click that button, none of the above is sent. Two limitations are worth stating plainly: it is a membership feature — on an account without it the button is disabled and shows an "unlock VIP" hint, which does not affect ordinary fill; and it requires the backend to have an AI provider configured, otherwise the model dropdown is empty and messages cannot be sent.

The text this path writes into the page is model-generated, not verbatim from your resume, and it is written automatically once the model proposes it. The protections for that path are in section 4.

2.3 Reading the runtime config when the side panel opens

When the side panel opens, the extension fetches four values from the same backend: the share link, the page-body cap, how many chat turns to keep, and the models selectable in the "model" dropdown (each model's name and per-answer cap — never a provider's address or key).

This is a plain read: no account, no token, no page content, no request body. The only thing that leaves is the request for that config itself, and only those values come back. It does not identify or record you. If you never open the side panel, this request never happens.

3. Data stored only on your machine

The following are kept in the browser's local storage, chrome.storage.local. None of them are uploaded, synced, or shared with anyone:

• The session token — issued by the backend after sign-in, used to prove to the same backend that it is still you. Deleted when you log out or uninstall.
• The resume you selected — written briefly to local storage so the filling script in the page can read it. Cleared on logout.
• Your "AI-assisted fill" conversation — what you typed into the chat box and what the model replied (only the last few turns). It survives closing the panel and restarting the browser, is deleted when you log out, and can be cleared at any time with the "new conversation" button in that chat box. It is keyed to the account, so a different account never sees the previous person's conversation. The backend does not store it.
• The model you selected — the id of the provider chosen in the "model" dropdown. It is a preference that contains no personal information, so logging out does not clear it.

4. Page content that is read and written

4.1 Read

Only after you click "自动填充当前页面" in the side panel, and only for the current tab, does the extension read that page's form fields (names, label text, placeholder hints) to work out which field corresponds to which resume item.

• What it reads never leaves the browser; it is used locally for matching and filling.
• The extension requests no persistent host access to ordinary websites and registers no automatically running content scripts. It never appears on a page you did not click for.
• It does not read other tabs, browsing history, bookmarks, or downloads.

AI-assisted fill reads a little more: besides those form fields, it reads this page's title and body text (4000 characters by default) so the AI knows what the posting asks for. Like the items in 2.2, that text is read and sent only after you click that button.

4.2 Writing and undo

Matched fields receive the exact text from the resume you selected. The extension does not invent values, does not overwrite fields you have already filled in, and does not tick any consent checkbox on your behalf.

Radio button groups are filled too — on a job application, gender, political status, marital status and "has children" are usually a set of radio buttons. The rule: an option is selected only when its text matches the resume value (a resume saying 男 matches options 男 and 男性, not 女); if nothing matches, the whole group is left alone. A group someone has already answered is left alone as well — replacing a choice that has already been made is far worse than filling one field less.

On the AI-assisted path the text written into the page is model-generated, not verbatim from your resume (the wording may be adapted), and it is written automatically once the model proposes it. The protections on this path are therefore: fields that already have a value are never overwritten, checkboxes and radio buttons are never touched (the "fill by group" rule above belongs to the rule-based path only — here a group is not even in the list of fillable controls), and the side panel immediately lists every field it wrote with an undo button. The AI sees only the resume fields you have already filled (except the national ID number), and the prompt explicitly forbids inventing anything not present in them (expected salary, ID expiry date, family members, and so on). Whether to use this path is your call — please review those fields before submitting.

On either path, afterwards the extension's browser side panel lists every field, the value used and the evidence for the match, with an undo button that restores the previous values. That undo covers radio groups too: restoring one means putting the group back to "nothing selected", which is exactly the state it had to be in for the extension to fill it. The page itself only shows a short line that fades away (how many fields were filled) — nothing is drawn over the page, and that list lives in the panel's memory only: closing the panel drops it and nothing is written to storage. (The AI conversation is a separate case: it is saved locally as described in section 3, and cleared on logout.)

5. The control you have

• Whether to use AI is your decision — if you never click "AI-assisted fill", no resume or page content is sent to an AI.
• Undo — every fill comes with a per-field list and an undo button that restores every field it wrote (radio groups included).
• Clear the AI conversation — the "new conversation" button clears both the on-screen log and the copy stored on your machine.
• Log out — clears the local session token, the selected resume and the AI conversation in one step. Please log out before handing the machine to someone else.
• Uninstall — the browser removes the extension's local storage with it.
• View or change your resume — the resume itself lives on the backend your account belongs to, where you can view and edit it in the student dashboard (eaglet.net.cn/apply/pages/dashboard). The extension only reads it; it never modifies it.
• Delete server-side data — that is the responsibility of whoever operates that backend. The extension stores nothing on the server and cannot reach it.

6. What it does not do

• No browsing history, bookmarks, or downloads.
• The clipboard is never read. The only clipboard use is a write: when you click the "share" button in the panel, the extension puts one fixed share link on your clipboard — a public site address, never any of your data. Nothing else touches the clipboard.
• No analytics, no telemetry, no selling or sharing of data, and no data brokering.
• No remote code: all logic ships inside the package, uncompressed and unobfuscated. (The AI path is a plain API call — no model or script is downloaded and executed.)
• Not directed at children: the extension is for job seekers and does not knowingly collect children's personal information.

7. Retention and deletion

• Local data: cleared on logout, and removed by the browser when you uninstall.
• Server-side data: the responsibility of the backend you deploy or use. What it stores and for how long depends on that service and your configuration; the extension neither controls nor participates in it. The backend the official build connects to (https://eaglet.net.cn/apply/api) is operated by Beijing Langsheng Yingcai Technology Co., Ltd.
• The extension runs no server of its own and retains no data with any third party.

8. Changes and contact

If a future version behaves differently from what is written here, this policy will be updated first and the change noted in the release notes; the "last updated" date above will change with it.

For any question, request or deletion request about this policy or about data handling, contact us:

• Email: 13483322210@163.com
• Or via the support contact listed on the extension's Microsoft Edge Add-ons listing page

Operator: Beijing Langsheng Yingcai Technology Co., Ltd. This policy covers the 简历助手 · 雏鹰 browser extension; data handling by the eaglet.net.cn website and student app itself is covered by the separate privacy policy published on that site.