LinkedIn Resume Extension: Permissions and Data

ExportMyResume’s extension reads your own LinkedIn profile in your browser. The extracted resume is handed to the web editor locally. That does not mean the product makes no network requests: production diagnostic events are reported, and a failed import can include your profile identifier. AI, signed-in sync, and PDF/Word export have separate server flows.

This page describes the implementation checked on September 6, 2026. ExportMyResume is independent of LinkedIn and is not affiliated with or endorsed by it.

Requested permissions

Permission	Use in this extension
activeTab	Temporary access associated with a user action, used when checking the active profile tab
scripting	Run the code that reads the rendered LinkedIn profile
sidePanel	Display the import panel beside the page
storage	Store the last import, panel language, and installation identifier locally
Host access: https://www.linkedin.com/*	Persistent site access for the LinkedIn import flow

There is no <all_urls> host permission. However, that fact alone doesn’t prove an extension can never access another active tab or send a network request. Chrome’s activeTab documentation describes temporary access granted by a user action. The current import code separately checks the LinkedIn page and requires confirmation that it is your own profile.

Permission names describe capabilities. The data flows below describe what the current implementation uses them to do.

What happens during import

1. Click Import my profile. The extension checks that the open page is your own LinkedIn profile and stops if that cannot be confirmed.
2. It reads the rendered top card and the profile’s Contact info overlay.
3. It visits the profile’s section pages for experience, education, skills, and the other supported sections, reading what LinkedIn renders.
4. It merges the sections and stores the resume in browser extension storage.
5. Clicking Open Editor transfers that resume to the web editor through a URL fragment, which the browser does not send as part of the HTTP request. The editor stores the working resume locally.

The import doesn’t read LinkedIn passwords or session tokens and doesn’t use LinkedIn’s internal API as a second data source. Navigating LinkedIn pages still makes the normal requests needed to load them. The extracted resume content is not uploaded to ExportMyResume as part of the import handoff; diagnostic reporting is described separately below.

Long sections may load incompletely, and changes to LinkedIn’s markup can affect parsing. Compare imported entries with your profile before editing or exporting.

Features that send resume content to a server

AI improvement. Running Improve with AI sends resume content to ExportMyResume’s API, which forwards it to Anthropic. A pasted job description and any answers to the fit questions are included when applicable. The optional job URL is not fetched by the AI. The processing route does not save a separate copy of the resume. Provider handling is a separate matter; see the privacy policy. AI requires sign-in and has daily run limits, with more runs on Pro.

Signed-in sync. While signed in, the editor syncs the resume version bundle to storage hosted on Supabase. The bundle includes saved versions and associated job information: pasted descriptions, job links, fit results, and answers. Signing in for a feature can therefore also enable sync; it isn’t a fresh opt-in click for every edit. Signed-out editing keeps the working resume in browser storage.

PDF and Word downloads. These formats require Pro. Free for now during the launch offer: both downloads are available after sign-in, without a subscription. They send the resume export content to the server to generate the file. The export handler returns the file without writing the resume to storage. That is distinct from the signed-in sync copy. TXT and PNG generation runs in the browser.

Included photos. An imported photo starts as an image URL, which may be retained in a synced resume. At export, the browser attempts to fetch and embed the image before sending the export content. If it cannot retrieve the image, the file can be generated without it.

Diagnostic events

Production builds create a random installation identifier and report installation, first-open, uninstall, and import start/result events. The event fields include browser, operating system, language, and extension version.

These events don’t contain the resume’s text. On an import or section failure, the report can contain the slug identifying your own LinkedIn profile, along with the failure category and section. That identifier is personal data even though it isn’t the resume content. If you sign in, the installation identifier may be linked to the account for installation-to-purchase attribution.

Uninstalling stops future extension collection; it doesn’t itself erase data already received. The website also uses Vercel Web Analytics and, once you allow it in the cookie banner, the Google Ads tag, as described in the privacy policy. Those are separate from the extension’s import reader.

Storage and deletion

Request account and associated-data deletion by emailing exportmyresume@gmail.com, using the instructions in the privacy policy. Deletion is handled by request; there is no account-deletion button in the editor.

Account deletion removes account and resume records. Installation and purchase records can remain with their account link removed. Clearing browser storage is separate from deleting the server-side account, and can remove a local working copy you still need.

Before installing an importer

Review the permissions on the Chrome Web Store listing and in Chrome’s extension settings. Consider both what the extension can access and when its product sends data for processing.

A public-URL importer reads through the vendor’s service rather than your signed-in page. That changes the starting point and may require a publicly readable profile; it doesn’t establish that one approach is always safer. Compare the import methods alongside their actual privacy disclosures and file requirements.