Korosta Privacy Policy
Last updated 6 October 2026
Korosta is developed and operated by Jose Covarrubias under the CovaTools name. This notice explains what the extension processes on your device and what information may reach us when you visit covatools.com, contact us, or use licensing features. Korosta does not upload the job data it processes during normal use.
1 Who operates Korosta
Controller: Jose Covarrubias (CovaTools), Mexico. Privacy contact: privacy@covatools.com. Website: https://covatools.com/privacy. These details also cover messages you send through our support and feedback channels.
2 Information kept in your browser
When you use Korosta on a job page, it may read the page content needed for the Cookbook and Recipe you selected, including posting titles, companies, descriptions and page addresses. It uses this information to organize, rate, hide and highlight postings. Cookbooks, custom Recipes, ratings, hidden companies, preferences, relevant posting evidence and apply-run history are stored in your browser on your device. Korosta does not send this material to CovaTools, Polar or an analytics service during normal use. If you choose to send us a screenshot, Recipe or backup for support, we receive only what you send.
Korosta does not use browser storage sync for this data. You can manage it in the extension or browser, and uninstalling normally removes the extension's local storage. The extension automatically removes apply-run history after 120 days and posting evidence after 45 days; other local settings and ratings remain until you remove them. Browser backups or copies you export are controlled by you and your browser provider.
3 Browser permissions
Korosta requests storage, tabs, activeTab, scripting, contextMenus, alarms and unlimitedStorage; its Chrome build also requests sidePanel. Site access lets Korosta work on job pages you configure or use, including custom Recipes. These permissions allow local page reading and display changes; they do not mean page content is sent to us. The exact site-access pattern shown by a browser is the one in the installed extension. Korosta uses information obtained through browser permissions only for its stated features and does not sell it or use it for advertising, credit decisions or unrelated profiling. Its use of information from Chrome APIs follows the Chrome Web Store User Data Policy, including Limited Use requirements.
4 Purchase and license requests
You can use the free features without giving us an account or email address. When the extension requests a Pro purchase link, it sends the product identifier to our licensing service. If you activate a license, the service receives the key you enter and a public key generated by this installation. It stores customer and provider identifiers, license and purchase references, purchase dates, paid, refunded or revoked status where applicable, entitlement status, an installation record and the public key or its hash. We use these records to verify entitlement, activate, refresh and deactivate the license, process refunds and respond to support requests. The private key remains in your browser. The public-key hash is not derived from hardware identifiers. License requests do not contain job pages, Cookbooks, ratings or browsing history. Cloudflare may process ordinary request metadata such as IP address and time when it serves these requests.
The licensing service uses hashes derived from the IP address that Cloudflare supplies with a request, as well as license keys and identifiers, to apply rate limits and prevent abuse. It also writes sanitized operational logs, such as the route called, the response status and the request latency. These sanitized logs do not include license keys, license tokens, email addresses or customer or order identifiers. Rate-limit data and these logs are used to operate, secure and troubleshoot the licensing service, rather than to analyze your job-search activity. Korosta does not collect extension usage analytics or upload job data during ordinary use.
In Firefox, Korosta asks for optional data consent before it contacts the licensing service to request a purchase link, activate a license, refresh license status or deactivate a device. Firefox labels the requested categories authentication information, personally identifying information, and financial and payment information. For Korosta, these cover license credentials, installation and customer identifiers, and the purchase and refund information used to manage Pro; they do not mean the extension reads your credit-card details. Until you consent, the Firefox extension does not contact the licensing service, and if you decline, the Free features remain available locally.
You can revoke consent at any time in Firefox’s Add-ons Manager: about:addons → Korosta → Permissions and data. Revoking consent stops future licensing requests from the extension. Existing Pro access remains valid until its current signed expiry; revoking consent does not extend that expiry.
Revoking consent does not delete server records we already hold, stop payment-provider webhooks or purchase and refund processing, or release a device slot. To release a device slot, deactivate the device while licensing consent is enabled, or contact support. Removing the local license only clears license data on your device.
This consent prompt and control are provided by Firefox and do not apply to the Chrome build.
If a Pro checkout link is offered, it takes you to Polar, the merchant of record. Polar handles payment and billing information under its own terms and privacy policy. CovaTools does not receive your complete card details; it may receive the customer, purchase and license identifiers, dates and status (such as paid, refunded or revoked) needed to deliver Pro, handle a refund or resolve a support request. Card details are entered on Polar’s checkout and are not sent by the extension to our licensing service. Transaction information received from Polar forms part of the licensing records described above. Not every license necessarily originates from a Polar purchase; we may also issue a license directly. Purchasing and license activation are optional.
5 Website, forms and email
Cloudflare hosts the website and may process normal web request and security data, including IP addresses, requested URLs and request times. Cloudflare may also retain request logs to operate, secure and troubleshoot the site. The Support and Product Feedback forms on the site are embedded from Tally. Loading a form connects your browser to Tally; submitting one sends Tally the information you enter, such as a name, email address, message or attachment, which we use to respond or review feedback. Please do not send passwords or sensitive personal information. Purelymail handles email sent to or from CovaTools. We do not add advertising or usage analytics to the extension or our website; the embedded form and other providers may use their own necessary technologies under their notices. We do not sell personal information.
Our website links to the public Korosta Cookbook repository on GitHub. Following a link or downloading a file connects your browser to GitHub, which processes request and account information under its own privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. Korosta does not automatically fetch files from the repository or upload your local extension data to it. Issues, comments and contributions you submit to the public repository are visible to others; we use the information you choose to publish to review contributions and respond to reports. Do not publish license keys, backups or personal job-search data there.
6 How long information remains
Local data remains subject to the controls and cleanup described above. We keep correspondence and form submissions while needed to answer or follow up on them, and license, customer, purchase and refund records while needed to verify entitlement, provide the purchase, handle disputes, refunds and support requests, and meet legal obligations. Refund, ownership and license-administration audit records are not automatically deleted; they help verify ownership, preserve an audit trail and prevent a refunded or revoked license from being reinstated by mistake. Rate-limit hashes are used for rate limiting and abuse prevention. Sanitized operational logs are retained under the retention settings and limits of Cloudflare’s logging service. We do not use either to build usage profiles. Cloudflare, Tally and Polar may retain technical or transaction records under their own policies. Public repository content and related records remain subject to GitHub’s retention and deletion controls.
7 Your choices and requests
You can delete local Korosta data using the extension or browser. We cannot access, recover or delete data that never left your device. For information we do hold, email privacy@covatools.com to ask what we have, correct it, request deletion, object to a use, or limit an optional use or disclosure. Describe the information or purchase involved and how we can reply; we may ask for enough information to verify the request. We will respond within the time required by applicable law. Deleting a license record may end access to Pro. For data held independently by Polar, Tally, GitHub or a browser store, you may also need to contact that provider.
8 Changes and contact
We will update this notice at https://covatools.com/privacy when our practices change and revise the date above. We will give additional notice or seek consent if required for a material change. Questions and privacy requests: privacy@covatools.com.