What Weavenly sends

Checked against the code on November 2, 2026

Weavenly’s code isn’t public, so you can’t read it to see what it sends. Here is the list instead: every request the app and the browser extension make, written down from their code.

Weavenly has no server that stores your data. From our addresses the app only downloads files that are the same for everyone: the job list, the H-1B data and updates.

Everything else goes where you send it: your AI provider, your mail server, job boards and employers’ job pages.

The app has no analytics or telemetry. The browser extension talks only to the app on your computer, apart from one request for a job’s page, described below.

The app on your computer

The job list and H-1B data

When: When the job search runs: 30 seconds after the app starts, then every 6 hours (Settings → Job search → Refresh every, 1 to 24 hours) and when you press Refresh in Jobs → Found. The H-1B file downloads again only when a new one is published. The job list is also read when an interview invitation names a job the app doesn’t know yet, to find its description.
Where it goes: index.weavenly.app, our public files
What is sent: A request for the list’s table of contents (manifest.json), then for the parts of the list your roles need. The list is split into broad job areas (like engineering or design), so those areas are all a request shows. The H-1B data is one file, the same for everyone. Each request carries the app’s name and version number, and a tag of the copy the app already has, so nothing downloads twice.
Never sent: Your roles’ titles, your searches, your résumé, the jobs you open, or anything else about you. Jobs are matched to your roles, and employers looked up in the H-1B file, on your computer.
Can you turn it off: Yes: Settings → Job search → Find jobs, or turn the search off in a role. The lookup for an interview invitation happens only with your email connected.

Remote job boards

When: Once a day, in the day’s first job search.
Where it goes: Himalayas, Arbeitnow, Remotive, Remote OK and We Work Remotely: himalayas.app, arbeitnow.com, remotive.com, remoteok.com and weworkremotely.com
What is sent: A plain request for each board’s newest jobs (Himalayas in five pages of 20), with the app’s name and version number. No search words.
Never sent: Your roles, titles, places, résumé or anything about you: the boards’ jobs are filtered on your computer.
Can you turn it off: Yes, together with the job search (Find jobs).

Job descriptions from employers’ job pages

When: For found jobs: up to 30 new ones each search, and a job you open in Found that has none yet. When you add a job by its link, in the app, or from the browser panel when the page itself had no description. When an interview invitation is for a job the app doesn’t know and links its posting.
Where it goes: The hiring system the employer posts on, like Greenhouse (boards-api.greenhouse.io), Lever (api.lever.co), Ashby, Workable, SmartRecruiters, Recruitee, Personio, Teamtailor, Pinpoint, BambooHR, Rippling, Breezy or Workday; or the address of the job page itself.
What is sent: A request for that one job, or for the company’s list of jobs, with the app’s name and version number. A page you add by its link is asked for the way a browser would, introducing itself as Chrome.
Never sent: Cookies or sign-ins (the app has none of yours for these sites), your résumé or your name. LinkedIn and Indeed pages are never fetched: they need a sign-in, so you paste the description yourself.
Can you turn it off: Turning off Find jobs stops the ones for found jobs. The others happen only when you add a job by its link, or with your email connected.

Your AI provider

When: When an AI feature runs: reading a résumé you add, fitting it to a job, answering a form’s questions (and translating them when the app is in Russian), rating found jobs (10 per role a day at most, by default), suggesting more job titles once for a new role, an interview prep, a follow-up email, a look at an interview transcript you add and, only if AI email sorting is on, your job mail. Also when you connect it and pick a model.
Where it goes: Only the one you connect. An OpenAI key: api.openai.com. An Anthropic key: api.anthropic.com. Your ChatGPT plan: you sign in on auth.openai.com in your browser, then requests go to api.openai.com. Your Claude plan: the app runs Claude Code, Anthropic’s own program on your computer, and Claude Code sends the request to Anthropic. Ollama: localhost:11434, on your computer, unless you type another address.
What is sent: What the feature needs: the job’s text, your résumé, a form’s questions with the About you answers they need (name, city, work authorization, salary expectation, links), a role’s job titles, a job’s notes and interview transcripts for its follow-up, and email only with AI email sorting on (its subject, sender, date and text). Your key or sign-in goes with each request, to that provider only. Signing in with ChatGPT also gives OpenAI a random id this copy of the app made, which OpenAI’s sign-in asks for. Install Claude Code, if you press it, downloads Anthropic’s installer from claude.ai.
Never sent: The street, apartment and postal code you save in About you (the AI sees an address only if your résumé has one), your mail password, anything to Weavenly. Your key goes nowhere but its own provider, and with a ChatGPT or Claude plan the app never sees your password. That provider’s own policy applies to what it gets.
Can you turn it off: Yes. With no AI connected, nothing goes to any provider. AI email sorting stays off until you turn it on, and AI ratings per role per day set to 0 turns the ratings off.

Your email

When: Only if you connect it: 5 seconds after the app starts, then every 5 minutes (Settings → Mail → Check for new mail, 1 to 60 minutes) and when you press Check now. A follow-up is sent only when you press Send.
Where it goes: Your mail provider’s IMAP and SMTP servers: imap.gmail.com and smtp.gmail.com for Gmail, the servers of Yandex, Mail.ru, iCloud or Yahoo, or the ones you type in.
What is sent: Your address and the app password to sign in, always over an encrypted connection; requests for new mail in your Inbox and Spam (the first check reads the last 30 days); and the follow-up you send, from your address.
Never sent: Changes to your mailbox: folders are opened read-only, so nothing is marked as read, moved or deleted. The app password goes nowhere but your own mail servers.
Can you turn it off: Yes: Settings → Mail → Disconnect.

Address suggestions

When: While you type your home address in About you, in the app or in the browser panel’s question window (the panel asks the app, and the app asks Photon). Your city from About you, once, so addresses near you come first; and once when you add your résumé, so your region and country fill in by themselves.
Where it goes: photon.komoot.io: Photon, an OpenStreetMap address search run by komoot (Germany)
What is sent: The words you type (from 3 characters on), your city, region and country from About you, the area within about 50 km of your city’s middle, and the app’s name and version number. Like any website, Photon sees your computer’s IP address.
Never sent: The address you choose and save, your name or your résumé. The saved address isn’t sent to your AI provider either.
Can you turn it off: There’s no switch: it runs only while you type an address there, and for the city lookups above.

Update checks

When: 5 seconds after the app starts, and when you press Settings → About → Check for updates. A new version downloads in the background and installs when the app restarts or quits.
Where it goes: weavenly.app/download, which passes it on to our file storage, downloads.weavenly.app
What is sent: The name of the update file for your system (macOS, Windows or Linux, and on Linux the processor too), and a random id that the update library makes once for this copy of the app.
Never sent: None of your data: no name, email, résumé or jobs.
Can you turn it off: There’s no switch for the check.

Your AI assistant, if you turn it on

When: When you ask an AI assistant you set up on this computer (Claude Desktop or Claude Code) about your job search, and only after you turn on Settings → Your AI assistant. It is off until you do.
Where it goes: Nothing goes out from Weavenly: the assistant’s program on your computer reads your Weavenly folder and sends what it read to the company that runs it (Anthropic for Claude), under that company’s terms.
What is sent: What the assistant asks for: your roles, jobs, notes, résumés, the senders and subjects of job emails, found jobs, follow-ups and your daily goal.
Never sent: Your passwords, AI keys, sign-ins, About you, form answers or the text of your emails. Nothing goes to Weavenly.
Can you turn it off: Settings → Your AI assistant. When it is off, the assistant only gets a note that access is off.

The browser extension

The app on your computer

When: On a job page or an application form it recognizes, and when you connect it with the 6-character code from the app.
Where it goes: 127.0.0.1:9217: the app’s own server, which only this computer can reach
What is sent: The page’s address, the job’s title, company and text, and the form’s questions; the code once, then a token with every request. It gets back your answers, About you and the résumé to attach.
Never sent: Anything to Weavenly or anywhere else on the internet: it has no server to send to, no analytics, and no fonts or pictures from the web.
Can you turn it off: Yes: turn the extension off or remove it in Chrome, or disconnect the browser in the app, Settings → Browser extension.

A job’s description page

When: On a Lever or Ashby application step (an address ending in /apply or /application), when the page shows too little of the job’s description.
Where it goes: The same job’s page on the same Lever or Ashby site, without /apply or /application
What is sent: An ordinary request for that public page, without cookies.
Never sent: Cookies, your answers or anything about you.
Can you turn it off: There’s no switch: it happens only on those application steps.

This website

Visit counts

When: Only after you press Accept in the cookie card.
Where it goes: us.i.posthog.com (PostHog, servers in the US), and its script from us-assets.i.posthog.com
What is sent: A page view: which page, the page you came from, your browser, system and screen size, and your IP address, as any website sees it. PostHog keeps its id in this browser’s storage, not in a cookie.
Never sent: Clicks, what you type, recordings of the screen, and what you paste into the recruiter check, which runs in your browser and sends nothing.
Can you turn it off: Yes: Only necessary in the cookie card, or Cookie settings at the bottom of any page. A browser that asks sites not to track it is respected too.

Something here doesn’t match what you see? Write to hello@weavenly.app. The same, in short, is in the Privacy Policy.