TAI — Trust & Attention Intelligence

Privacy policy

Last updated 9 October 2026

What TAI does

TAI reviews your pending LinkedIn connection requests, job listings and unread-message metadata and tells you which ones you can trust, with the evidence behind each result.

What the browser extension reads

• Pending invitations: name, headline, profile link, and on the inviter’s own public profile: LinkedIn’s verification badge, location, experience, education, skills, publications, patents, honours and awards, licences and certifications, projects, volunteering, languages, courses, organisations, interests, the recommendations they received (each recommender’s name, headline and relationship as shown), and up to three recent posts.
• Jobs: title, company, location, listing date, description and application link.
• Messaging: sender name, time, unread status and the kind of conversation LinkedIn labels it (a direct message, InMail, sponsored, a message request or a group). Message bodies are never read or stored. To improve TAI’s checks, the kind of each conversation and TAI’s verdict on its sender are kept as training data, without the sender’s name (only a one-way code) and without any message text; they are deleted with your data and after the retention period. Gmail messages are never used this way.
• Your own profile, as often as your plan re-checks it (at most twice a day): the same sections as an inviter’s profile, read the same way, used to match jobs to you and to give you a Profile Score.

It reads only pages you are signed in to, in your own browser, and only when you enable collection. It never posts, connects, messages, likes or changes anything on LinkedIn, and never sees your LinkedIn password.

If you connect Gmail (Plus)

On Plus you can connect a Gmail or Google Workspace inbox, through Google’s own permission screen. TAI asks Google only for read-only message metadata (the gmail.metadata permission) and your account’s email address. For the ten newest unread messages in your inbox it reads the sender, reply-to address, subject, date, reply headers and Gmail’s authentication results (SPF, DKIM, DMARC), and, for a message that looks like a reply, only the labels of its conversation, to tell whether you wrote to that sender, and checks whether each sender is who it claims to be. TAI never reads the content of a message or its attachments, and it cannot send, delete, label or change anything. Senders and subjects are read from Gmail when you open the page and shown to you; TAI does not store them. It stores your Google tokens encrypted and, for each message, only its result (the verdict, its email trust score, the warning signs found, the authentication results and when it arrived), replaced at each check. Across all users it keeps anonymous daily counts of these results (for example, how many senders failed DMARC), with no person or message attached. To recognise spammers, scammers and bots, it also keeps, for each sender, a one-way code made from the sender’s address (it cannot be turned back into the address) and, for company domains, the domain, with counts of how often that sender was seen and found verified, unverified or suspicious; no user, name or message content is attached, and a sender not seen for a year is forgotten. When a sender was found suspicious before, TAI tells you. For a company address, TAI also opens the company’s public website once to check that the company exists, and keeps that result (the domain, whether the site works and its title) to reuse for later checks. For a company sender, two open AI models (Gemma and gpt-oss) running on TAI’s own servers, never a third-party AI service, give a one-line second opinion on whether the sender is the company it seems to be. They read only the sender’s domain and display name, the authentication results, the warnings and what the company’s site showed (never the address, subject or message); that input is held with no user attached and deleted once they have answered, and their opinion is kept for 30 days so it serves later checks. Gmail data is never used to train AI models. Disconnecting in the Inbox tab, or deleting your account, revokes TAI’s access at Google and deletes the tokens and results.

TAI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to show you these checks; it is never used for advertising, never sold, never used to train AI models, and never read by people at TAI except to fix a problem you report, with your permission.

How it is analysed

Captured items are sent to TAI’s servers, which research them on the public web: search engines (SerpAPI and fallbacks), the employer’s own website and job boards, public domain-registration records, and, where configured, company registers and a page-rendering service. Only names, company names, job titles and public web addresses are sent to these services, never your LinkedIn session.

TAI keeps a shared knowledge base about organisations and websites it has researched, such as an employer’s official website, where it lists its staff or vacancies, and which sites cannot be read automatically. It never contains people: no names, profiles or individual pages, and no link to the user whose research produced it. Facts about people stay in each user’s own history and are deleted with it.

Every analysis also teaches that knowledge base, in counts only: how many of an employer’s job listings TAI has checked and how many its own site confirmed (a listing is recorded as a short one-way code, not its address), which websites tend to confirm job details, and how often each verdict is given and marked right or wrong by users. None of it identifies a person or a user, and none of it changes a score: every result is decided by the pages read for that item.

To measure and improve its research, TAI also keeps a short record of each analysis: which kinds of sources it tried, whether each proved the claim, how many searches it took, and the result. It holds no page text, website address or name, and it is deleted with your account. When you mark a result as wrong, TAI may check that item again more thoroughly to learn what it missed.

TAI then searches the public web for what a profile lists — schools, past employers, publications, patents, awards, certifications, projects and articles — under fixed, published rules that are the same for every profile, including your own, and within a search allowance set by your plan. For people likely to be over 30, it also searches each five-year period of their career, back to the earliest year the profile lists, with search results limited to that period. That age is estimated from the dates on the profile only to decide whether this back-search runs: it is never stored, shown, scored or shared. Recommenders are never searched.

For your own Profile Score, TAI also reads your LinkedIn “Contact info” for the websites you list there (never your email address or phone number) and reads those public pages to check that they name you.

Where enabled, TAI uses an AI model (Anthropic’s Claude API) to search the web for public pages about a person or a job, to read public pages it fetched, and to match job listings to your profile. For that check it sends the person’s name and headline or the job listing, the public page text, and, for job matching, your own profile’s headline, roles and skills. Your LinkedIn session and messages are never sent.

To learn which checks it gets right, TAI keeps two kinds of signal. When you answer “Does this look right?” on a result TAI was unsure about, it stores your answer with the record’s title. And when you click Accept or Ignore on a connection request, or Apply or Save on a job, that TAI has already reviewed, the extension notes that click: only the action and the address of that profile or job, and only for a record TAI already holds for you. Neither ever changes a trust score, and both are deleted with the rest of your data.

TAI sends email through Resend: a welcome when you create your account, a notice each time you sign in, and, only if you switch them on in Customize, alerts after a sweep. Emails go to the address LinkedIn gave at sign-in or the alert address you set; Resend receives that address and the email’s content, nothing else from your account.

The site counts page views with Vercel Web Analytics, which sets no cookies and does not identify you. Addresses are trimmed before they are counted: no query strings, and a shared Trust Score link is counted without its private part.

To find real jobs for you beyond your LinkedIn feed, TAI searches Google Jobs (through SerpAPI) twice a day, on the Plus plan, with the role titles from your profile or Customize and your location. Nothing else about you is sent, and the jobs found are researched like any other.

Where it is stored

Results are stored in TAI’s database (Supabase), processed by TAI’s worker (Render) and served by the dashboard (Vercel). Your LinkedIn sign-in token is stored encrypted and used only to identify your account. TAI does not sell data or use it for advertising.

Paid plans are billed by Stripe. Your card details go to Stripe’s own checkout and billing pages and never reach TAI; TAI keeps only your Stripe customer and subscription reference, your plan, and when it renews.

If you share your Trust Score

Nothing about you is public unless you press “Share Trust Score”. That creates a link with a random address showing your name and headline as they appear on LinkedIn, your score and its band, when it was checked, and the websites that confirmed it. Anyone with the link can open it; it is kept out of search engines. “Stop sharing” turns the link off at once, and deleting your account removes it.

Anonymous patterns

TAI produces statistics about groups of professionals, such as how often people in a role and region have their current job confirmed by their employer’s own website. They are built only from users’ own Profile Scores (your profile link and the research on it), never from the people, jobs, messages or emails you look at. A group is shared only when it has at least 50 people; counts are rounded and small categories are combined. TAI shares these statistics with customers through its Intelligence API; it never sells or shares your profile, name, employer, results or any record about you. Contributing your own verified Profile Score is part of using TAI: accepting the Terms records it, with what it may be used for (anonymous patterns and their distribution). Only values a public page confirms are described as verified; what you wrote yourself, such as dates and titles, is labelled self-reported. To withdraw, delete your account in Account → Privacy & data: your claims are removed and the next update no longer counts you.

How long it is kept

• Raw captures from the extension: deleted after 14 days.
• Analysed records and their evidence history: deleted after 180 days.
• Job applications from the Careers page: the role, your email and the Trust Score you shared are kept 180 days; the rest goes only to our hiring inbox.
• You can delete everything at any time from Account → Security → Delete my data.

Your choices

Pause or disconnect collection in the extension at any time, delete your data from the Account page, or uninstall the extension.