Skip to content

ETHICS.md

Latest commit

 

History

History
112 lines (94 loc) · 6.05 KB

ETHICS.md

File metadata and controls

112 lines (94 loc) · 6.05 KB
Raw
title AutoApply Ethics Statement
status needs-review
last_verified 2026-09-27
verified_against bulk provenance stamp 2026-09-27; content not individually re-verified against code
audience everyone

AutoApply Ethics Statement

deon Checklist

This document follows the deon ethics checklist for data science and software projects involving data collection.

A. Data Collection

  • Informed consent: Users must explicitly opt in to research data collection through the consent dialog. Collection is OFF by default; the decision is stored in a versioned consent record and the version is stored with each record.
  • Right to withdraw: Users can delete their research contribution at any time via the Research screen — File → Research… in the app (also Settings → Research…), or python -m auto_apply --research on the command line — by choosing withdraw with deletion. Deletion is immediate: every research table, the database files, and the installation's research signing key are removed. Uninstalling AutoApply also withdraws participation; see Data retention.
  • Data minimization: Only the minimum data needed for each research signal is collected. Full job descriptions are never stored in research data; only anonymized excerpts ≤200 chars. A separate, optional choice (page copies, off unless turned on and only while research participation is on) keeps cleaned copies of job posting pages on the device only — the person's own details, form values, hidden fields and scripts removed before writing, search pages never kept — so rows can be checked against their pages. Research rows carry only a fingerprint of a copy; export carries no copies.
  • Anonymization: Company names are HMAC-SHA256 anonymized. No personally identifiable information (PII) is ever stored in research tables.
  • Third-party data: Research data may include signals from third-party job boards. This data reflects employer behavior (job descriptions, form fields) rather than user behavior.

B. Data Storage

  • Encryption at rest: Research databases use SQLite WAL mode with system-level file encryption. Future versions will implement AES-256 encryption at the file level.
  • Access controls: Research data is stored locally on the user's device. No data is transmitted to external servers without explicit user action (export).
  • Data retention: Research data is kept until the user withdraws and purges it or deletes it; there is no automatic expiry for research rows. (An earlier draft of this document promised a configurable 90-day default; that mechanism was never built for rows.) Page copies, the separate opt-in above, do expire: after 90 days by default (page_copy_keep_days), oldest first past 200 MB (page_copy_max_mb), and on any withdrawal from research. They are not encrypted; the consent text says to leave them off on a shared computer. When AutoApply itself is uninstalled, research records are kept by default — moved or exported to a location the user confirms — and deleted only by an explicit, separately confirmed choice during uninstall. A researcher working under an IRB-approved protocol (for example the three-year minimum of 45 CFR 46.115(b)) can place a retention hold on the device: while a hold is active, uninstall refuses to destroy research records — page copies included — names the hold, and offers export instead.
  • Breach response: In the event of a discovered vulnerability affecting research data, users will be notified via the project's issue tracker within 72 hours.

C. Analysis

  • Proxy discrimination: Signals for discrimination proxies (DISC-01 through DISC-06) are documented with their academic grounding. Confidence scores reflect the probability of a genuine signal, not a legal determination.
  • Spurious correlations: All signals include confidence scores and evidence text. Aggregate analysis uses Benjamini-Hochberg FDR correction to control for multiple comparisons.
  • Honest reporting: Signal detectors are designed to minimize false positives. The js_variables CAPTCHA detector, for example, was explicitly set to empty because presence of window.grecaptcha is not a genuine CAPTCHA challenge.

D. Modeling (N/A for this version)

AutoApply v1.0 does not train ML models on research data. If this changes, this section will be updated with model cards and fairness assessments.

E. Deployment

  • Worst-case user first: Every feature degrades gracefully for users on library computers with 2GB RAM and no admin rights.
  • Accessibility: Application forms are assessed for WCAG 2.1 compliance. AA itself targets keyboard accessibility in its GUI.
  • Transparency: This ethics statement is public and versioned. Changes to data collection practices require an update to this document and to the user consent dialog's version string.

Research Ethics Statement

AutoApply's research capabilities are designed for labor market science. The research program aims to provide empirical evidence of systematic hiring dysfunction for the benefit of workers, policymakers, and researchers. The platform:

  1. Does not impersonate: AA fills real job applications on behalf of real users who have given consent for their applications.
  2. Correspondence audits: If AA is used for correspondence audit studies (fake paired applications for discrimination research), this requires separate IRB-equivalent review, must be pre-registered on OSF, and must comply with all applicable laws regarding fictitious applications.
  3. Employer accountability: Research signals attribute dysfunction to specific employer behaviors (job descriptions, form fields, policies), never to individual employees or candidates.
  4. Open data: Aggregate research data may be published openly to support independent verification and replication.

Contact

For ethics-related concerns, open an issue on Codeberg with the label ethics.