Last updated: September 14, 2026
Bidsmith is a Chrome extension that drafts Freelancer.com bid proposals using an OpenAI API key you provide and fills them into Freelancer’s bid form. You submit the bid yourself with Freelancer’s Place Bid. This policy describes what the extension stores, what it sends and to whom, and what it does not collect. If you do not agree, do not use the extension.
Bidsmith does not offer text snippets, tags, right-click menus, or contextMenus. Older marketing copy that described those features does not apply to the current product. There is no Bidsmith server: no account, no backend, no analytics, and nothing that reports back to the developer.
On Freelancer’s bid form, on the right above Describe your proposal, Bidsmith shows Write and hides Freelancer’s own Write My Bid control. Write generates a draft into that proposal box, selects Freelancer’s Sealed option, and on fixed-price projects fills two to four equal milestone rows — and stops there. You submit with Freelancer’s own Place Bid if you want to. Bidsmith never clicks Place Bid, never spends a bid credit, never clicks paid upgrades (Sponsored, Highlight, Promote, Feature), and never sends a chat message.
The OpenAI API key and optional Freelancer API token are stored only in chrome.storage.local on this device. They are not written to synced storage, are never included in a settings export or Google-account backup, and are not injected into Freelancer.com pages. The page script never reads either secret. These items stay on this device:
Settings you edit in the Dashboard — prompts, skills, search filters, nickname, alert preferences, portfolio maps, case studies, a cached price table, and a custom API base URL — are stored locally so they work offline. A copy of those same settings (not the API keys) is also packed into Chrome Sync so they can return after you remove and re-add Bidsmith. See below.
These items use synced storage, and they may therefore be transmitted to Google and copied to your other Chrome installations if Chrome Sync is enabled:
The OpenAI API key, the Freelancer API token, commitment reminders, and seen-project ids never leave this device through Chrome Sync. A custom API base URL is restored only if this Chrome profile already has permission for that host.
There is no settings password. Anyone who can use this Chrome profile can open the options page and see stored settings.
When you generate a bid or a reply draft, the extension’s background worker calls your configured Chat Completions URL (default https://api.openai.com/v1) with your key. The request includes:
{{token}} substitution ({{selection}}, {{portfolio}}, {{signature}}, {{style}}, {{case_studies}}, {{must_include}}, and for replies {{thread}} / {{project}})That traffic goes from the extension to OpenAI. Bidsmith does not operate a backend that receives this content. OpenAI’s own privacy policy applies to data they process.
About once a week the service worker fetches the public pricing markdown from https://developers.openai.com/api/docs/pricing.md so the Dashboard can show input/output prices. That request sends no API key and no project or chat text.
Before your key is sent anywhere, the destination is re-checked every single time: it must be HTTPS (plain http: is allowed only for localhost and loopback addresses), it must not carry an embedded username or password, it must not be a link-local or cloud-metadata host, and the extension must already hold Chrome’s permission for that exact origin. If any check fails, the request is refused and no key is sent. Dashboard export never contains the OpenAI key or the Freelancer token, and settings import only accepts a fixed list of known keys, each individually sanitized.
If you paste a Freelancer OAuth access token in Settings → Connection, Bidsmith stores it on this device and sends it only to Freelancer on https://www.freelancer.com/, never to OpenAI, and never in a settings export. Saving the token or clicking “Import skills from Freelancer” calls /api/users/0.1/self/ and replaces Settings → Skills with the skills on that profile (including each job’s numeric id). While a token is saved, Bidsmith also repeats that same skills import about once a day. An empty or unreadable skills list is ignored, so the list you already have is not wiped. The token is not used for the cookie-session new-project listing checks. Bidsmith does not store your Freelancer hourly rate, name, email, or portfolio from the /self response. Clearing the token stops the daily skills import and does not wipe the Skills list.
Bidsmith can show a desktop notification when a new Freelancer project matches your saved filters. This is on by default. Turn it off with the “Notify me about new matching projects” checkbox in Settings → Notifications or in the toolbar popup.
While it is on, and whether or not you have a Freelancer tab open, Bidsmith wakes up at most once a minute and requests Freelancer’s own public project-listing endpoint (/api/projects/0.1/projects/active) on the Freelancer domain you last used, defaulting to www.freelancer.com. Only one such request is ever outstanding at a time, and the check is hard-capped at 130 requests an hour. If Freelancer rate-limits the request, refuses it, or returns a server error, Bidsmith waits progressively longer before trying again — 5, 10, 20, 40, then up to 60 minutes — and honours any wait Freelancer explicitly asks for; after repeated failures it stays on a slower schedule for the rest of the browser session. This is the same endpoint Freelancer’s own search page uses, and because it is a request to Freelancer from your browser, your existing Freelancer session goes with it — exactly as it would if you loaded the search page yourself. Bidsmith does not read, copy, or store your Freelancer login or session cookie.
What comes back is used entirely on your device: it is matched against your saved filters and, if you set one, your per-skill alert scope; matching projects become a desktop notification, and the ids of every project seen are kept locally (capped) so the same project is never announced twice. None of it is sent to OpenAI, and none of it is sent to the developer — there is no server to send it to. When a Freelancer search page is already open, the page supplies the same data immediately and the background check is only a fallback. Turning the alerts off clears the scheduled check entirely and the requests stop.
Bidsmith does not include analytics, advertising, crash telemetry, or usage tracking. It does not send browsing history to the developer.
The extension requests:
Bidsmith does not use activeTab, contextMenus, identity, offscreen documents, or required all-sites access.
Bidsmith is not directed at children under 13. The extension does not collect personal information for the developer’s servers.
We may update this page and the “Last updated” date. Review it when you update the extension.
Questions about this policy: rajkumar@rewathi.com
Summary
The OpenAI API key and optional Freelancer API token stay on this device and are never exported. Settings (prompts, skills, filters, nickname, alert preferences) may sync with your Google account so they return after you reinstall; keys, commitments, and seen-project ids do not. Generating a bid sends the substituted prompt (project text, portfolio, signature, and any profile facts you stored) to the API host you configured — nowhere else. A Freelancer token, if you saved one, is sent only to Freelancer to import your profile skills (on save, on Import, and about once a day). It is never used for the cookie-session new-project watch. While new-project alerts are on, Bidsmith checks Freelancer’s public listing at most once a minute — capped, never overlapping, and backing off when Freelancer is busy — and keeps the result entirely on your device. Write fills Freelancer’s proposal box; you submit on Freelancer. There is no Bidsmith server and no analytics.