Privacy Policy

We provide a hyper-local hiring marketplace. The service is available in the United States only and is intended for adults aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has provided us with information, report it via the Help Center → Contact us and we will delete it.

Account information

• Email address (from Google or Apple sign-in).
• Display name and language preference.
• Role (worker, employer, or admin) and the time you chose it.

Profile information

• Profile photo.
• Voice intro audio file and its text transcript. Voice Recordings are treated as Sensitive Personal Information under the California Privacy Rights Act (CPRA).
• Tags, skills, languages, and availability.
• Location: employers provide a business address that we geocode; workers provide an approximate home area. Precise geolocation, when collected, is treated as Sensitive Personal Information under CPRA.

Activity

• Jobs viewed, applications, messages, ratings, hires, and contact unlocks.
• Reports, moderation flags, and dispute history.

Device and technical data

• User agent and device type (from your browser).
• PWA installation state and web push notification details (only if you opt in).

Payment information

All payment processing is handled by Stripe. We do not see or store your full card number. We store your Stripe customer ID, subscription IDs, payment status, and the last 4 digits of your card so we can show it back to you.

• You — when you sign up, complete your profile, post a job, or message someone.
• Your device — user agent, push notification details, geolocation if you grant permission.
• Sign-in providers — basic profile info from Google or Apple when you use them to sign in.
• Stripe — payment status events.
• Google Maps Places — public business information when an employer selects their business.

• Run the marketplace — match workers to jobs and employers to candidates.
• Send transactional notifications (new applications, messages, hires, payment receipts).
• Prevent fraud, abuse, and unsafe behavior.
• Comply with legal obligations and respond to lawful requests.
• Improve the product — we may keep de-identified server logs (e.g. error traces) to debug and improve the service.

We use AI to make the service faster and easier:

• Voice intros are transcribed by OpenAI Whisper. The audio file and transcript are stored under your account; you can delete them anytime.
• Job ↔ worker matching uses embeddings generated through Lovable AI Gateway.

Providers may briefly process your content to fulfill the specific request. We do not authorize providers to use your content to train their general foundation models. You can opt out of voice intros by leaving them blank.

Other users

• When a worker applies to a job, the employer sees the worker's profile (photo, name, voice intro, tags, ratings).
• Workers see the employer's public profile and business location. Direct contact info (phone/email) is masked until the employer unlocks it.
• Public worker profile pages (/p/<id>) are marked noindex/nofollow so search engines do not index them by default.

Service providers

• Supabase — database, authentication, file storage, and backend hosting.
• Cloudflare — application hosting and edge runtime.
• Stripe — payment processing.
• Google Maps Platform — geocoding and business autocomplete.
• Lovable AI Gateway — AI inference for matching and embeddings.
• OpenAI — voice transcription via Whisper.
• Email and push notification providers used to deliver transactional messages.

Legal and safety

We may disclose information to comply with valid legal process, protect rights or safety, or investigate fraud or abuse.

We do not sell your personal information. We do not 'share' personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and California Privacy Rights Act. A "Do Not Sell or Share My Personal Information" link is available in the site footer and at /legal/do-not-sell; we provide it as a courtesy and as a CPRA technical safeguard even though we do not engage in sale or cross-context behavioral sharing.

• Account data: until you delete your account, plus a 30-day grace period in case you want to restore it.
• Messages: up to 2 years after the conversation ends.
• Ratings and hire records: retained for marketplace integrity; the rater/ratee identity is anonymized after account deletion.
• Payment records: retained for up to 7 years for tax and accounting.
• Voice intros: you can delete anytime from your profile.

• Edit or delete your profile fields from the profile screen.
• Delete your account from Settings → Danger zone.
• Opt out of non-essential notifications in Settings → Notifications.
• Request a copy of your data from Settings → Privacy → Request a copy of your data.

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, the sources, the purposes, and who we share it with.
• Access a portable copy of the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information, subject to legal exceptions.
• Limit the use of sensitive personal information.
• Opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising).
• Not be discriminated against for exercising any of these rights.

To exercise these rights, email help@jobontheblock.com from the email address on your account. We may ask you to confirm details about your account to verify your identity. You may also designate an authorized agent to submit a request on your behalf; we will require proof of authorization.

If you live in a state with a consumer privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you have similar rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising or profiling with significant effects. We do not engage in targeted advertising or profiling of that kind. To exercise your rights, email help@jobontheblock.com.

The service is for adults 18 and over. We do not knowingly collect personal information from anyone under 18, and we comply with the Children's Online Privacy Protection Act (COPPA) regarding anyone under 13. If you become aware that a minor has used the service, report it via the Help Center → Contact us and we will delete the data.

We use industry-standard safeguards: data is encrypted in transit (HTTPS) and at rest at our provider. Access to production data is restricted and audited. Authentication uses Google and Apple OAuth — we do not store passwords. No system is perfectly secure; we cannot guarantee absolute security.

We use only essential cookies and browser storage: your authentication session, your language preference, and your PWA installation state. We do not use advertising cookies and do not load third-party advertising or behavioral analytics trackers.

The service is intended for use within the United States only. If you access it from outside the U.S., you do so at your own risk and are responsible for compliance with your local laws.

We may update this policy from time to time. Material changes will be shown as an in-app banner on your next visit (and emailed when we have a verified address on file).

Privacy questions, data requests, or complaints — email help@jobontheblock.com.

Under the California Privacy Rights Act (CPRA), the following table lists the categories of personal information we collect, the sources, the business purposes, the categories of third parties we share with, and how long we keep each category. We do NOT sell or share any category for cross-context behavioral advertising.

Identifiers (email, name, account ID)

Source: you, Google/Apple sign-in. Purpose: account creation, authentication, transactional notifications. Shared with: Supabase, email provider. Retention: life of account + 30-day grace; payment-related identifiers up to 7 years.

Geolocation (approximate home area, business address)

Source: you, Google Maps Places (employer business). Purpose: distance-based matching, map display, wage-floor lookup. Shared with: Supabase, Google Maps Platform. Retention: life of account. Precise geolocation, when collected, is treated as Sensitive Personal Information (see §18).

Audio (voice intros, voice job snippets)

Source: you (via the in-app recorder, with your express consent — see Terms §19). Purpose: profile and job-post presentation, transcription for accessibility and matching. Shared with: Supabase (storage), OpenAI (Whisper transcription). Retention: until you delete the recording or your account. Treated as Sensitive Personal Information (see §18).

Commercial information (payments)

Source: Stripe events. Purpose: subscription management, receipts, fraud prevention. Shared with: Stripe. Retention: up to 7 years for tax/accounting.

Internet/network activity (device, push tokens)

Source: your browser. Purpose: keep you signed in, deliver web-push notifications you opted into, debug errors. Shared with: Supabase, push notification provider. Retention: session lifetime; push tokens until you uninstall.

Inferences (match scores, embeddings)

Source: derived from your profile and job posts via the Lovable AI Gateway. Purpose: surface relevant jobs/workers. Shared with: Lovable AI Gateway (for the inference call only). Retention: regenerated as profile changes; cleared on account deletion. Not used as the sole basis for any adverse hiring decision (see Terms §8).

Under the CPRA, certain data is classified as Sensitive Personal Information (SPI). The categories we collect and how we use each:

• Precise geolocation — used only to compute distance-based matches and map display. Not used to profile you or for advertising.
• Audio (Voice Recordings) — used only to present your voice intro/job snippet to users you've chosen to share it with, and to transcribe it for accessibility and matching.
• Sign-in credentials and authentication tokens — used only to keep you signed in.

We use SPI only for the operational purposes you initiated, plus the limited additional purposes allowed by Cal. Civ. Code §1798.121(a) (e.g. security, fraud prevention, short-term transient use). We do not use SPI to infer characteristics about you for any other purpose. You may request that we limit our use of SPI even further — email help@jobontheblock.com with the subject line "Limit SPI". You can also limit SPI sharing from Settings → Privacy → "Limit use of sensitive personal information".

We target WCAG 2.1 Level AA for the entire service. See the Accessibility Statement at /legal/accessibility for the current audit status, known issues, and how to report a barrier. To request an alternative format of this Privacy Policy, email help@jobontheblock.com.