Privacy

What we collect, and what we do not.

This platform sends people to physical places and records where they were. That is unusually sensitive, so this page is specific rather than reassuring.

Not yet reviewed by counsel. This describes what the system does today, accurately. It has not been through legal review, and that review is a production requirement before this platform is marketed at scale.

Tag Partners — the people who do the work

Location

While you are completing a Tag, the server records your device's reported position, accuracy, and whether the operating system flagged the location as mocked. This happens only inside a capture session you started by accepting a Tag — not in the background, and not between Tags.

This is the evidence the PLACE lock is built on, and it is why the platform can tell a customer that somebody was actually there. It is also the most sensitive thing we hold about you.

Photographs and their metadata

Proof images are stored, along with their dimensions, a SHA-256 hash, and any EXIF location and capture time the file carried. EXIF is read as a fraud signal — a photograph whose embedded location disagrees with the session is interesting — and never as the authority. The server's own record is what counts.

Account and payment

Your name, email, optional phone number, and an approximate home location used to show you nearby work. Payments are handled by Stripe: we never see or store your bank details. We hold a Stripe account identifier and whether onboarding is complete.

Reliability

Completion counts, rejection counts and a reliability score. This affects which Tags you can take.

Corners — the customers

Company name, email, an optional webhook URL, and the Tags you create. API keys are stored as a peppered SHA-256 hash — we cannot read your key, re-send it, or recover it for you, and a database dump would not yield working credentials. Webhook signing secrets are stored encrypted.

Everyone

Ordinary server logs, carrying a request id, a Tag or account id where relevant, timing and outcome. Logs are redacted: API keys, webhook secrets, tokens, phone numbers and raw coordinates are not written to them.

We run no analytics, no advertising pixels and no third-party trackers. The contact form stores what you type and nothing else — no IP address, no user agent, no fingerprint.

Who else processes your data

  • Stripe — payments and payouts, including identity verification required to pay you.
  • Supabase — database, authentication and file storage for proof images.
  • Vercel and Cloudflare — hosting and DNS for the web applications and API.
  • An AI vision provider — proof photographs may be sent to a model to assess whether they show what the Tag required. The model's verdict is advisory and can never release money on its own. At the time of writing, vision is disabled and every Tag is reviewed by a person.

Retention — stated plainly

There is currently no automated deletion. Nothing in the system expires data on a schedule. Tags, proof images, location evidence and ledger entries are kept indefinitely unless somebody removes them by hand.

Some of that is deliberate: financial records and the evidence behind a completed Tag need to outlive a dispute, and the ledger is append-only by design. Some of it is simply not built yet. Implementing a retention schedule is on the production checklist, and until it is done this page will keep saying so.

Your requests

You can ask for a copy of your data, a correction, or deletion. There is no self-service button — a person handles it. Use the contact form and choose Privacy request.

Deletion has limits we will be straight about: we cannot remove financial records we are required to keep, and we will not remove evidence attached to an unresolved dispute while it is unresolved.

Security

  • API keys peppered and hashed; webhook secrets encrypted at rest.
  • Proof images in a private bucket, reachable only through short-lived signed URLs.
  • Transport encrypted everywhere. The Partner app requires HTTPS — camera and location are unavailable without it.
  • An explicit CORS allow-list on the API rather than a permissive default.

Contact

Privacy questions, requests, or a security problem you would like to report: the contact form. Security reports are read first.