Privacy policy

This is a plain-English draft awaiting legal and operational review. The operator’s identity, address, applicable privacy obligations and working privacy contact remain to be confirmed. This is not a claim of regulatory certification or a guarantee of compliance.

jomt stores freelancer account details, including the account email and business or display name; authentication is handled by Supabase. Requests contain a title, optional description, price, currency, designated client email, freelancer details, status and timestamps. Approval events record the agreement details and approval time. Response messages, where enabled, and delivery queue or attempt information may also be stored. Do not put sensitive personal information into a request.

The client email is a designated recipient address, not proof of the approver’s identity. The hosting and backend providers may process network information such as IP addresses, user agents, request times and security logs to operate and protect the service. Where server-side approval security metadata is retained, it is private and is not intended for public records, emails or analytics. This policy does not claim that every historical approval has IP or user-agent evidence.

Information is used to authenticate freelancers, display and manage requests, record responses, protect against abuse and operate the service. Freelancers can view their own requests. Someone with an approval or record link can view the information available through that link; share links only with the intended recipient. jomt does not verify email ownership when someone responds through a bearer link.

Supabase provides authentication and database infrastructure. Cloudflare Pages hosts the public web app. Providers may process technical data in locations outside your country under their own service terms. Exact project region, contractual details and any additional email provider must be reviewed before public launch. Email copies and notifications are pending sender and delivery configuration, not currently promised.

Authentication sessions use local device or browser storage so you can stay signed in. Optional, consent-based product analytics are planned with PostHog, but live collection requires configuration. Analytics must not include names, email addresses, request text, prices, private approval tokens or record links; session replay and automatic capture are not part of this plan. No live analytics dashboard verification is claimed by this draft.

A final retention schedule and automated deletion process have not yet been established. Account, request and approval information may remain stored during beta; provider logs and backups follow their own retention settings. There is not yet a self-service account deletion flow or an operational privacy inbox. Deletion requests are intended to be handled after verifying ownership once a working contact is configured. We cannot currently promise a response or deletion deadline, or immediate removal from backups. This is a launch blocker, not a completed privacy-request service.

Use only the information needed for the agreement, keep private links secure and retain copies of records you need. Depending on your location, you may have rights to access, correct or delete personal data. A verified channel to exercise these rights still needs to be published; see Contact. If this limitation does not meet your needs, do not submit real client data during beta.