Privacy Policy

Align is operated by [legal entity name and address] (fill in before launch), which is the data controller for the information described here. Contact: privacy@example.com.

Because you gave it to us

• Your name, email address, and password (stored only as a bcrypt hash — never in a readable form).
• Your skills and avatar link, if you add them.
• Projects, tasks, bids and cover letters you write.
• Work you submit: links, notes, and — on QA tasks — a pass/fail verdict and any screenshots you attach.
• Reviews and comments you write about other people’s work.

Because the service produced it

• Your reputation score and the count of bugs you reported that were confirmed.
• Payment records: amount, currency, status, timestamps, and the Stripe identifiers for the charge, transfer or refund.
• Which notifications we sent you and whether they were delivered.
• Ordinary server logs, including IP address, for security and debugging.

What we deliberately do not hold

• Card numbers, bank account numbers, or government ID. Those go directly to Stripe.
• Advertising or cross-site tracking identifiers. There are none.

• To run the marketplace — matching tasks to people, and showing each side what they need to decide.
• To move money — charging an owner at acceptance, paying a developer at approval, and handling refunds and disputes.
• To tell you things you need to know — see notifications below.
• To keep the service safe — rate limiting, abuse reports, and investigating fraud.
• To meet legal obligations — financial and tax records.

Where the law requires a legal basis: most of this is performance of our contract with you; safety and fraud prevention rest on our legitimate interests; financial records rest on a legal obligation.

Other users

Your name, avatar, skills and reputation are visible to other users. Your cover letter is visible to the owner of the task you bid on — not to other bidders. Work you submit, and screenshots you attach, are visible to the owner of that project.

Service providers

• Stripe — payments, payouts, identity verification and tax forms.
• Resend — sending email.
• Expo — delivering push notifications to the mobile app.
• Cloudflare R2 — storing screenshots, in a private bucket.
• Render and Vercel — hosting the API, database and web app.

We do not sell your information, and we do not share it for anyone else’s advertising. We may disclose it if the law requires it, or to protect someone’s safety.

We send email about things that affect your money or need a decision — a bid accepted, work submitted for review, a payment that failed. You can turn most of these off in your settings, and every email has a one-click unsubscribe link.

A few cannot be turned off: a failed payout, a failed payment, a blocked payout account, and messages about your account’s security. Not receiving those would cost you money or leave your account exposed.

If you use the mobile app you can allow push notifications. You can revoke that in your device settings at any time, and it is off until you allow it.

The web app sets two cookies, both strictly necessary and neither used for tracking: a session cookie that keeps you signed in, which JavaScript cannot read, and a token used to protect against cross-site request forgery. There are no analytics or advertising cookies, so there is no consent banner to click through.

Screenshots attached to a test report are stored in a private bucket. They are never public. Each time one is displayed we generate a link that stops working after ten minutes. We do this because a screenshot of someone’s app can easily contain a staging URL or a live test account.

A screenshot you upload but never attach to a report is deleted automatically after a day.

• Your profile — until you close your account.
• Payment records — kept after closure. We are required to keep financial records, and a cardholder can dispute a charge months after it was made.
• Reviews, submissions and deliverables — kept after closure, attributed to “Deleted user”. A review is evidence about someone else’s work, and a deliverable belongs to the owner who paid for it.
• Notification records — about a month.
• Server logs — a short period, for security and debugging.

From your profile you can export everything we hold about you as a single file, and close your account. Closing is immediate and cannot be undone, so the export is offered first.

Closing replaces your name and email, clears your skills and avatar, removes any saved payment method, and signs you out everywhere. It does not delete the records described above, which is why we describe them plainly rather than promising an erasure we could not honestly perform.

Depending on where you live you may also have the right to correct your information, object to certain uses, or complain to a data protection authority. Write to privacy@example.com and we will help.

The email address you used is freed when you close the account, so you can sign up again later with a fresh, unconnected account.

Passwords are hashed with bcrypt. Sessions use a cookie that JavaScript cannot read, and you can sign out of every device at once from your profile. Traffic is encrypted in transit. Screenshots are private and served through expiring links.

No system is perfect. If you find a security problem, please write to security@example.com before disclosing it publicly.

Align is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has an account, write to us and we will remove it.

Our providers may process your information in the United States and elsewhere. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.

If we change this policy in a way that materially affects you, we will tell you by email before it takes effect. The date at the top always reflects the current version. See also our Terms of Service.