Privacy Policy

Effective Date: June 22, 2026

This Privacy Policy explains how Corkboard (“we,” “us,” “our”) collects, uses, stores, shares, and protects your personal information when you use our website, mobile application, and related services (collectively, the “Platform”). We are committed to transparency about our data practices and protecting your privacy.

By using the Platform, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Platform.

1. Information We Collect

1.1 Information You Provide Directly

When you create an account, update your profile, or use the Platform, we may collect:

Account information: username, password (stored in hashed form), and display name
Contact information: email address and phone number
Location information: city or area name you provide on your profile, and geographic coordinates associated with gig postings (with a privacy radius applied)
Profile information: bio, skills, avatar selection, profile photo, work gallery photos, certifications/training, work experience, and vehicle availability
Business information (Business tier): business name, personal name, business website, and business phone number
Job-related information: gig postings (title, description, requirements, category, pricing, estimated duration), job applications, and proposed quotes
Communications: messages sent through the in-app messaging system
Reviews and ratings: text reviews and star ratings you provide for other users
Reports and appeals: content you submit when reporting other users or appealing moderation decisions

1.2 Information Collected Automatically

When you use the Platform, we automatically collect:

Usage data: how you found the app (join source), last active date and time, pages viewed, features used, and interactions with the Platform
Device information: device type, operating system, and app version
Push notification tokens: device identifiers used to deliver push notifications (only if you grant permission)
Profile and gig view counts: tracking how many times your profile or gig postings are viewed by other users
Application activity: number of daily applications submitted and daily reset timestamps
Last known IP address and device identifier: stored per-user (last-write-only, no history) for the purpose of supporting account-level safety actions. Specifically, this lets administrators issue an IP or device ban when a user is banned for severe abuse, which prevents the banned user from creating a new account from the same IP or device. These values are not shared with third parties and are cleared when you delete your account.

1.3 Information from Third Parties

We may receive information from third-party services if you choose to link or connect them to your account (such as sign-in services). We may also receive information from users who refer you to the Platform via referral codes.

2. How We Use Your Information

We use the information we collect for the following purposes:

Platform Operations

To create, maintain, and secure your account
To connect Clients with Workers and facilitate gig discovery
To enable in-app messaging, applications, and reviews
To process subscription management and tier features
To display your profile and gig postings to other users

Safety and Moderation

To screen content using automated AI systems for policy violations (see Section 4 below)
To maintain trust scores, enforce community guidelines, and process moderation actions
To investigate reports, abuse complaints, and fraudulent activity
To implement rate limits and protect against spam and misuse

Communications

To send push notifications about messages, application updates, and gig activity
To deliver platform announcements and service updates
To send promotional content and tips (only if you opt in)

Analytics and Improvement

To understand how users interact with the Platform and identify areas for improvement
To generate aggregated, anonymized analytics for platform health monitoring
To make data-driven decisions about features, categories, and user experience

Legal and Compliance

To comply with applicable laws, regulations, and legal processes
To enforce our Terms of Service and protect our rights
To respond to law enforcement requests and prevent fraud or harm

3. Sharing of Information

We do not sell your personal information to third parties.

We may share your information in the following circumstances:

With other users: Your profile information, gig postings, reviews, and messages are visible to other users as part of the Platform’s functionality. Your display name, avatar, bio, skills, ratings, and gig history are publicly visible on your profile.
With service providers: We rely on third-party processors for email delivery, content moderation, image hosting, push notifications, and database hosting. Section 10 below lists each provider, the categories of data it receives, and the country in which it processes that data. These providers process data on our behalf and are contractually obligated to protect your information.
With platform administrators: Authorized administrators may access user data for the purposes of content moderation, dispute investigation, platform analytics, and user management. Administrators may export aggregated user, gig, and review data for operational and analytical purposes.
For legal reasons: We may disclose information when required by law, court order, subpoena, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
In business transfers: If Corkboard is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Automated Decision-Making and AI

We use artificial intelligence (AI) systems to help moderate content on the Platform. This is an important part of how we keep the community safe, and we want to be transparent about how it works:

What AI Screens

Gig postings (titles, descriptions, and requirements) when created or edited
In-app messages between users
Profile updates and content changes

What AI Checks For

Illegal activity or solicitation of illegal services
Harassment, threats, or hate speech
Scams, fraud, or deceptive practices
Spam or unsolicited advertising
Discrimination based on protected characteristics
Inappropriate or explicit content

How AI Decisions Are Made

The AI assigns a severity level (low, medium, high, critical) and confidence score to flagged content
Low-severity content is generally approved automatically
Medium-severity content may be flagged for human review by platform administrators
High or critical severity content may be automatically rejected or removed
Content is typically posted immediately while moderation runs in the background; if a violation is detected after posting, the content may be removed retroactively

Your Rights Regarding Automated Decisions

You have the right to be informed that automated decision-making is being used (which this section fulfills)
You have the right to appeal any automated moderation decision through the Account Standing section in Settings
Appeals are reviewed by human administrators, not AI
You can view your current moderation status, trust score, and any active warnings in Account Standing

5. Push Notifications

If you grant permission, we collect your device’s push notification token to send you notifications. This token is stored on our servers and is used exclusively for delivering push notifications through the Platform.

Push tokens are provided to the Expo push notification service solely for the purpose of delivering notifications to your device
You can control which types of notifications you receive (messages, application updates, promotions) through your notification preferences in the Edit Profile section
You can disable push notifications entirely through your device’s system settings
If you revoke notification permissions, your push token is no longer used but may remain stored until your next app session

6. Data Security

We take the security of your personal information seriously and implement reasonable administrative, technical, and physical safeguards to protect it:

Passwords are stored using industry-standard salted hashing (bcrypt) and are never stored in plain text
Database connections use secure protocols and connection pooling
API communications use HTTPS encryption in transit
Administrative access to user data is restricted to authorized personnel and logged in an audit trail

However, no method of electronic storage or internet transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Platform’s services. We apply data-minimization principles: each category of data has a defined retention window, after which automated cleanup jobs delete or anonymize it. The specific windows are:

Account data: Retained until you delete your account, at which point your profile is tombstoned and personal information (email, phone, location, push token, last known IP and device identifier, bio, photos) is scrubbed.
Messages: Retained for 2 years past the send date, then deleted. When the sender deletes their account, their message text and attachments are overwritten immediately so recipients no longer see the deleted user’s payload.
Reviews: Retained indefinitely as part of the Platform’s public record, even if your account is deleted (the reviewer’s display name is anonymized).
Profile change history (display name and photo): Retained for 2 years, then deleted.
In-app notifications: Retained for 30 days, then deleted.
Push notification delivery logs: Retained for 90 days. These are aggregate counters only — no user identifier or push token is stored in the log.
Recent-view records (the rows that power the “recently viewed” feature): Retained for 30 days.
Content moderation flags: Low and medium severity flags are retained for 1 year. High and critical severity flags are retained for 3 years.
Analytics events: Retained for 365 days. When you delete your account, the userId is set to null and any identifying breadcrumbs in the event payload are wiped before the cleanup window applies.
Operational error logs: Resolved errors are retained for 30 days. Unresolved errors are capped at 180 days regardless of resolution state.
Moderation audit log, user reports, appeals, and disputes: Retained for 3 years for safety and compliance purposes.
Password reset codes and email verification codes: Deleted as soon as they expire or are used.
Last known IP address and device identifier (see Section 1.2): Stored last-write-only with no history. Cleared when you delete your account.
Content snapshots: Before-and-after versions of moderated content may be retained for the lifetime of the corresponding moderation record (subject to the same flag windows above).

When you delete your account, we will delete or anonymize your personal information within a reasonable timeframe, except where retention is required by law or for legitimate business purposes (such as fraud prevention or resolving disputes). You can exercise your right to deletion at any time through Settings › Privacy › Delete My Account.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

For All Users

Access: You can view your personal information at any time through your profile and account settings
Correction: You can update your personal information through the Edit Profile screen
Deletion: You can delete your entire account and associated data through Settings › Privacy › Delete My Account. Account deletion is permanent and cannot be undone.
Notification Preferences: You can control email notifications, push notifications, message alerts, application updates, and promotional communications through your notification preferences in Edit Profile
Data Portability: You can request a copy of your personal data by contacting us at the email address below
Withdraw Consent: Where we rely on your consent to collect, use, or disclose your personal information, you may withdraw that consent at any time (subject to legal or contractual limits) by adjusting your settings, deleting your account, or contacting our Privacy Officer

For Canadian Residents (PIPEDA & provincial privacy laws)

We handle your personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. You may: access the information we hold about you and request a copy; request corrections; and withdraw consent to our collection, use, or disclosure (subject to legal/contractual limits) by deleting your account or contacting our Privacy Officer. If you have a concern we can’t resolve, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca · 1-800-282-1376). Quebec residents may have additional rights under Quebec’s Law 25.

For California Residents (CCPA)

Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions
Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a clear opt-out mechanism.
Non-Discrimination: We will not discriminate against you for exercising your privacy rights

For European Economic Area (EEA) Residents (GDPR)

Legal Basis: We process your data based on your consent (account creation), contractual necessity (providing the Platform), legitimate interests (safety and improvement), and legal obligations
Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances
Right to Object: You may object to processing based on legitimate interests
Right to Data Portability: You may request your data in a structured, machine-readable format
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority

To exercise any of these rights, please contact us at [email protected]. We will respond to verified requests within 30 days (or as required by applicable law).

9. Children’s Privacy

The Platform is not intended for use by anyone under the age of 18, consistent with our Terms of Service §2 (Eligibility). We do not knowingly collect personal information from minors. At registration, every user must affirmatively confirm they are 18 years of age or older — that attestation is recorded on the account. If we become aware that we have collected personal information from anyone under 18, we will take steps to delete that information promptly.

If you believe a minor has provided us with personal information, please contact us immediately at [email protected].

10. Third-Party Service Providers

The Platform relies on the following third-party processors. Each processes data on our behalf, in the country listed, under its own published terms and privacy policy. All processors below operate in the United States, which means your information is transferred outside of Canada for these purposes — see Section 11 for the cross-border transfer disclosure.

Resend (United States) — Transactional email delivery. Receives your email address and the contents of system messages we send you (email verification codes, password reset codes, username reminders).
Google Vision (United States) — Automated image moderation. Receives the bytes of images you upload (profile photos, gig and service images, gallery photos, message image attachments) for the purpose of detecting policy-violating content.
Gemini (Google, United States) — Automated text moderation and AI-assisted search query expansion. Receives the text of gigs, jobs, offered services, messages, reviews, profile bios, and search queries you submit, for the purpose of detecting policy-violating content and improving search results.
Google Cloud Storage (United States) — Image hosting. Stores the image files referenced above (profile photos, gig and service images, gallery, message attachments) in our own private storage bucket. The files are not publicly accessible; they are served only through our authenticated server.
Expo Push Notification Service (United States) — Mobile push notification delivery. Receives your device push token (if you have granted notification permission) and the title, body, and metadata of each push notification we send to you.
Neon (United States) — Managed PostgreSQL database hosting. Stores the underlying platform data — your account record, gigs, applications, messages, reviews, notifications, moderation history, and other operational data described in Section 1.

We encourage you to review the privacy policies of these third-party services. We are not responsible for their privacy practices.

11. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws than your own.

By using the Platform, you consent to the transfer of your information to these countries. Where required by law, we will ensure appropriate safeguards are in place for international data transfers.

When service providers process your information outside Canada (including in the U.S.), we use contractual and other measures to require a comparable level of protection. While abroad, your information may be subject to that country’s laws, including lawful access by its courts or government.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes:

We will update the “Effective Date” at the top of this page
We will notify you through the Platform or via email (if you have provided one)
For significant changes affecting how we use your data, we may request your renewed consent

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer at:

Privacy Officer, Corkboard Group Inc.
Email: [email protected]

We aim to respond to all privacy-related inquiries within 5 business days and will address data rights requests within 30 days (or as required by applicable law).