Privacy Policy

WorkSquare (worksquare.co) is a social hiring platform. Job seekers and recruiters use it to browse a job feed, discuss roles, apply, message, and keep a profile. This policy describes the data the product actually stores and the services that process it.

Information we collect

Account data is your email address, the password credential stored by Supabase Auth, and, if you choose Google sign-in, the Google identity linked to that login.

Profile data is what you add: username, name, bio, skills, location, experience, education, portfolio, GitHub, and LinkedIn links, plus an avatar and cover image.

A resume you upload is stored as a private file. It is not shown on your public profile. A recruiter can open it only for an application to a job they posted.

Content you create includes posts, comments, messages, reactions, job applications, bookmarks, and community membership. Settings store your privacy, notification, messaging, and appearance choices.

Interview practice sends Google Gemini the conversation so far, the job title, company, and description, and a summary of your profile (role, company, experience, education, skills, and bio). Your resume file is not sent. WorkSquare does not save the interview conversation; finishing a session records the karma it earns.

Voice practice asks for microphone access only when you start it. Your browser or device speech service turns speech into text (in Chrome, including Chrome on Android, this is Google speech recognition). The WorkSquare Android app uses the device speech recognizer for spoken answers and the device's built-in voice for spoken questions. WorkSquare receives that text, not an audio recording, and handles it like a typed prompt. Type instead stays available.

When you add a link to a post, WorkSquare's servers fetch that page to build a preview and store its title, description, image address, and site name in a shared preview cache. The preview image loads from the linked site when the post is shown. YouTube, Vimeo, and Streamable videos load from those services only after you press play.

Avatars, cover images, and images in public communities are stored at public addresses. Resumes, message attachments, and media in private communities are stored privately and opened through short-lived links. Hosting logs and product analytics are processed by Vercel, including Vercel Analytics and Speed Insights.

How we use it

We use this information to sign you in, show the feed, deliver applications and messages, and remember the preferences you set. We do not sell personal information.

Who processes it

Supabase stores the database, authentication, and uploaded files.

Vercel hosts the website and app shell, and provides analytics and speed measurements.

Cookies

Signing in stores a first-party session cookie named sb-…-auth-token. A large session is split into numbered pieces such as sb-…-auth-token.0. It is limited to this site, uses SameSite=Lax, can be read by the page, and lasts up to 400 days. Supabase Auth uses it to keep you signed in. Signing out clears it. A visit that never signs in does not set it.

Closing the welcome card on the feed stores ws_welcome_dismissed for one year, on path /, with SameSite=Lax, and Secure when the page is https. The value is 1. It only records that the card was closed.

The color theme is stored in this browser's local storage under getajob-theme-paper. That is not a cookie.

Every page loads Vercel Analytics and Vercel Speed Insights with no cookie option. WorkSquare does not call Analytics identify or group. The scripts they load do not write a cookie. In production, Analytics sends Vercel a page view, and Speed Insights sends page loading measurements. Neither sends those reports in development.

Google provides optional sign-in, the Gemini model used by interview practice, and, in Chrome, the speech recognition used by voice practice. In the Android app, Google sign-in opens in your device's browser and returns to the app.

Deleting your account

You can delete your account in the app under Settings → Account, or on the web at worksquare.co/delete-account. Deletion asks you to type DELETE and to re-enter your password. If you signed in with Google only, you sign in with Google again and then confirm.

Deletion is immediate. It removes the login, profile, settings, and files stored for your account, including your avatar, cover, resume, post images, and message attachments. Jobs, posts, comments, and communities you created are removed with the account. Messages you sent can remain in the conversation with the sender cleared. Records that only mentioned you, such as another person’s karma history, keep the record and drop the link to your profile.

If you cannot sign in, email privacy@worksquare.co from the address on the account and ask for deletion. We use that request to find the account and delete it the same way.

Contact

Questions about this policy: privacy@worksquare.co. The Terms of Service cover how the product may be used.