Privacy Policy

You give us: your email, name, and whatever you choose to put on your profile. Your posts, comments, reactions, messages and job applications. Optionally, a work email used solely to check its domain against a company.

We derive: a keyed hash of your IP address and user-agent for device recognition, a coarse region from your CDN headers, and timestamps of security-relevant events.

We do not collect: your precise location, your contacts, your browsing on other sites, or any advertising identifier. There are no third-party advertising or tracking scripts on this platform.

If you sign in using Google OAuth, we collect your basic Google profile information (your email address, name, and profile picture) solely to authenticate your identity and maintain your account.

• Use & Storage: Google data is used exclusively for user authentication, account setup, and security log attribution. We store your email and profile name securely in our database.
• No Selling or Advertising: We do not sell, trade, or share your Google user data with third parties. Google user data is never used for personalized advertising, retargeting, or marketing purposes.
• Google Policy Compliance: LinkedOut’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Revoking Access: You can revoke LinkedOut’s access to your Google account at any time via your Google Security Settings or by deleting your account in Settings → Data Privacy.

• Your raw IP address. IPs are hashed with a server-side key before storage. The hash recognises a returning device; it cannot be reversed to an address.
• Photo location data. EXIF metadata is stripped from every image twice — once in your browser during upload, and again on the server. A photo attached to an anonymous review cannot carry GPS coordinates.
• Your search history. Recent searches live in your browser’s localStorage and are never sent to us.
• Your password or security answer. Both are stored as bcrypt hashes.

An anonymous post shows a generated handle derived from a per-account secret and the post’s scope, using HMAC-SHA256. The same person reviewing the same company twice produces the same handle, so readers can recognise a repeat reviewer. Handles for different companies are unlinkable to each other.

Your real account is recorded on the row. It is never included in any public API response — author identity is projected in exactly one function in the codebase, and anonymous posts return a null id rather than an obfuscated one.

Identity can be seen by a human in only two circumstances:

• A moderator reviewing the content because it was reported or auto-held. Each such view is recorded with the moderator’s name, the reason and a timestamp.
• A valid, binding legal order. Where legally permitted, we will notify you before complying, and we publish aggregate transparency figures.

• Device fingerprints: 90 days, then deleted by a daily job.
• Read notifications: 90 days.
• Sessions: until they expire or are revoked, then removed 30 days later.
• Verification and reset tokens: deleted the moment they are used or expire, whichever comes first.
• Media uploaded but never attached to a post: deleted after 24 hours.
• Security logs: 90 days, then deleted by a daily job.
• Deleted accounts: personal data removed 30 days after you request deletion. Posts remain, reattributed to “Deleted member”.

Regardless of where you live, you can:

• Access everything we hold — request an export. It arrives as a complete archive within minutes.
• Correct anything on your profile at any time.
• Delete your account and personal data, subject to the review retention explained in the Terms.
• Port your data — the export is machine-readable JSON.
• Object to processing, or restrict it.
• Complain to your data protection authority.

We process your data on the basis of your consent (provided at sign-up), contractual necessity (to operate your account and deliver the service), and legitimate interest (platform security and abuse prevention), in accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Each of these is a processor with a specific job:

• Vercel — hosting and CDN. Sees request metadata.
• Neon / PostgreSQL host — the database.
• Upstash Redis — rate limit counters and caches. Holds hashed identifiers, never content.
• Backblaze B2 — media storage. Files are content-addressed and stripped of metadata before upload.
• Cloudflare Turnstile — bot detection on auth endpoints.
• Google — sign-in, if you choose it, and the web fonts the interface is set in. Signing in returns your email address, name and profile picture, as described above. Loading a font sends Google your IP address, the same as any other request for a file; it sets no cookie and carries nothing about what you were reading.
• Resend — transactional email. Receives your address and the message; we log only a hash of the recipient.
• Sentry — error monitoring. Configured to scrub request bodies and personal data.

Each processor is bound by a data processing agreement. Data may be transferred outside India as necessary to operate the service through the processors listed above.

Three cookies, all strictly necessary. No analytics or advertising cookies.

• lo_session — your signed-in session. httpOnly, Secure, SameSite=Lax, 30 days.
• __Host-lo_csrf — cross-site request forgery protection. Readable by the page script by design; carries no authority on its own.
• lo_2fa / lo_challenge — short-lived, 10 minutes, set only mid-sign-in while a second factor or a network check is pending.

Because none of these is used for tracking or advertising, no consent banner is required under applicable law.

• Passwords hashed with bcrypt at cost 12.
• TOTP secrets encrypted with AES-256-GCM under a key held outside the database.
• Direct message bodies encrypted at rest with AES-256-GCM. This is not end-to-end encryption: we hold the key, so we can technically read a conversation. That is why messages can be disclosed under a valid legal order, and why they appear in full in your data export.
• Optional two-step verification and single-use backup codes.
• New-device detection with a security challenge and an email alert.
• Rate limiting with escalating delays and automatic lockout.
• A strict Content Security Policy and CSRF protection on every mutating route.
• Every security-relevant event logged and reviewable by you in Settings.

No system is perfect. If you find a vulnerability, tell us at support@linkedout.net.in before disclosing it publicly, and we will not pursue you for good-faith research.