Privacy Policy

You give us: your email, name, and whatever you choose to put on your profile. Your posts, comments, reactions, messages and job applications. Optionally, a work email used solely to check its domain against a company.

We derive: a keyed hash of your IP address and user-agent for device recognition, a coarse region from your CDN headers, and timestamps of security-relevant events.

We do not collect: your precise location, your contacts, your browsing on other sites, or any advertising identifier. There are no third-party advertising or tracking scripts on this platform.

• Your raw IP address. IPs are hashed with a server-side key before storage. The hash recognises a returning device; it cannot be reversed to an address.
• Photo location data. EXIF metadata is stripped from every image twice — once in your browser during upload, and again on the server. A photo attached to an anonymous review cannot carry GPS coordinates.
• Your search history. Recent searches live in your browser’s localStorage and are never sent to us.
• Your password or security answer. Both are stored as bcrypt hashes.

An anonymous post shows a generated handle derived from a per-account secret and the post’s scope, using HMAC-SHA256. The same person reviewing the same company twice produces the same handle, so readers can recognise a repeat reviewer. Handles for different companies are unlinkable to each other.

Your real account is recorded on the row. It is never included in any public API response — author identity is projected in exactly one function in the codebase, and anonymous posts return a null id rather than an obfuscated one.

Identity can be seen by a human in only two circumstances:

• A moderator reviewing the content because it was reported or auto-held. Each such view is recorded with the moderator’s name, the reason and a timestamp.
• A valid, binding legal order. Where legally permitted, we will notify you before complying, and we publish aggregate transparency figures.

• Device fingerprints: 90 days, then deleted by a daily job.
• Read notifications: 90 days.
• Sessions: until they expire or are revoked, then removed 30 days later.
• Verification and reset tokens: deleted the moment they are used or expire, whichever comes first.
• Media uploaded but never attached to a post: deleted after 24 hours.
• Security logs: retained for operational security and abuse investigation. [LEGAL REVIEW NEEDED: a specific retention period must be set and justified]
• Deleted accounts: personal data removed 30 days after you request deletion. Posts remain, reattributed to “Deleted member”.

Regardless of where you live, you can:

• Access everything we hold — request an export. It arrives as a complete archive within minutes.
• Correct anything on your profile at any time.
• Delete your account and personal data, subject to the review retention explained in the Terms.
• Port your data — the export is machine-readable JSON.
• Object to processing, or restrict it.
• Complain to your data protection authority.

[LEGAL REVIEW NEEDED: lawful bases for each processing purpose under GDPR Article 6, and the additional basis under Article 9 if any special-category data can appear in free-text reviews — which it can.]

Each of these is a processor with a specific job:

• Vercel — hosting and CDN. Sees request metadata.
• Neon / PostgreSQL host — the database.
• Upstash Redis — rate limit counters and caches. Holds hashed identifiers, never content.
• Backblaze B2 — media storage. Files are content-addressed and stripped of metadata before upload.
• Cloudflare Turnstile — bot detection on auth endpoints.
• Resend — transactional email. Receives your address and the message; we log only a hash of the recipient.
• Sentry — error monitoring. Configured to scrub request bodies and personal data.

[LEGAL REVIEW NEEDED: data processing agreements, sub-processor list, and international transfer mechanism for each of the above.]

Three cookies, all strictly necessary. No analytics or advertising cookies.

• lo_session — your signed-in session. httpOnly, Secure, SameSite=Lax, 30 days.
• lo_csrf — cross-site request forgery protection. Readable by the page script by design; carries no authority on its own.
• lo_2fa / lo_challenge — short-lived, 10 minutes, set only mid-sign-in while a second factor or a network check is pending.

Because none of these is used for tracking or advertising, no consent banner is required under the ePrivacy Directive. [LEGAL REVIEW NEEDED: confirm this analysis]

• Passwords hashed with bcrypt at cost 12.
• TOTP secrets encrypted with AES-256-GCM under a key held outside the database.
• Direct message bodies encrypted at rest with AES-256-GCM. This is not end-to-end encryption: we hold the key, so we can technically read a conversation. That is why messages can be disclosed under a valid legal order, and why they appear in full in your data export.
• Optional two-step verification and single-use backup codes.
• New-device detection with a security challenge and an email alert.
• Rate limiting with escalating delays and automatic lockout.
• A strict Content Security Policy and CSRF protection on every mutating route.
• Every security-relevant event logged and reviewable by you in Settings.

No system is perfect. If you find a vulnerability, tell us at security@linkedout.example before disclosing it publicly, and we will not pursue you for good-faith research.