Privacy Policy

1. Information We Collect

Talent profiles

When you create a talent account, we collect the information you provide during onboarding:

• Name, initials, and current job title
• Current employer (used solely for employer-blocking)
• Location and work style preferences
• Skills, years of experience, and seniority level
• Salary expectations and target roles
• Career achievements and deal-breakers
• Work email address (for verification purposes)
• Privacy preferences (anonymous mode, employer blocking, approach settings)

Company profiles

When you create a company account, we collect:

• Company name, website, and description
• Industry, size, stage, and headquarters
• Logo, perks, and careers page URL
• Billing information (processed by Stripe — we never store card numbers)

Automatically collected data

We collect limited analytics to improve the platform:

• Profile view counts and match activity
• Pitch and signal engagement metrics
• Browser type and general session information

2. How We Use Your Information

• Matching: Our matching engine scores talent-role compatibility based on skills, experience, salary, role type, and location. Scores of 30 or above generate a signal.
• Communication: We send OTP verification codes, pitch notifications, and platform updates via email.
• Billing: Company subscription management and payment processing through Stripe.
• Analytics: Aggregated, anonymized usage data helps us improve the matching algorithm and platform experience.

3. Anonymity & Identity Protection

Anonymity is central to Discreet. Here's how we protect your identity:

• Anonymous by default: Your name and employer are never shown to companies. They see only your skills, experience level, salary expectations, and career highlights.
• Work email hashing: Work email addresses are used solely for verification. They are never shared with companies or displayed on your profile.
• Employer blocking: When enabled, your profile is automatically hidden from your current employer's company account.
• Reveal is always your choice: Your identity is only shared with a company after you explicitly accept their pitch and consent to reveal.

4. Data Sharing & Third Parties

We do not sell your data. We share information only with the following service providers, solely to operate the platform:

• Supabase: Database hosting and authentication. Your data is stored with row-level security policies.
• Stripe: Payment processing for company subscriptions. Stripe handles all payment data directly.
• Resend: Transactional email delivery (OTP codes, notifications). We send only the minimum data required.

We may disclose information if required by law, court order, or to protect the rights and safety of our users.

5. Data Security

We implement multiple layers of security to protect your information:

• Row-Level Security (RLS): Database policies ensure users can only access their own data.
• OTP expiration: Verification codes expire after a short window and cannot be reused.
• HTTPS: All data in transit is encrypted.
• Access controls: Administrative database operations use a separate service-role client with strict access controls.

6. Your Rights & Choices

You have the right to:

• Access: View all personal data we hold about you through your profile and settings.
• Correction: Update your profile information at any time.
• Deletion: Request complete deletion of your account and associated data by contacting us.
• Portability: Request a copy of your data in a standard format.
• Opt-out: Disable the “open to approaches” setting to stop receiving new pitches, or enable anonymous mode for maximum privacy.

7. Cookies & Local Storage

• Authentication cookies: We use secure, HTTP-only cookies to maintain your login session.
• Local storage: We persist UI preferences (navigation state, view mode) in your browser's local storage for a seamless experience.
• No ad trackers: We do not use advertising cookies, tracking pixels, or third-party ad networks.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal or compliance purposes. Anonymized, aggregated analytics data may be retained indefinitely as it cannot be linked back to you.

9. Children's Privacy

Discreet is designed for employed professionals and is not intended for anyone under 18. We do not knowingly collect information from minors. If we learn that we have collected data from someone under 18, we will promptly delete it.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by email or through a notice on the platform. Your continued use of Discreet after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this privacy policy or want to exercise your data rights, contact us at:

privacy@discreet.so