Privacy
What Co Curate collects, why, and what it never does. Written to be read, not to be survived.
The short version. We collect what a staffing marketplace needs to work: who you are, what you're making, and what was agreed. We measure how people move through the site on our own server, with no cookies and nothing that follows you elsewhere. We don't embed third-party trackers, we don't sell anything to anyone, and individual creatives are never publicly browsable.
What we collect
When you make an account
Your name, email address, and whether you're here to commission work or to make it. If you set a password, we store only a bcrypt hash of it, never the password itself. If you sign in with Google instead, see below.
When you sign in with Google
Co Curate requests three standard scopes: openid, email, and
profile. From those we store your Google account identifier, your email address, and
your name. That's all of it.
We never receive your Google password. We do not request and cannot read your Gmail, Drive, Calendar, contacts, or any other Google service. If an account already exists under the same email address and Google confirms that address is verified, the two are linked so you don't end up with duplicate accounts.
When you use the platform
Briefs and commissions you create, including titles, scope, deliverables, dates and agreed amounts. Messages you send in a project room. Files you upload: images, PDFs and MP4s, up to 15MB each. Applications submitted through the invite form, including the work samples and links you choose to include. Records of emails the platform sent you.
How you move through the site
So we can see where the site is confusing and fix it, we record which pages you open, how long each one is on screen and how far down you scroll, which step of a form you reach, what you press, and when something goes wrong: a page error, a request that fails, or the same button pressed again and again. We also note your screen size (phone, tablet, or desktop), the site that sent you here, and, if you're signed in, whether you're a commissioner or a creative.
We never record what you type. A form field is known by its label only. We don't record your name or email with any of this, and we don't keep your IP address. A visit is grouped by a code made from your IP address and browser, mixed with a random value that is replaced every day and never stored, so we can't recognise you from one day to the next or work back to who you are. None of it is shared or sent to an outside analytics service. It lives on our own server and is deleted after 90 days.
If your browser sends Do Not Track or Global Privacy Control, none of this is recorded.
What we don't collect
No third-party analytics, no tracking pixels, no advertising identifiers, no session recording (we never capture video of your screen or what you type), no fingerprinting. The site's content security policy only permits scripts served by Co Curate itself, so third-party scripts cannot run here even if someone tried to add one.
We do not currently process card details. Payment rails exist in the code but run in test mode only; no live payment credentials pass through Co Curate today.
How we use it
To run the thing you asked for: match briefs to creatives, open project rooms, keep the record of what was agreed and delivered, and send the transactional email that goes with it: an invite approval, a commission quote, a password reset. We don't send marketing email.
We look at aggregate counts, such as how many projects reached a given stage or how many people stopped at a given step of a form, to understand whether the product works and where it needs to change. That's counting, not profiling.
Who else touches it
Only the services required to operate:
| Railway | Hosting and the Postgres database. All application data lives here. |
|---|---|
| Only if you choose Google sign-in, and only the three scopes above. | |
| Resend | Delivers transactional email. Receives the recipient address and message body. |
| Sentry | Receives reports when something on our server fails: the kind of error, where in our code it happened and the page address with any private link removed. No names, emails, messages or files. |
| Stripe | Payment rails, test mode only at present. No live payment data. |
We do not sell, rent, or trade personal information. We don't share it with advertisers or data brokers, because we don't work with any.
Who can see what
Individual creatives are never publicly browsable. There's no directory, no search, no public profile page. A creative becomes visible to a specific commissioner only inside an open brief's match feed, or when they send a commission link directly.
Project rooms are limited to the people on the project: the commissioner and accepted co-curators.
One thing worth knowing: uploaded files are served from long random URLs. Those URLs are unguessable, but anyone holding one can open it without signing in. Treat a file URL as you would the file itself, and don't upload anything you'd be uncomfortable sharing that way.
Cookies
One cookie, cc_session. It keeps you signed in, lasts 30 days, is marked
httpOnly and sameSite=lax, and is sent only over HTTPS in production.
There are no advertising or analytics cookies, and the visit measurement above stores nothing in
your browser, so there's no consent banner to dismiss.
Keeping it, and getting rid of it
We keep your data while your account exists, because the project record is the product. Ledger and project history are kept as the record of what was agreed.
There is no self-serve delete button yet. This is an alpha, and we'd rather tell you that than pretend otherwise. Email jaredkeys100@gmail.com and ask for your account and data to be deleted, and it will be. You can also ask for a copy of what we hold, or ask us to correct it.
Disconnecting Google sign-in doesn't delete your Co Curate account; ask us to delete it if that's what you want. You can revoke Co Curate's access from your Google account permissions at any time.
Security, honestly stated
Passwords are bcrypt-hashed. Sessions are signed cookies. Traffic is HTTPS. Credential endpoints are rate-limited, and the site sets a strict content security policy.
Co Curate is an early-stage prototype built by a very small team. It has not had an external security audit. Please don't reuse a password here that you use anywhere else, and if you find something broken, we'd genuinely like to hear about it at the address above.
Children
Co Curate is for professional production work and isn't intended for anyone under 18.
Changes
If this policy changes materially, we'll update the date at the top and, where it affects you, say so by email rather than quietly editing the page.
Contact
Questions, deletion requests, or anything else: jaredkeys100@gmail.com.