Privacy Policy

1. What We Collect

• Phone number — used for account creation and identity verification via SMS OTP. We do not use your number for marketing.
• Display name — optional, shown to other users on tasks you post or accept.
• Location data — GPS coordinates captured at the moment of evidence submission only. We do not track your location passively or outside of evidence capture.
• Photo evidence — images submitted as task completion evidence. Stored securely in private cloud storage (Supabase). Access is limited to the requester and CarbonSkills.
• Payment information — handled entirely by Stripe. CarbonSkills never sees or stores your card number, CVV, or full payment details. For payouts, Stripe collects identity information directly.
• Task activity — tasks posted, accepted, completed, and earnings history. Used to calculate your public profile stats.
• Device and usage data — basic request logs (IP address, user agent) for security and abuse prevention.

2. How We Use Your Data

• To operate the platform and process payments
• To verify task completion evidence
• To detect fraud and abuse
• To send transactional SMS (OTP codes, task status updates)
• To calculate and display your work record and stats

We do not sell your data. We do not use your data for advertising.

3. Third-Party Services

• Stripe — payment processing and identity verification for payouts. stripe.com/privacy
• Twilio — SMS delivery for OTP verification and task notifications. twilio.com/en-us/legal/privacy
• Supabase — database and file storage, hosted on AWS infrastructure. supabase.com/privacy
• Cloudflare — hosting and DDoS protection. Request metadata may pass through Cloudflare infrastructure. cloudflare.com/privacypolicy
• AI moderation — submitted evidence photos are processed by an automated content moderation API to verify task completion. Photos are not retained by the moderation provider beyond the review request.

4. Data Retention

We retain your account data for as long as your account is active. Evidence photos are retained for 90 days after task completion, then deleted. You may delete your account at any time from settings — account data is permanently deleted within 30 days of a deletion request.

5. Your Rights

You have the right to access, correct, or delete your personal data. To make a request, email us at privacy@carbonskills.ai or use the account deletion feature in settings.

California residents have additional rights under CCPA, including the right to know what data we collect and the right to opt out of data sale (we don't sell data, so this right is already satisfied).

6. Security

We use HTTPS for all data in transit, access-controlled private storage for evidence files, and industry-standard practices for credential storage. No system is perfectly secure — if you discover a vulnerability, please contact us at security@carbonskills.ai

7. Changes

We may update this policy as the platform evolves. Material changes will be communicated in-app. Continued use after changes constitutes acceptance.

8. Contact

Privacy questions: privacy@carbonskills.ai