Privacy Policy

Leadly ("we") is a platform for finding local jobs — used by teens, students, young adults, the people who hire them, and freelancers looking for local clients. This policy explains exactly what we collect, why, where it goes, and what control you have. Leadly currently serves the United States and Canada.

What we collect

• Account: email, name, password (stored only as a secure hash by our auth provider), and optionally a phone number, business name, and profile photo.
• Job posts: title, description, pay, category, schedule, safety notes, an approximate location (a neighborhood or city name and, if you choose to attach it, approximate coordinates — never your exact address). Legacy listing photos may remain accessible through public image links. The current posting form does not collect new photos or contact details. Profile photo uploads are resized and their metadata is removed.
• Applications: your message, availability, age range (e.g. "Under 16", "16–17", "18+"), and experience. Your application is delivered to the job poster as an in-app message.
• Messages: the messages you send and receive in-app.
• Find Clients (freelancers): leads and businesses you save, notes, pipeline stages, earnings or revenue you record, and outreach you generate or send (including the recipient and content of outreach emails you choose to send).
• Reports & moderation: if you report content, we store the reason, note and necessary evidence in a private moderation queue; moderation decisions (automatic and human) are recorded in an internal audit log.
• Security events: our authentication provider keeps sign-in and account-security logs, which can include your account identifier, email, IP address, and browser information. Leadly also retains existing local security records according to the retention periods below. Your legal acceptances (terms version, date, IP) are recorded with your account.
• Newsletter: the email you subscribe with and which article you subscribed from.
• Support: messages you send to support, with your account email as the reply address.

Location

You can type a ZIP or postal code, or grant browser location permission — we use it to find jobs, businesses, and a readable city name near you. Your search preference is kept on your device. Location is sent to our server when needed for location services. Job posts store coordinates rounded to a coarse grid and neighborhood text. If you enable nearby-job push notifications, we also keep your selected postal area and coarse coordinates with the device registration. We never collect background or continuous location.

How we use your information

To run the platform: show jobs near people, deliver applications and messages, send the emails you'd expect (welcome, password reset, new-message notification, security alerts), screen new job posts for safety, power moderation and anti-abuse systems, and understand product usage in aggregate. We do not sell your personal data, we do not run ads, and we do not build advertising profiles.

What's public

Job listings are visible to signed-in users and show your display name and approximate location — never your email, phone, or exact address; all contact happens through in-app messaging. New profile photos uploaded through Leadly are accessible only to their account owner and authorized administrators. New job photos uploaded through Leadly are accessible to their account owner, authorized administrators, and other signed-in users who are permitted to view an approved, open listing that includes them. Photos previously uploaded to our public image storage remain accessible to anyone with their existing direct links. Messages and applications are private between the two people involved.

AI features and your data

AI sharing is optional and off until you explicitly allow it in Settings → Privacy preferences. You can change this choice there at any time. With permission, relevant tool text, skills, age range, general area and public business information may be sent to Anthropic for suggestions and post screening. Do not include contact details, exact addresses or sensitive information in AI tools. Freeform text can contain information you enter, so avoid sharing anything unnecessary. We do not send account credentials or private in-app conversations to the AI provider. You can use jobs, applications and messages without AI. Posts that cannot be safely screened are held for human review. See the AI Policy for more.

Analytics

Optional usage analytics are off until you turn them on in Settings. Your choice applies to this browser or app installation and is turned off when you log out or delete your account. Analytics are first-party: a pageview beacon records a random visitor id, the page path, coarse device type (e.g. iPhone/Android/Desktop), country, and referring site — no IP address is stored with analytics, and no third-party analytics or advertising scripts are loaded. When you are signed in, pageviews also include your account's user ID, and we update your last-active time to understand account activity. These signed-in records are linked to your account. With analytics enabled, blog reading events use a random visitor ID without an account ID. Article feedback you choose to submit works without analytics and uses a separate, article-specific identifier to prevent duplicate votes. A random identifier is pseudonymous; it is not a guarantee of anonymity. What never goes into these analytics: precise location, addresses, phone numbers, message contents, or your search text. You can turn analytics off anytime in Settings → Notifications → "Help improve Leadly with basic usage analytics."Turning analytics off stops future optional collection and clears its identifiers and referral information from this device; it does not delete historical records already received. Account deletion and the retention periods below apply to those records.

Cookies

Leadly uses only essential, first-party cookies: the session cookies that keep you signed in, and a short-lived cookie that remembers where to return you after sign-in. There are no advertising or third-party analytics cookies. Preferences like theme, language, and your saved search location live in your browser's local storage, on your device. Details are in the Cookie Policy.

Service providers

Employer Pro: We store your business name, private business contact details, hiring-location addresses, selected paid locations, Stripe customer/subscription identifiers, payment status and billing period to provide the employer service. Private onboarding addresses and contact details are not added to public job listings. Stripe receives your business contact email, business name, selected location identifiers and subscription quantity; payment-card details are entered directly with Stripe. Employer Pro badges show paid participation, not verification. With your optional analytics consent, we record job-detail views and application starts linked to your account, once per job and event type each UTC day. Employers see aggregate counts, not viewer identities. Completed-application counts come from actual applications and are needed to manage hiring. We remove employer engagement records tied to your account when your account is deleted. Stripe may retain financial records under its own legal and retention obligations.

We share data only with the processors needed to run Leadly, each limited to its function: Supabase (accounts, database, file storage), Anthropic (AI features, as above), Google (Maps, and Places searches — your search area is sent to return nearby businesses), Resend (sending email), Cloudflare (network security and the sign-up CAPTCHA, which processes your IP to tell humans from bots), and Vercel (hosting, which derives the country used in analytics). If paid plans are enabled, Stripe processes payments — card details go to Stripe directly and never touch our servers. We disclose information if required by law or to protect users' safety, and we may share aggregate statistics that identify no one.

How long we keep it

Your content and account data are kept while your account exists. The daily maintenance job removes local security events after 90 days, moderation audit records and page views after 365 days, and completed deletion receipts after 30 days. Hosting and authentication providers apply their own operational log and backup retention; ask support for details.

Deleting your account

Settings → Delete account permanently deletes your login, profile, applications, conversations and messages, saved leads and clients, outreach history, and support requests. Job posts you created are anonymised rather than deleted: the description, location, coordinates and pay are erased, the post is archived so it no longer appears anywhere on Leadly, and it is unlinked from you — the emptied record is kept only so people who applied to it keep their own application history. A few other things are not removed by account deletion: provider security logs (subject to provider retention), moderation audit records (kept for up to 365 days for accountability of enforcement decisions), analytics records without your account ID (such as signed-out pageviews and blog activity), and provider backups pending their normal expiry. Pageviews linked to your user ID are removed with your account. We remove newsletter subscriptions matching your account email and local security events tied to that email. Account deletion removes your uploaded files through the storage service and removes your in-app conversations and messages. For Apple accounts, we first revoke the Apple connection; if reconnection is needed the app explains how. Copies another person independently saved, such as screenshots or previously delivered emails, cannot be recalled.

Your rights and choices

You can edit your profile in Settings, delete your account yourself, turn analytics off, and control email notifications. To request a copy of the personal data we hold about you (or correction of it), email [email protected] from your account email — there is no self-serve export button yet, so we fulfill these requests manually. We will never discriminate against you for exercising privacy rights.

Children and parents

Leadly is not for children under 13, and we don't knowingly collect their data — if we learn an account belongs to a child under 13, we will delete it. Teens 13–17 may use Leadly with a parent or guardian's permission. Parents and guardians can contact us at [email protected] to review what information we hold about their teen, have it corrected or deleted, or have the account closed. The Parent & Guardian Guide explains what teens share on Leadly and the safety features that apply.

California residents

California law gives you the right to know what personal information we collect (this policy is that disclosure), to access it, to correct it, to delete it, and to not be discriminated against for exercising those rights — use Settings or email us as described above. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no "Do Not Sell or Share" opt-out to make. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

If you are a California resident under 18, you may request removal of content you posted on Leadly by deleting it in the app or emailing us. Removal applies to content you posted; it may not extend to copies delivered to other users (like sent messages) or records we're required to keep, and it does not guarantee complete removal from all systems where the law does not require it.

Canada and international

Leadly serves the United States and Canada. For Canadian users, we handle personal information consistent with PIPEDA principles — collection limited to what the feature needs, use limited to the purposes above, and access/correction available on request. Data is processed on servers in the United States. If you use Leadly from elsewhere, you understand your data is processed in the US.

Security

Everything is served over HTTPS. Database access is protected with per-user row-level security — your private rows are readable only by you; internal logs are reachable only by our servers, never from a browser. Secret keys stay server-side. Sign-in is protected by rate limiting, attack detection with alert emails, and an optional CAPTCHA. Admin access is restricted to an allowlist, admin views mask user emails, and administrators never read message contents in analytics. No system is perfectly secure — if we learn of a breach affecting you, we will notify you as the law requires.

Changes and contact

We'll update this policy as Leadly evolves and change the date above; material changes will be flagged in the app. Questions or requests — including privacy, access, correction, and deletion requests: [email protected]. See also the Data Requests page and Account Deletion page.