Privacy policy

What we collect

• Account details: your name, email address and profile photo, from Google or the form you fill in.
• Profile content: your headline, bio, location, skills and the social accounts you choose to link.
• Reviews and replies you write, and reports you send.
• Contacts you choose to import when inviting friends: names and email addresses only, used once to show you the list.
• Technical data: IP address, browser, device and pages visited, used for security and to fix problems.

Google user data

If you sign in with Google we receive your name, email address and profile photo. If you choose "Import Google contacts", we ask for read-only access to your contacts and receive their names, email addresses and photos.

Imported contacts are shown only to you so you can pick who to invite. We do not store them on our servers, do not email anyone automatically, and never use them for advertising. The access token expires within an hour and you can revoke it any time at myaccount.google.com/permissions.

CredFolk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it

• To run your account and show your public profile.
• To publish and moderate reviews.
• To send emails you need, such as new reviews and security alerts. You can turn off non-essential emails in settings.
• To detect fake reviews, fraud and abuse.
• To understand how the site is used so we can improve it.

What is public

Your profile, linked accounts, reviews about you, and reviews you write (with your name and photo) are public. Your email address, imported contacts and reports are never public.

Who we share it with

We don't sell personal data. We share it only with providers that help us run CredFolk, under contracts that limit how they use it: Hetzner (the servers that host the site, its database and sign-in), our email provider (email delivery) and Google (sign-in).

We may disclose data when the law requires it, or to protect people from harm.

How long we keep it

We keep your account data while your account exists. When you delete your account we remove your profile within 30 days. Reviews you wrote are anonymised rather than deleted, so the people you reviewed keep an accurate history.

Your rights

• See and download a copy of your data.
• Correct anything that's wrong.
• Delete your account.
• Object to certain uses, such as product emails.

Download your data or delete your account from Dashboard, Settings. For anything else, contact us and pick "Privacy and my data". We answer within 30 days.

Cookies

We use a small number of cookies to keep you signed in and to credit invites. See the cookie policy for details.

Changes

If we change this policy in a meaningful way we'll tell you by email or on the site before it takes effect.