Privacy Policy

MoonBaas (“The Work Network”) is a closed-beta job-matching platform. During the beta it is operated directly by the MoonBaas team. Questions about this policy: hello@moonbaas.com.

This policy covers the MoonBaas web app only — not the websites of employers or job boards we link to.

We collect only what the product needs to match you with work:

• Account details: your name, email address, and password. Sign-in is handled by our authentication provider (Supabase Auth); we do not store your password ourselves.
• Your profile: phone number, city and state (and ZIP if you add one — we never ask for a street address), how far you’ll travel, whether you’d relocate, remote/on-site/hybrid preference, reliable transportation, minimum pay, availability and shifts, job types, types of work you’re open to, skills/capabilities, and your search status (actively looking, open to offers, or just browsing).
• Your résumé (optional): if you upload one, the file is stored in a private storage bucket. Only you (and our administrators) can read it.
• Your activity: which matches you view, your “interested” / “not interested” votes, and your alert preferences.
• Messages: the plain-text messages you exchange with recruiters or employers inside the app.
• Consent records: timestamps and document versions when you accept these terms, and a per-introduction record whenever you consent to be introduced to an employer.

• Matching you with opportunities — by pay floor, distance, schedule, and your skills — and explaining why each match fits.
• Sending you match alerts by email (see section 6).
• Preparing introductions to employers — but only after your explicit, per-introduction consent. Being “interested” in a match is not consent.
• Letting approved recruiters message you, only after a relationship is accepted, inside the app.
• Running and improving the beta (debugging, safety, abuse prevention).

We do not sell your personal information. Sharing happens only as:

• Employers: only when you give explicit, per-introduction consent naming that employer, that opportunity, and exactly what is shared. Consent expires after 30 days and you can revoke it any time before the introduction is transmitted.
• Recruiters: approved recruiters see a limited view of your profile. Your contact details are masked by default and are shared only through the same per-introduction consent process — never handed out from messages.
• External job sites: many matches are listings from external job boards. We link you to the employer’s own application page; we do not send your profile, name, or contact details to those sites.
• Service providers: our infrastructure providers process data on our behalf — Supabase (database and authentication), Resend (transactional email), and job-listing providers such as Jooble (we send them search keywords and a location, not your name, email, or contact details).
• Legal: if required by law or to protect safety, we may disclose information as legally required.

Data lives in a managed Postgres database with row-level security (you can only read and edit your own data; only administrators can see more), and uploaded résumés sit in a private bucket. We take reasonable steps to protect your information.

We do not claim SOC 2, GDPR, CCPA, or any other compliance certification. We have not undergone a third-party security audit.

We send transactional email: sign-in/verification messages, security notices, and — if you keep them on — match alerts. You can turn “Strong matches” and the daily digest off any time in Settings. Account and security emails are always sent.

During the beta, emails may come from a test sender. We never add you to marketing lists; there is no marketing email in the beta.

We keep your information for as long as your account is active and as needed to run the service (for example, consent records for introductions that were sent). To delete your account and data, use the Delete my account option in Settings. Deletion is immediate and permanent once you confirm by typing DELETE: your profile, résumé, matches, messages, and other account data are deleted, along with your login. We keep one anonymized record that an account was deleted — no name, email, or other personal information — for our operational records. Shared records that don’t belong solely to you (such as job opportunities and employer listings) are kept. Backup copies may persist for a limited time.

Alert preferences and messages are part of your account and are deleted with it.

• Edit your profile any time from the Profile tab.
• Turn match emails off in Settings.
• Pause your search by changing your search status.
• Revoke introduction consent before it is transmitted.
• Delete your account and data from Settings (immediate and permanent after you confirm).

MoonBaas is intended for job seekers who can legally work. We do not knowingly collect information from children under 13. If you believe a child has provided us information, contact us at hello@moonbaas.com and we will delete it.

We may update this draft during the beta as the product changes. When we do, we’ll update the version date at the top. Material changes will be communicated in-app or by email before they take effect.