Privacy Policy

Version 21 August 2026

Written to be specific rather than reassuring. Collabea is a demonstration deployment, but if you create an account the data below is really collected and really stored — so this describes exactly what happens to it.

What we collect when you sign up

Your email address and name, and a phone number if you choose to add one.
Your password, stored only as a bcrypt hash. We cannot read it, and neither can anyone who reads the database.
Your IP address and browser user-agent, recorded against the session so you can see and revoke your own signed-in devices from Settings.

What we collect as you use it

Profile content you enter: bio, location, niches, rate cards, portfolio.
Jobs, proposals, contracts, milestones and reviews you create.
Messages you send, and files you attach to them.
Connected social accounts, if you link any — see below.

Where it goes

Collabea is hosted outside your country and uses a small number of third-party services. Data reaches each of them only for the purpose named:

Hosting and database — the application and its database are hosted on commercial cloud infrastructure. Everything above is stored there.
Email — verification, password reset and notification email is sent through a third-party email provider, which necessarily receives your address and the content of the message.
File storage — uploads go to third-party object storage. Uploaded files are served from public URLs with no expiry. The addresses are long and effectively unguessable, but they are not access-controlled: anyone holding one can open the file, including after a contract ends or your account is deleted. Treat an upload as something you have published to whoever has the link.
Error monitoring — when the application errors, a report may be sent to a third-party monitoring service. Those reports can include your email address, and a proportion of sessions may be recorded as a replay of the screen. Text and media are masked in those recordings, but the pages you visited and the shape of what you did are not.

There is no advertising and no analytics in the product, and nothing you do here is tracked across other sites or used to build a profile of you. The error monitoring described above is the one exception to that, and it is there to fix faults rather than to study you. Nothing here is sold, and nothing is shared with anyone else.

Cookies

Collabea sets a session cookie so you stay signed in, and a cookie remembering your light or dark theme. If the site is password-gated, a cookie remembers that you entered the password. That is all — there are no advertising or analytics cookies, which is why you are not being asked to consent to any.

Connected social accounts

If you connect Instagram, Facebook, YouTube, X or TikTok, we receive your public profile and audience metrics from that platform. Access tokens are encrypted before they are stored and are never sent back to the browser. Disconnecting removes the tokens; revoking access from the platform's own settings has the same effect.

How long we keep it

For as long as your account exists. Sessions expire after 30 days of inactivity. Password reset codes last ten minutes; email verification links last 24 hours.

Your choices

See and correct — everything on your profile is editable from Settings.
Sign out everywhere — Settings shows every signed-in device and lets you revoke any of them.
Deactivate — hides your account; signing back in restores it.
Delete — Settings › Data Management. This anonymises your account immediately: email, name, avatar, bio, location and phone are cleared, and your login stops working. Contracts and messages you were part of are not deleted, because they are also the other party's record — but they no longer identify you. Uploaded files may remain at their existing URLs.

Anything else — including a copy of your data — by email: support@collabea.com.

Children

Collabea is for people aged 18 and over. We do not knowingly collect data from children.

Changes

If this policy changes materially, the version stamp at the top changes with it, and the version you agreed to is recorded against your account.

Read the Terms of Use →

What we collect when you sign up

Your email address and name, and a phone number if you choose to add one.

Your password, stored only as a bcrypt hash. We cannot read it, and neither can anyone who reads the database.

Your IP address and browser user-agent, recorded against the session so you can see and revoke your own signed-in devices from Settings.

Where it goes

Collabea is hosted outside your country and uses a small number of third-party services. Data reaches each of them only for the purpose named:

Hosting and database — the application and its database are hosted on commercial cloud infrastructure. Everything above is stored there.

Email — verification, password reset and notification email is sent through a third-party email provider, which necessarily receives your address and the content of the message.

File storage — uploads go to third-party object storage. Uploaded files are served from public URLs with no expiry. The addresses are long and effectively unguessable, but they are not access-controlled: anyone holding one can open the file, including after a contract ends or your account is deleted. Treat an upload as something you have published to whoever has the link.

Error monitoring — when the application errors, a report may be sent to a third-party monitoring service. Those reports can include your email address, and a proportion of sessions may be recorded as a replay of the screen. Text and media are masked in those recordings, but the pages you visited and the shape of what you did are not.

Connected social accounts

Your choices

See and correct — everything on your profile is editable from Settings.

Sign out everywhere — Settings shows every signed-in device and lets you revoke any of them.

Deactivate — hides your account; signing back in restores it.

Delete — Settings › Data Management. This anonymises your account immediately: email, name, avatar, bio, location and phone are cleared, and your login stops working. Contracts and messages you were part of are not deleted, because they are also the other party's record — but they no longer identify you. Uploaded files may remain at their existing URLs.

Anything else — including a copy of your data — by email: support@collabea.com.