Legal

Privacy Policy.

Last updated: August 5, 2026

Jobs & Bids is run by Jobs and Bids LLC, an Illinois company. This page says what we collect, who else touches it, how long we keep it, and what you can control. It covers the website, the emails, and the mobile app.

What We Collect

• Account details: your name and email, to run your account and deliver bid digests. Your password is stored as a one-way hash, never as text we can read.
• Phone number: only if you provide it.
• Matching preferences: trades, base ZIP, travel distance, your feed state, and any licenses or certifications you add, used to filter and rank the bids you see.
• Profile and public content: your username, company name, license number, city, what kind of member you are, and anything you write in the network: posts, comments, questions, and reviews. Every member is listed in the member directory, which any signed-in member can search. There is no opt-out of the directory. Your trade and state always show on your profile. Your email, phone, and city only show if you switch them on in Settings.
• Jobs you post: the title, description, trades, location, budget, deadline, and the contact details you put on the posting. Paying members see the full posting, including those contact details. Everyone else sees a locked teaser.
• Bids you place on member jobs: the amount, your note, and the timestamp. Bid amounts are sealed. The dollar figure and the note are shown only to the member who posted the job and to you. Rival bidders never see your price. They see that a bid exists, and you see your own rank in the pack. We also record that you accepted the bidding disclaimer, and when.
• Direct messages: messages you send other members are stored so they can be delivered and read.
• Photos you upload: post photos, your profile picture, and any screenshot you attach to a bug report. Photos are resized, converted to WebP, and stripped of camera metadata (including GPS) before they are stored. In production they are stored in a Cloudflare R2 bucket and served from a public web address, so the file itself is reachable by anyone who has the link, even though the page around it is not. If a post has several photos, we compose them into a single preview image so links pasted into a text message or a social feed show the work. That preview is public.
• Company and team accounts: if you join an Enterprise or multi-seat company account, we record which company you belong to, your role and job title, who invited you, and when you were invited, joined, suspended, or removed. Your company's owner and admins can see your name, the email on your seat, your role and title, your seat status, and the date you last signed in. They cannot read your direct messages, your saved bids, or the amount of a bid you placed. Every seat action is written to an audit log for the company.
• Trophies and track record: badges you earn, plus the completed jobs, reviews, and tenure they are calculated from.
• Payment information: handled entirely by Stripe. Full card numbers never reach our servers. We store your Stripe customer and subscription id, your plan, and whether you bill monthly or yearly.
• Security and usage data: IP address, browser and user-agent, and a per-device sign-in record, used for sign-in, device limits, abuse prevention, and (when you post in the marketplace) to record your attestation.
• Product analytics: page and feature events tied to a random anonymous id, a shortened user-agent, and a referral tag if you arrived with one. No names or emails go in this table.
• Bug reports: what you typed, the page you were on, your screen size, your browser, and a hashed (not plain) IP address.
• Mobile app: if you turn on push notifications, we store the device push token the app gives us.

Cookies & Tracking

• Our session cookie. The site sets one cookie, including for visitors who are not signed in. It holds your sign-in state (once you sign in), the device type we detected, a random anonymous analytics id, and a referral tag if you arrived with one. It is HTTPS-only, cannot be read by JavaScript, is limited to our own site, and lasts up to 30 days. It is required for the site to work, so there is no way to turn it off and still sign in.
• Google Ads. Every page loads the Google Ads tag (gtag.js). Google sets its own cookies through it and can use them to measure our ads and to build advertising audiences on its own platforms. When a checkout completes we send Google the purchase amount, the currency, and a transaction reference. We do not send Google your name, email, or phone number.
• Meta pixel. The site has a Meta (Facebook) pixel built in, but it is switched off and does not load. We will update this page if that changes.
• Cloudflare. Our traffic runs through Cloudflare, which may set its own security cookie to tell people apart from bots.

Because of the Google tag, some information about your visit does reach a third party that uses it for advertising purposes of its own. If that is not acceptable to you, most browsers can block third-party cookies and trackers site by site, and Google offers its own ads settings controls.

What We Don't Do

• We do not sell your personal information.
• We do not rent, trade, or hand your name, email, or phone number to advertisers, data brokers, or anyone else for their own marketing.
• We do not use your personal information or your content to train AI models.
• We do not take a cut of any job, so we never see or handle money moving between members.

Who Else Handles Your Data

We use a short list of outside companies to run the service. Each gets only what it needs.

• Stripe (payments): your email, your plan, and your card details, which you give to Stripe directly. Stripe tells us whether you are paid up.
• Cloudflare (DNS, CDN, and firewall): every request to the site passes through it, so it sees your IP address, the page you asked for, and your browser.
• Cloudflare R2 (file storage): the photos you upload. Files there are served from a public address.
• Our email provider (Resend, over SMTP): your email address and the contents of the emails we send you, including digests, invites, and account notices.
• Google Ads (advertising measurement): see Cookies & Tracking above.
• Expo (mobile push), which passes messages on to Apple and Google: your device push token and the text of the notification.

Our AI is not on that list, on purpose. The models that read member posts and job listings for spam and quality run on our own hardware, reached over a private tunnel. Member content is not sent to OpenAI, Google, Anthropic, or any other outside AI service, and it is not used to train anything.

How Long We Keep It

• Direct messages: automatically deleted after 90 days.
• Product analytics events: automatically deleted after 180 days.
• Scrape and job logs: automatically deleted after 14 days.
• Sign-in device sessions: dropped after 30 days without use.
• Member job postings: removed 14 days after the deadline passes, unless the job has a review attached to it.
• Everything else (your account, profile, posts, bids, trophies) is kept while your account exists, and goes when you ask us to delete it.
• Photos: taking a post down removes it from the site immediately. The stored image file is not deleted automatically at that moment. If you want a photo erased from storage, tell us and we will delete it.

Deleting your account removes your profile, posts, comments, questions, messages, saved bids, notifications, trophies, sign-in sessions, and the bids you placed. Public contract-award records stay, with the link to you removed, because those are public facts we did not create.

Security

The whole site is HTTPS only, behind Cloudflare's firewall. Passwords are hashed. Session cookies are HTTPS-only and cannot be read by JavaScript. Card numbers never touch our servers. Uploaded images are re-encoded and stripped of metadata. Access to the live database is limited to the people who operate the company. No system is perfect, and we will not pretend otherwise.

If Something Goes Wrong

If member data is exposed in a way that could put you at risk, we will email the people affected without undue delay, tell you plainly what happened and what was involved, and notify regulators where the law requires it.

Children

Jobs & Bids is a business tool for contractors and the people who hire them. It is not for children, and it is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Your Choices

• Emails: change your digest day, time, and content in Settings, switch bid emails off entirely, or use the unsubscribe link in any digest. Unsubscribing stops the emails only. It does not cancel a paid subscription.
• Your profile: choose whether your email, phone, and city are shown to other members.
• Devices: see every device you are signed in on, and sign the others out, from Settings.
• Your data: ask us for a copy of what we hold about you, or ask us to correct it.

Changes To This Policy

We update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will announce it by email.

Contact

Privacy questions, data requests, and deletion requests all go to the same place: contact us. Deletion requests are confirmed and completed within 7 days.

Jobs and Bids LLC
244 S Randall Road PMB 1169
Elgin, IL 60123