Last updated 3 October 2026 · Effective 3 October 2026
The short version. We collect what you type into WorkRadius and the minimum needed to show you jobs near you. We do not sell your data. Your home address is sent to a mapping service to turn it into a point on a map. If you pay us, Stripe handles the card and we never see it. If you confirm a phone number, Twilio sends the code. If you arrived from one of our advertisements we note which one, for 90 days, so we can tell whether the advertisement worked — and not at all if you have opted out. Employers see your application when you apply to them, and nothing before that. You can delete your account and your data at any time from Settings, and it is really deleted.
WorkRadius ("we", "us") operates workradius.co, a map-based marketplace connecting people looking for local work with businesses hiring nearby. We are based in Colorado, United States.
For questions about this policy or your data: hello@workradius.co
| What | When | Why |
|---|---|---|
| Email address and password | Creating an account | To sign you in. Passwords are hashed by our authentication provider and are never visible to us. |
| First and last name | Creating an account | To address you, and to show employers who applied. |
| Phone number, location, job title, biography, skills | Completing a job seeker profile — all optional | Shown to employers you apply to or who invite you. |
| Business phone number | Employer accounts — required before your first job posting goes live | So a reachable person stands behind every posting, and so we can contact you about your account. See "How we use your phone number" below. |
| Résumé file and file name | Uploading a résumé — optional | Sent to employers you apply to. |
| Profile and cover photographs | Optional | Displayed on your profile. |
| LinkedIn profile URL | Optional | Shown as an identity signal on your profile. |
| Desired pay and preferred travel distance | Optional | Used to filter and rank listings for you. |
| Home or business address | Setting your search center — optional | To measure distance and travel time to jobs. See §4. |
| Business name, website, category, size, locations | Employer accounts | Shown publicly on your job postings. |
| Legal name and where to send referral rewards (a PayPal, Venmo or Cash App account, or bank details) | Only if you join the referral programme and add payout details | To pay rewards you have earned. Only you, when signed in, and our payment system can see them. |
| Applications, saved jobs, and messages | Using the service | To operate the product. If you or the other person reports a conversation, we read the messages in it to review the report. |
| Feedback you submit | Using the feedback button | To fix bugs. Sent with the page you were on, your role, your plan, your screen size and your browser version. |
We are stating this plainly because a phone number is the one piece of contact information people most reasonably expect not to be surprised by.
If you are an employer, giving us a phone number is a condition of publishing a job posting, and by giving it to us you agree that we may call or text you about:
If you are a job seeker, your phone number is optional, we do not require it, and we do not call job seekers to sell anything. Employers you have applied to may contact you using it.
What we will not do, for anyone:
Stopping it. Tell us to stop and we will: reply STOP to any text, say so on a call, or email hello@workradius.co. You can also delete the number from your profile, though an employer account cannot publish new postings without one. We will still contact you about anything genuinely required to operate your account, such as a billing failure or a security issue — those are not marketing and you cannot opt out of them while the account exists.
Business numbers are generally outside the US National Do Not Call Registry. If the number you give us is your personal mobile, tell us and we will treat it accordingly.
Advertising. If you are signed in and have not opted out of advertising, a hashed (scrambled) copy of your phone number goes to Meta from our own server whenever we count something you do, such as creating an account or paying, so that Meta can tell whether one of our advertisements worked. It is never sent in the clear. Opting out, through "Your Privacy Choices" or Global Privacy Control, stops it, and so does deleting the number from your profile. §8 explains how this works.
gclid. We store it against your account so that if you
later become a paying customer we can tell that platform which advertisement worked.
It identifies the click, not you: it carries no name, email or address, and it is
useless to anyone who does not already run that ad account. We keep it for 90 days and
then it is gone. If you have opted out of advertising, or your browser sends Global
Privacy Control, we do not record it at all — see §8.If you sign in with Google or LinkedIn, we receive your name, email address and profile picture from them. We do not receive your contacts, connections, posts, or employment history, and we cannot act on your behalf on those services.
We are candid about this because the product is mid-migration and the answer differs by data type.
| Data | Stored |
|---|---|
| Login credentials, account record, profile | Supabase, on servers in the United States |
| Applications, messages, saved jobs, and the settings we act on (such as whether you appear in employer talent search) | Supabase, on servers in the United States, tied to your account so they follow you between devices |
| Notifications you have read, drafts, and display preferences | Only in your own browser, using local storage on your device |
What browser storage means for you. This applies only to notifications you have read, drafts and display preferences — not to your applications, messages or saved jobs, which are on our servers and which we can recover for you. Data held only in your browser is not on our servers. We cannot see it, recover it, or transfer it to another device. Clearing your browsing data, using private browsing, or switching devices will lose it. We are moving this data to our servers; this policy will be updated when that happens.
This deserves its own section because it is the least obvious thing we do.
When you type an address to set your search center, we send that address text to two third-party geocoding services to convert it into map coordinates:
These services receive the address text and your IP address. They are independent of us and handle that data under their own policies. Both are volunteer- or community-operated and are not paid by us.
If you would rather not send your address anywhere, use "Drop a pin on the map" instead. That sets your search center from a point you click, and no address text leaves your browser.
We do not sell personal information. We share it only with services that help us run WorkRadius, and each one receives only what its job needs. Those jobs are hosting the site and storing your account; sending email and confirmation codes; taking payment; letting you sign in with another account; loading the page, its map and its routes; booking a call with us; and keeping track of the people and businesses we are in touch with. Advertising and measurement tags work differently, and are described in §8.
The providers we use today are:
| Service | Purpose | What it receives |
|---|---|---|
| Hosting the site and storing your account | ||
| Supabase | Accounts and database | Your account and profile data |
| Vercel | Website hosting | Your IP address and requests |
| Cloudflare | Domain, DNS and email routing | Requests to the domain; mail sent to our addresses |
| Sending email and confirmation codes | ||
| Resend | Sending our email | The recipient address and message content |
| Twilio | Sending the code that confirms your phone number | Your phone number and the six-digit code. Only when you ask us to confirm a number — never otherwise, and never for marketing. |
| Taking payment | ||
| Stripe | Taking payment, for paid plans only | Your name, email address, billing address and card details, plus what you bought, and the referral or representative code you arrived with, if there was one. Card numbers never reach WorkRadius. The payment form belongs to Stripe and runs inside their own frame or on their own page, so we never see, handle or store a card. If you choose to save your details with Link, Stripe’s saved-payment service, Stripe keeps them under Link’s own terms, and you can use them with other businesses that accept Link. We keep only the customer and subscription identifiers Stripe gives back, so we know what you are on. |
| PayPal (including Venmo) | Sending referral rewards | Your name, the PayPal or Venmo account you gave us, and the amount. Only when a reward you earned is paid that way. |
| Signing in | ||
| Google, LinkedIn | Optional sign-in | Only what is needed to authenticate you |
| Loading the page, its map and its routes | ||
| Google Fonts | Loading typefaces on some pages | Your IP address, as a side effect of loading the page |
| CARTO | Map tiles | Your IP address and the area of the map you view |
| Unsplash | Photographs on some of our pages | Your IP address, as a side effect of loading the page |
| FOSSGIS e.V. (routing.openstreetmap.de) | Working out drive times | Your IP address, the location you are searching from, and the locations of the jobs being timed |
| Mapbox | Drawing the route of a commute | The start and end points of the route. We send this request from our own server, so Mapbox does not see your IP address. |
| Booking a call with us | ||
| Calendly | Booking a walkthrough call | Your IP address when the booking page loads; and if you book, your name, email address, the time you choose, anything you write in the booking form, and how you found us |
| Keeping track of the people and businesses we are in touch with | ||
| HubSpot | Our customer records | Your name and contact details; your business details if you are an employer or ask us for a demo; and how you found us — which campaign or link brought you here |
We may also disclose information if legally required to, or to protect the rights and safety of users. If we are ever acquired, information may transfer as part of that transaction; we would notify you first.
This is deliberately restrictive and we intend to keep it that way.
Browsing a job does not tell that employer who you are.
Most listings are collected daily from employers' own public career pages and applicant-tracking systems. Applying to those takes you to the employer's own site, and their privacy policy governs what happens next. We do not receive your application.
Listings marked ⚡ posted on WorkRadius were created by an employer here, and applying sends your profile to them through us.
We use your browser's local storage to keep you signed in and to hold the data described in §3. Clearing it signs you out and erases anything not yet on our servers. That part is essential to the service and cannot be turned off while you are using it.
Vercel Inc. (US), the company that hosts this site, counts page views and measures how quickly pages load for us. It sets no cookie and stores nothing on your device. A visit is counted from the page address, the site that referred you and the ordinary technical details of a web request, and what we see back is aggregate — it cannot be used to follow you onto another website.
Because it cannot follow you anywhere, this runs whether or not you accept the advertising tags described below. It is how we know how many people visited at all, which the tags below cannot tell us: they only ever see the visitors who opted in.
We may use the following, through Google Tag Manager, to understand which parts of WorkRadius people use, to measure our own advertising, and to show our advertisements to people who have visited:
| Service | Run by | What it is for |
|---|---|---|
| Google Analytics | Google LLC (US) | Which pages are used, and where visitors arrive from. Aggregate, although if you are signed in to a Google account that allows it, Google may connect your visits here to that account. |
| Google Ads tag | Google LLC (US) | Measuring whether an ad we paid for led to a signup. If you are signed in, this includes a scrambled copy of your email address — see below. |
| Meta pixel | Meta Platforms (US) | The same, for advertising on Facebook and Instagram. |
| TikTok pixel | TikTok Inc. (US) | The same, for advertising on TikTok. |
| Microsoft Advertising (UET tag) | Microsoft Corporation (US) | The same, for advertising through Microsoft, including on Bing. |
These see the pages you visit on this site and the usual technical details of a web request. They never receive your home address, your applications made through WorkRadius, your messages or your résumé. Those never leave our own systems for this purpose. Your phone number reaches only Meta, hashed, through the server-side half described below.
Some of them record more than which pages you visit, and we would rather list it than leave it to the table:
Google, Meta, TikTok and Microsoft may also use what these tags record to show our advertisements to people who have visited WorkRadius, on other websites and apps.
The tags above are part of the website. The apps do not load any of them — no Google Analytics, no Meta, TikTok or Microsoft pixel. The apps use one measurement service instead, and only one.
We use AppsFlyer (AppsFlyer Ltd.) to understand which of our marketing led someone to install an app. In the apps, AppsFlyer records that the app was installed and which of the events we count happened in it, together with a device identifier and the account it belongs to.
If you turn off ad measurement, or your browser or device sends Global Privacy Control, the apps do not start AppsFlyer at all and nothing is sent. Not a reduced version and not an anonymised one — the service is never started, so there is no request to make. The same switch that turns off the website’s tags turns this off too, and it is re-read every time you return to the app rather than remembered from when you first opened it.
There is one exception in your browser, and we would rather spell it out than leave it in a table. If you are signed in, we send Google a scrambled copy of your email address so that it can tell which of its advertisements actually led to someone paying us. Google calls this “enhanced conversions”.
The scrambling is real: your address is turned into a fixed string of letters and numbers in your own browser, using a standard one-way method (SHA-256), and only that string is sent. Your actual address is not transmitted for this purpose.
We want to be straight about what that does and does not protect. Google cannot read your address back out of that string. It can, however, run the same scrambling over the addresses it already holds and see that two of them match — which is precisely how the measurement works. So if you have a Google account under the same address, this can tell Google that the person who clicked its advertisement is the person who paid us. The scrambled address itself does not tell Google what you applied for, who you messaged or where you live.
Opting out stops it completely. Either method below — “Your Privacy Choices” or Global Privacy Control — and your address is never scrambled, never queued and never sent. This does not happen at all if you are signed out.
Under Colorado law, using these for advertising counts as targeted advertising, and you can refuse it. Two ways:
Opting out does not reduce anything about the service. Nothing here gates a feature.
We do not sell personal information. Once these companies receive an event, what they may do with it is governed by their own terms rather than by any restriction we have placed on them. What we control is whether anything is sent at all — and if you opt out, or your browser sends Global Privacy Control, nothing is.
Where this stands today: the Google Ads tag, the Google Tag Manager container, Google Analytics, the Meta pixel, the TikTok pixel and the Microsoft Advertising tag are running — on the app and on our standalone pages (booking a demo, trying the sandbox, referral invitations), behind the same opt-out everywhere.
The TikTok pixel runs only in your browser. The Meta pixel also has a server-side half, and it is fairer to say so than to let the table imply everything happens in your browser. When you do something we count — creating an account, booking a demo, beginning a checkout, paying — we report it to Meta twice: once from your browser and once from our own server, both carrying the same event identifier so it is counted once rather than twice. The server copy sends your email address and phone number hashed, never in the clear. It also sends the technical details Meta uses to match it to the copy from your browser — your IP address, your browser’s user-agent string, and the advertising cookies Meta has already set in your browser. Those are not hashed, because hashing them would match nothing. None of it tells Meta anything about your use of WorkRadius beyond the event being reported. If you have opted out, or your browser sends Global Privacy Control, neither half is sent to Meta — the opt-out travels with the server request rather than being applied only in the browser, because a server that never heard about it would otherwise keep reporting.
To be specific about what is reported and when, because “we measure our advertising” can mean almost anything: creating an account is one of the things we count, and it is counted for job seekers and for employers alike, on both Meta and TikTok. The two are recorded as separate events so that we can tell the two sides of the marketplace apart. What is sent is the same for both. TikTok learns only that an account was created. Meta learns that too, and also receives your hashed email address through the server-side half described above. Nothing about the account itself goes with that event: not what you searched for, not the jobs you looked at, not where you live, not your résumé, and not whether you ever applied to anything.
Job-seeking is a sensitive subject to advertise around, and both platforms treat it that way. Where an advertisement of ours is aimed at job seekers, we declare it to the platform under its employment category, which restricts how narrowly it can be targeted — by age, by gender, or by a tight radius around an address. That is a restriction we accept on ourselves, and it applies to the advertising rather than to anything stored here.
None of it loads at all if you have opted out through "Your Privacy Choices" or if your browser sends Global Privacy Control. That is not a preference applied afterwards — the code that loads these checks first, so for those visitors no request is ever made to Google, Meta or anyone else, and no advertising click identifier is written down either.
Google Tag Manager deserves a word of its own, because the name misleads. It is not a tracker and it collects nothing. It is a switchboard: it holds the tags listed above and decides when they run. Everything in this section applies to it exactly as it applies to them — it is loaded by the same code, behind the same check, and a visitor who has opted out never receives it.
Under the Colorado Privacy Act, and regardless of where you live, you may:
Delete your account yourself in Settings → Delete account, or email hello@workradius.co. We respond within 45 days, as Colorado requires.
We honor the Global Privacy Control browser signal.
Global Privacy Control covers advertising. It does not reach the records of your own dealings with us, such as your account, your plan and how you reached us from our app. If you open our website from a link in our iOS app, then once you are signed in we record that you arrived from the app, and we note it on anything you buy from there. We keep these because Apple may be entitled to a commission on purchases that start in the app, and we need to be able to tell which sales that would cover. They are records of how you reached us, not advertising.
Deleting your account removes your account record and profile from our database. Data that only ever lived in your browser is removed when you clear that browser's data.
Sign-in is handled by Supabase: passwords are hashed and never stored by us, and all traffic uses HTTPS. Database access rules mean your profile can only be read by you, apart from business details that employers deliberately publish.
WorkRadius is early-stage software. No system is perfectly secure. Please do not upload documents containing your Social Security number, financial account details, or immigration documents. A résumé does not need them, and no legitimate employer needs them before an offer.
WorkRadius is not intended for anyone under 16, and we do not knowingly collect information from anyone under 16. If you believe a child has created an account, email us and we will delete it. Employer accounts must be operated by someone 18 or older.
WorkRadius includes a Job Concierge that helps narrow a search. At present it runs entirely in your browser and sends nothing to any AI provider.
When we connect it to a language model, the text you type into it and a summary of your stated preferences will be sent to that provider to generate a response. We will update this policy and say so in the product before that happens. Your résumé and contact details will not be sent.
We will update this policy as the product changes — the storage arrangements in §3 in particular are expected to change. Material changes will be announced in the product. The date at the top always reflects the current version.
Privacy questions, requests, or complaints: hello@workradius.co
Colorado residents may also contact the Colorado Attorney General's Office.