What we hold, and why

Aupex is run by Jacob Fletcher, an individual rather than a company. That person is responsible for the information described here, and questions go to admin@aupex.dev.

• The launch waitlist — if you used the form on the holding page before Aupex opened: your email address, and whichever of these you chose to add — whether you were looking for work or looking to hire, the company you named, what you said you do or need, and a link to a portfolio or site. Read only by us, to start vetting you before launch, and never shown to anybody else.
• Referrals — a referral code of your own, and the code of whoever referred you if you entered one. The code is a random string tied to nothing about you, and it is meant to be shared. Entering somebody's code records that they introduced you, which is read by us when deciding who to admit; it is never shown to other members, and it grants nobody access to anything.
• Your account — email address, name, a handle, and a password stored only as a bcrypt hash. The address is confirmed by a link, and that confirmation is what unlocks posting, bidding and inviting.
• Your profile — everything you choose to fill in: headline, biography, location, timezone, website, discipline, seniority, rate, availability, hours, years of experience and skills — and for a client, the company name, size and industry.
• What you do in the marketplace — projects and roles you post, statements of work you write or receive, comments on them, invitations, engagements and their milestones, reviews written about you and by you, vouches, badges, and talent you save.
• Verification evidence — whatever you submit to be verified, and the decision made on it with its reason. Read by staff, and never shown to other members.
• Anything you write in the feed — the text of a post, and any image attached to it.
• Mail sent to you — a copy of every message, its subject and body, and what the delivery provider reported back — delivered, bounced, or marked as spam.
• Usage — which page was viewed and which site linked to it, by hostname only. Tied to a random per-browser identifier, and to your account once you sign in.
• Security bookkeeping — failed sign-in, registration, password-reset and confirmation attempts, counted against an address or a browser identifier so that guessing a password is slow.
• Staff actions — a record of every administrative action taken on an account, including who took it and why.

No IP addresses are stored — not for usage numbers, not for rate limiting, not in the security log. The rate limiter counts against an email address or a browser cookie instead. That is a weaker defence against somebody determined, and it is the trade that was chosen.

There are no third-party analytics, no advertising pixels, no fingerprinting and no scripts from any other company on any page. The usage numbers come from the application itself. Referring sites are stored as a hostname and never as a full URL, because a full referrer is a tracking surface and the hostname answers the only question being asked.

Two, both set by this site. A session cookie, which is signed, HTTP-only, and is what keeps you signed in; and a visitor cookie holding a random identifier so that a repeat visit counts as one person rather than two. Neither follows you anywhere else, and there are no third-party cookies to refuse.

• Everybody — a contractor's profile, discipline, rate, availability, skills, rating, badges and vouches; open projects and the roles inside them. These are indexed by search engines — being found is what the directory is for.
• Signed-in members — the feed and everything on it. Posts and their images are served only to a signed-in session.
• The other side of a deal — a statement of work, its milestones and its comments are visible to the client and the contractor on it and to nobody else. A client's private notes on a bid are visible only to that client's own side.
• Staff — your account record, verification evidence, moderation history and the mail log, where support or moderation needs it. Anything that changes something is written to the audit log.
• Nobody — your password. It exists only as a hash and cannot be read back by anyone, including us.

Email is delivered by Postmark, which receives your address and the content of messages sent to you. The site runs on Amazon Web Services, which holds the server and its storage. Those are the only two.

Nothing is sold, and nothing goes to an advertiser or a data broker. Under the California Consumer Privacy Act this is a business that does not sell or share personal information, so there is no opt-out to offer — there is nothing to opt out of. Information would be handed over in response to a valid legal demand, and if the site were ever transferred to somebody else you would be told before it moved.

• Your account and everything on it — for as long as the account exists. Deleting it removes your profile, your posts, your bids and your uploads.
• Feed activity — 90 days. The feed cannot show anything older than that, so nothing older is kept — a scheduled job deletes it.
• Security attempts — an hour at most. Rows are deleted once they are too old to count against a limit.
• Reviews and completed engagements — these are part of somebody else's record as well as yours, so a completed contract and the review on it outlive the account that wrote them, with the author no longer named.
• Mail log and audit log — kept as the record that something was sent or done. A deliverability complaint and a support question are both answered from these.

A copy of everything held about you, a correction to anything wrong, or deletion of your account and its contents. Most of it you can do yourself in Settings; anything you cannot, ask at admin@aupex.dev and it is answered within thirty days. You will not be treated any differently for asking.

Notification email is per-category and switchable in Settings. Anything sent to a list rather than to you personally carries an unsubscribe link that works without signing in, and that link is honoured immediately. Mail about your own account — a password reset, a bid you received — is part of using the site rather than a list, and stops when the account does.

Passwords are hashed with bcrypt and never stored or written to a log in any other form. Sessions are signed and can all be revoked from Settings, which signs every other browser out at once; changing a password does the same. Sign-in, registration, reset and confirmation are rate-limited. Uploaded images are checked by their actual bytes rather than by their filename, and are re-encoded before they are stored.

None of that is a guarantee. If a breach ever affects your information you will be told what happened and what to do about it.

Aupex is for professional contracting and is not for anybody under 18. Accounts are not knowingly created for children, and one found to belong to a child is deleted.

On servers in the United States. If you are outside the US, using the site means your information is handled there, under US law.

When this changes, the date at the top changes with it. Anything that materially alters what is collected or who it goes to is emailed to registered accounts before it takes effect, rather than quietly published.