Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

[FULL LEGAL ENTITY NAME]
[Registered address, including postal code, city, country]
Company registration number: [TO BE SET]
Tax ID / VAT number: [TO BE SET]

Contact for privacy matters: [privacy@josh-app.example]
General contact: [hello@josh-app.example]
DSA single point of contact (for users and authorities): [legal@josh-app.example]

We have not appointed a Data Protection Officer (DPO) because our processing does not meet the thresholds in Article 37 GDPR. You may direct any privacy-related questions to the email address above and we will respond within 30 days.

2. Personal Data We Collect

2.1 Data you provide directly

Data	When collected	Purpose
Email address	Registration, login	Authentication, account recovery, security notifications
Password (hashed by Firebase Authentication; we never see the plaintext)	Registration	Authentication
Display name	Registration	Identifying you to other users in the feed and on the leaderboard
Profile avatar (optional, future feature)	Profile editing	Display on your profile
Photos of job advertisements you upload	Each upload	Sharing with the community feed and map
Job advertisement metadata you provide (title, company name, description, contact info if entered)	Each upload	Display on the feed and details screen
Reports of other users' content	When you report a post	Content moderation under the DSA

2.2 Data collected automatically

Data	Source	Purpose	Lawful basis
GPS coordinates of an upload	Device location services, only when you take a photo to upload	Showing the ad on the map; “near me” filter	Performance of contract (Art. 6(1)(b) GDPR)
OCR-extracted text from your photos	On-device text recognition (ML Kit on Android, Vision on iOS) — we do not transmit raw photos for OCR	Pre-filling the upload form	Performance of contract
Daily login streak, total XP, level, upload count, view counts on your uploads	Your activity in the App	Gamification, leaderboard, progress display	Performance of contract
Firebase Cloud Messaging (FCM) registration token	Set by Firebase SDK on first launch	Sending you notifications you have opted into	Consent (Art. 6(1)(a))
Crash reports (only if you opt in)	Firebase Crashlytics	Diagnosing crashes	Consent
Approximate IP address and device identifier	Set by Firebase services on every API call	Security, abuse prevention, geographic load balancing	Legitimate interest (Art. 6(1)(f)) — securing the Service
App language preference	Stored locally on your device	Localization	Performance of contract

2.3 Data we do not collect

• We do not collect your continuous location in the background. GPS is only sampled at the moment you take a photo to upload.
• We do not access your camera roll except when you tap “Choose from library”.
• We do not read your contacts, calendar, microphone, SMS, or call history.
• We do not use cross-app tracking identifiers (IDFA on iOS, AAID on Android) for advertising.
• We do not sell your personal data to anyone.

2.4 Sensitive data and OCR

The OCR feature may extract text from a photo that contains personal data of third parties (for example, a phone number written on a hand-made job ad in a shop window). You are responsible for ensuring you have a lawful basis to upload such content. By uploading, you confirm that:

• The photo was taken in a publicly accessible place;
• The advertisement is intended for public viewing;
• You will not upload photos showing identifiable individuals other than yourself unless you have their consent;
• You will not upload photos containing payment card numbers, identity documents, or other obviously sensitive personal data.

We may automatically scan uploaded photos for prohibited content (see Section 9).

2.5 Landing-page waitlist

Our public landing page offers a pre-launch waitlist. If you join it, we collect:

• Your email address;
• Your platform preference (Android / iOS / both);
• The time of signup and of your consent, and the privacy-policy version you accepted;
• If you arrived through a friend’s invitation link, the referral code of that link and a count of signups made through your own link (no identity of who referred whom is shown to anyone).

Purpose: to email you once, or a small number of times, about the launch of the JOSH app, and to operate the waitlist referral queue. Lawful basis: your consent (Article 6(1)(a) GDPR), given via the checkbox on the form. Storage: Google Firebase (see Sections 4–5). Retention: waitlist data is deleted no later than 90 days after the public launch, or earlier on request. Withdrawal: you may withdraw consent at any time by emailing support@josh-app.com — we will delete your waitlist entry.

3. Lawful Bases for Processing

Under Article 6 GDPR, we rely on the following lawful bases:

Processing	Lawful basis
Account creation, authentication, account management, providing the core Service	Contract (Art. 6(1)(b))
Displaying your uploads to other users	Contract (you upload them so others can see them)
Content moderation, fraud prevention, security, legal compliance	Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
Sending push notifications about your streak	Consent — you can withdraw at any time in Settings
Crash reporting	Consent — opt-in toggle in Settings
Sharing data with Firebase (our processor)	Contract (necessary to provide the Service)
Responding to a request from law enforcement or a court	Legal obligation

For each consent-based processing, you can withdraw consent at any time without affecting the lawfulness of processing performed beforehand.

4. Who We Share Your Data With

4.1 Public visibility

By design, the following data is public within the App and visible to every signed-in user:

• Your display name
• Your level, XP, streak, and leaderboard rank
• Your uploads (photo, title, company name, description, location, time)
• Reports flagged as ineligible for moderation review

Your email address, login credentials, FCM token, and crash reports are never shown publicly.

4.2 Service providers (processors)

We use the following service providers to operate JOSH. Each acts as a data processor under our written instructions and a Data Processing Agreement (DPA) compliant with Article 28 GDPR.

Provider	Service	Data processed	Country	Transfer safeguard
Google LLC (“Firebase”)	Authentication, Cloud Firestore database, Cloud Storage for images, Cloud Messaging (FCM), Crashlytics (opt-in), Hosting	All app data, including uploads, user profile, FCM token, crash reports	United States	EU Standard Contractual Clauses (Module 2 + Module 3) per Article 46 GDPR; also covered by the EU–US Data Privacy Framework where applicable
Apple Inc. (App Store)	App distribution and on-device payment infrastructure (if added)	Apple ID, App Store transaction data — handled by Apple, not by us	United States	EU–US Data Privacy Framework
Google LLC (Play Store)	App distribution	Google account ID, Play install metadata — handled by Google	United States	EU–US Data Privacy Framework

We do not share your personal data with advertisers, data brokers, or analytics services other than the providers listed.

4.3 Legal requests

We may disclose personal data if required by:

• A court order, subpoena, or other binding legal demand from a competent authority;
• The DSA’s notice-and-action mechanism;
• A request from law enforcement to prevent fraud, abuse, or imminent harm.

We will notify you before disclosing your data unless we are legally prohibited from doing so or notification would be counter-productive (e.g. ongoing criminal investigation).

4.4 Business transfer

If JOSH is acquired, merged, or sold (including via bankruptcy), your personal data may be transferred to the acquirer. We will notify you in advance and you will have at least 30 days to delete your account before the transfer takes effect.

5. International Data Transfers

Firebase and Google Cloud may process your data in data centres outside the European Economic Area, primarily in the United States.

Where data leaves the EEA, we rely on:

• The European Commission’s Standard Contractual Clauses (SCCs) as set out in Implementing Decision (EU) 2021/914;
• The EU–US Data Privacy Framework for transfers to US-based companies certified under the framework;
• Supplementary technical measures: encryption in transit (TLS 1.2+) and at rest.

You may request a copy of the relevant SCCs by contacting us.

6. How Long We Keep Your Data

Data	Retention
Account data (email, display name, password hash)	Until you delete your account
Your uploads (photos, metadata, GPS)	Until you delete the upload, you delete your account, or 30 days after the upload’s expiresAt if the upload is no longer “active”
Daily streak, XP, level, view counts	Until you delete your account
FCM token	Until you sign out, deactivate notifications, or delete your account
Reports you have submitted	12 months after submission, then anonymized for moderation statistics
Reports made about your content	24 months after resolution, to support DSA transparency reporting
Crash reports	90 days (Firebase Crashlytics default)
Backup snapshots	Up to 30 days after account deletion in Firebase backups before purge
Server access logs	14 days

When you delete your account (Settings → Account → Delete account), we hard-delete within 30 days:

• Your Firebase Authentication record;
• Your users/{uid} Firestore document;
• All your jobs/* Firestore documents you uploaded;
• All your photos in Firebase Storage at jobs/{uid}/;
• Your FCM token;
• Your entry in the leaderboard.

Some derived statistics (e.g. aggregate platform metrics) may be retained in anonymized form that cannot identify you.

7. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of them, email [privacy@josh-app.example]. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice).

Right	What it means	How to exercise
Access (Art. 15)	Get a copy of all data we hold about you	Settings → Account → “Download my data” (or email us)
Rectification (Art. 16)	Correct inaccurate data	Settings → Edit profile, or email us
Erasure (“right to be forgotten”, Art. 17)	Delete your data	Settings → Account → Delete account
Restriction (Art. 18)	Pause processing while a dispute is resolved	Email us
Portability (Art. 20)	Receive your data in machine-readable JSON	Settings → “Download my data”
Objection (Art. 21)	Object to processing based on legitimate interest	Email us
Withdrawal of consent (Art. 7)	Stop consent-based processing	Settings → toggle the relevant feature off
Not be subject to automated decision-making (Art. 22)	We do not use automated decision-making with legal effects	—

You also have the right to lodge a complaint with a supervisory authority. The competent authority for users in Hungary is:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf.: 9.
Phone: +36-1-391-1400
Email: ugyfelszolgalat@naih.hu
Web: https://naih.hu

If you live in another EU/EEA country, you may complain to your local supervisory authority — see https://edpb.europa.eu/about-edpb/about-edpb/members_en.

8. Children

JOSH is not intended for children under 16. We do not knowingly collect personal data from anyone under 16 in the EU/EEA, or under 13 elsewhere. If we discover that a user is under the applicable age, we will delete their account and associated data without undue delay. If you believe a child has provided us with personal data, contact us at [privacy@josh-app.example].

9. Content Moderation, Image Scanning, and Automated Processing

9.1 Image moderation

Photos you upload may be automatically scanned for prohibited content (nudity, violence, hate symbols, identity documents, or other content that violates the Terms of Service). Photos that are flagged as high-risk may be:

• Auto-rejected at upload;
• Held for manual review by our moderators;
• Removed after publication if reported by other users.

Image scanning is performed by Google Cloud Vision SafeSearch, which acts as our processor. Scanning results are stored alongside the upload for moderation review.

9.2 Content reports

When another user reports your content under our notice-and-action mechanism, you will be notified by email and in-app and given an opportunity to appeal (Section 10).

9.3 No personalized ranking

The feed is currently ordered by recency and proximity. We do not profile you or use your behaviour to personalize the order of jobs you see. If we introduce personalization in the future, we will update this Policy and provide an opt-out as required by Article 27 DSA.

10. Notice and Action — Reporting Illegal or Infringing Content (DSA)

In accordance with Articles 16 and 20 of the Digital Services Act, you can:

• Report content: tap “Report” on any job posting and choose a reason (inappropriate, spam/duplicate, not a job ad, or other). Reports are reviewed within 24 hours by our moderation team.
• Receive a Statement of Reasons: if your content is removed or restricted, we will send you a Statement of Reasons explaining the decision (Art. 17 DSA).
• Appeal a moderation decision: reply to the Statement of Reasons email within 6 months. We will re-review the decision within 5 business days.
• Out-of-court dispute settlement: if our final decision is unfavourable, you can refer the dispute to a certified out-of-court settlement body under Article 21 DSA. We will list the relevant body in the Statement of Reasons.

For reports concerning illegal content under EU or national law, send a substantiated notice to [legal@josh-app.example] including:

• A precise description of the content;
• The URL or in-app location;
• Your name and email (anonymous notices are allowed for content involving Articles 3–7 of Directive 2011/93/EU);
• A statement of good faith.

11. Security

We use industry-standard measures to protect your data:

• Passwords hashed by Firebase Authentication (PBKDF2 with per-user salt);
• TLS 1.2+ for all network traffic;
• Firestore Security Rules enforcing user-level access control;
• Firebase Storage Security Rules restricting writes to a user’s own folder;
• Image scanning at upload (Section 9);
• Role-based access in our admin panel; only authorized administrators have access to user data.

In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the competent supervisory authority within 72 hours in accordance with Articles 33–34 GDPR.

12. Cookies and Local Storage

The mobile app uses local storage on your device for:

• Authentication tokens (Firebase Auth);
• Cached jobs (SQLDelight database for offline use);
• Your settings (notification preferences, time, language, crash-reporting consent);
• A flag indicating you have completed onboarding.

We do not use third-party cookies or web tracking technologies in the mobile app.

The web admin panel uses only strictly necessary cookies for authentication. We do not use analytics, marketing, or advertising cookies on any web property.

Our public landing page keeps anonymous, aggregate visit counters (total page views per day and per language). These counters use no cookies and store no personal data — no IP addresses, no device identifiers, no browser fingerprints — so they involve no tracking of any individual visitor.

13. Push Notifications

If you enable push notifications in Settings, we send you reminders about your daily streak. Notifications are scheduled locally on your device by default; we do not currently send marketing or promotional pushes from our servers.

You can disable notifications at any time:

• In the App: Settings → Notifications → Daily reminders → off;
• On your device: system settings → Notifications → JOSH → off.

14. California, UK, Brazil and Other Jurisdictions

14.1 California (CCPA / CPRA)

If you are a California resident, you have rights similar to those in Section 7, including the right to know, delete, correct, and opt out of “sale” or “sharing”. We do not sell or share your personal information as those terms are defined under the CCPA.

14.2 United Kingdom (UK GDPR)

If you are in the UK, the UK GDPR and the Data Protection Act 2018 apply. You may complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk.

14.3 Brazil (LGPD)

If you are in Brazil, the LGPD applies. You may contact us about your rights under the LGPD using the same email address.

14.4 Switzerland, Canada, Australia, etc.

We apply GDPR-equivalent protections to all users globally. Contact us if you have questions about your rights under your local law.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Notify you in the App at least 30 days before the new version takes effect;
• For changes that require fresh consent (e.g. new processing purposes), ask you to consent again;
• Maintain a changelog at the website.

16. Contact

For any privacy-related question, complaint, or rights request:

Email: [privacy@josh-app.example]
Postal address: [Full registered address]

---

This policy was last updated on [DATE]. Previous versions are available on request.