Privacy Policy

Last updated: September 4, 2026

This policy explains what conjor collects, why, where it goes, and what control you have over it. It is written to be read, not skimmed past.

conjor is operated by an individual sole proprietor ("we", "us", "conjor"). Questions go to sean@conjor.io.

1. The most important thing: conjor is a publishing tool

conjor exists to publish information about you. That is the product. When you build a card, declare a profession, write a post, or list an opportunity, you are creating a page intended to be seen by anyone on the internet — recruiters, colleagues, clients, strangers, and search engines to name a few examples.

Read the rest of this policy with one distinction in mind:

We do not decide what goes in the first bucket — you do, deliberately, through the editor. Nothing is extracted from your card and published without you choosing it. But once you publish something, treat it as permanently public. We cannot recall a copy someone made, or remove your page from a third-party cache or archive.

2. Information you give us

2.1 Account information

• Email address — required. Used to identify your account, authenticate you, and send service notices.
• Display name — required, publicly visible, and on the Pro plan it becomes part of your card's URL.
• Account slug — a random 6-character code assigned at signup. Public. It cannot be changed.
• Authentication provider data — if you sign in with Google or Discord, that provider tells us your email address and a provider account identifier. We do not receive your password, contacts, friends list, or any other provider data.

We never see or store your password. Authentication is handled by Supabase Auth.

2.2 Card and profile content

Everything you place on your card is stored and published: your name, tagline, biography text, links, images, avatar, banner, status badge, embedded video and stream references, list items, statistics, and every configuration value that controls how the card looks.

2.3 Networking and discovery information

If you opt into the public directory, you additionally provide:

• Up to three declared professions
• Filter attributes for each profession, which you pick by hand in your account settings
• Universal attributes — your region, years of experience, and availability status (looking for work, open to work, or unavailable)

These are manually selected by you. Nothing is inferred, scraped, or extracted from your card content. All of it is published on your directory listing, and all of it is searchable and filterable by any visitor.

2.4 Posts, comments, likes, and opportunities

Post titles, cover images, and markdown bodies; comment text; likes; and opportunity listings including any organization name, logo, and link you attach. All public. Comments are attributed to your display name and link back to your profile.

2.5 Connections

When you send or accept a connection request, we store the pairing between the two accounts and your total connection count. Your connection count is public and influences your ranking in the directory.

2.6 Uploaded files

Images and videos you upload are stored in our media bucket under a folder keyed to your account ID.

Please read this one carefully. Our media bucket is public-read. Any file you upload is retrievable by anyone who has its URL — even if your card is unpublished, even if the post is a draft, and even after you remove it from your page. Unpublished does not mean private. Deleting the file is the only thing that makes it inaccessible. Do not upload anything you would not be comfortable making public.

2.7 Payment information

Paid plans are processed by Stripe. Card numbers, security codes, and billing addresses go directly to Stripe and are never transmitted to or stored on our servers. We store only the Stripe customer identifier, the subscription identifier, the subscription status, and your resulting plan tier.

3. Information collected automatically

3.1 View logs

When someone views your card, a post, or an opportunity, we record:

We do not store visitor IP addresses in our database. Country is resolved by our hosting provider at the edge and we receive only the resulting two-letter code — never a city, coordinates, or street-level location.

View counts feed the ranking score that orders directory results, so view logging is not purely cosmetic — it affects placement.

3.2 IP addresses and abuse prevention

We use the requesting IP address transiently to enforce rate limits and to stop a single source from inflating view counts. IP addresses appear only inside short-lived counter keys in our Redis cache, which expire automatically within their window (minutes to hours). They are not written to our database, not attached to your account, and not used for profiling.

3.3 Cookies

• Essential — session and authentication cookies set by Supabase Auth, scoped to our domain and its subdomains. Without these you cannot stay signed in.
• Preference — your light/dark theme choice.

We set no analytics or advertising cookies at all — see § 3.4. The two above are the only cookies conjor uses.

3.4 Analytics

We use Vercel Analytics and Vercel Speed Insights, and nothing else, for aggregate traffic and performance measurement. Both are cookieless: they set no cookie, store no identifier on your device, and do not track you across other websites. We removed Google Analytics in September 2026 rather than ask you to dismiss a consent banner for it.

conjor serves no advertising. Not on public card pages, not in the card editor, not anywhere in the app, on any plan. We run no ad network, we do not sell ad space, and we share nothing with advertisers. That is a standing product commitment, not just a description of today.

4. How we use information

1. To operate the service — render your card, run the directory, deliver posts and opportunities
2. To authenticate you and keep your session alive
3. To process payments and manage subscriptions through Stripe
4. To compute analytics for you and ranking scores for the directory
5. To enforce rate limits, storage quotas, and abuse controls
6. To send service-related email — account, security, and billing notices
7. To investigate violations of our Terms of Use and to comply with the law

5. What we do not do

We do not sell your personal information. We do not share it with data brokers. We do not rent mailing lists. We do not use your email address for third-party marketing.

We also do not read, mine, or repurpose your unpublished drafts for anything other than storing them and rendering them back to you.

6. Legal disclosure

We may disclose information where we believe in good faith that doing so is required to comply with a law, subpoena, court order, or lawful government request; to enforce our Terms of Use; or to protect the rights, safety, or property of conjor, our users, or the public.

If conjor is acquired, merged, or its assets transferred, account data may transfer as part of that transaction, subject to this policy.

7. Third-party processors

We use the following providers. Each processes data on our behalf under its own privacy policy.

A note on Twitch: if your card includes a stream component, we ask Twitch's public API whether that channel is live. The request contains only the channel name you entered. No visitor data, no account data, and no identifiers are sent to Twitch. Results are cached briefly on our side so that viewing your card does not generate a fresh Twitch request every time.

These providers operate in the United States and elsewhere; using conjor involves transferring your data to those locations.

8. Retention

Deleting a component, post, or opportunity removes its stored content, and we make a best-effort attempt to delete the associated uploads. Best-effort means exactly that: cleanup can fail quietly, and an orphaned file may persist until it is found.

9. Your choices and rights

At any time you can:

• Access and correct everything on your card, posts, opportunities, and directory listing through your account settings
• Unpublish your card so it stops serving to the public
• Leave the directory by removing your declared professions
• Set your availability to unavailable, which removes you from directory results
• Delete individual posts, comments, opportunities, components, and uploads
• Cancel your subscription through the Stripe billing portal
• Delete your entire account, yourself, without contacting us

Deleting your account

Account deletion is self-service and takes effect immediately. Go to Profile settings → Danger Zone → Delete account, then confirm by typing your display name.

Deleting your account permanently removes:

• Your card — its layout, theme, tabs, and every component on it
• Every post, comment, and like you have written
• Every opportunity listing you have published
• Your connections and your listing in the networking directory
• Your saved themes and your declared professions
• Every image and file you have uploaded, removed from storage

Two things survive, deliberately:

• Billing records. Any active subscription is cancelled as part of the deletion, but invoices and payment records are retained by Stripe — and by us — for as long as tax, accounting, and dispute-resolution obligations require. See § 8.
• Anything that already left our servers. See the note directly below.

Data export is still handled manually. Email sean@conjor.io from your account's email address and we will send you an export within 30 days. Export before you delete. Deletion is immediate and irreversible — once it completes we have nothing left to send you, and no way to restore the account.

Depending on where you live, you may have additional statutory rights — to access, correct, delete, port, or object to the processing of your personal information, and to be free from discrimination for exercising them. We honor these requests regardless of whether a specific law obligates us to. Use the same address.

What deletion cannot reach: copies other people made, search engine caches, web archives, screenshots, and anything else that left our servers while your content was public. We can delete our copy. We cannot delete theirs.

10. Children

conjor is not directed to children. You must be at least 13 years old to create an account, and if you are under 18 you may use conjor only with the involvement of a parent or guardian. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact sean@conjor.io and we will delete it.

11. Security

All traffic is served over HTTPS/TLS. Credentials are managed by Supabase Auth and are never stored by us in plaintext. Our database is not directly reachable from the browser — all access runs through server-side code that verifies ownership before reading or writing. Secrets are held server-side only.

That said: no method of transmission or storage is completely secure, and conjor is built and maintained by one person. We cannot and do not guarantee that our security measures will be sufficient in every circumstance, and the service is provided as is in this respect as in every other. See §§ 10–11 of the Terms of Use.

12. Changes to this policy

We may update this policy. When we do, we will change the date at the top of this page, and for material changes we will give notice in the app or by email. Continuing to use conjor after a change means you accept the updated policy.

Contact

Privacy questions, deletion requests, and data exports: sean@conjor.io

See also our Terms of Use.