Privacy policy

Wander Pixels runs this website and decides what is collected and why. Write to sahiladncode@gmail.com about anything on this page. The terms of service cover the rest.

From anyone who visits

• Visit counts. We use GoatCounter, a privacy-friendly counter. It records the page visited, where you came from, your browser and device type, screen size and rough country. It sets no cookies and builds no profile of you.
• Server logs. Our host keeps technical records of each request (such as IP address, browser and time) to run and secure the site.

From a jobseeker account

• Your email address and password (the password is stored only as a one-way hash).
• Your full name, and a phone number if you add one.
• Your preferences: the roles, areas and experience level you are looking for.

This is private to you and to the site’s staff. Employers and other visitors cannot see it.

From an employer account

• Your email address and password, the business name and the kind of venue.
• If you fill them in: a description, area, address, map link, website, Instagram name, phone number, logo, cover photo, menu designs and uploaded images.

Once we approve an employer, its profile and open jobs are public. Its phone number is shown only to signed-in users.

From the employer waitlist

The business name, the kind of venue, the number of outlets and a phone number.

From staff

An email address, a role, and a log of what each staff member did and when, so changes can be traced.

When you write to us

Your email address and what you send.

• Sign-in. If you sign in, a cookie keeps you signed in. Its name begins sb-.
• Theme. Your light or dark choice is kept in your browser’s local storage.

That is all. There are no advertising cookies and no third-party tracking cookies, so there is no cookie banner to click.

• To run accounts, show jobs and let jobseekers reach employers.
• To review employers before they can post, and to remove bad listings.
• To keep the site secure and working.
• To count visits, so we know what people read.
• To answer you when you write to us.

We do not use it for advertising and we do not sell or rent it.

• Supabase stores accounts, sign-in, the database and uploaded files, on servers in India (Mumbai).
• Vercel hosts the site.
• GoatCounter counts visits.
• Meta (Facebook) is where the connected Page lives. The console talks to Meta’s Graph API to list the Page and publish to it.

Links to WhatsApp, Google Maps, TikTok and similar sites take you to their services, and what you do there is covered by their policies. We share information with the authorities only when the law requires it.

The staff console can connect the site owner’s own Facebook Page, so the owner can publish their own posts to it. This is the only use. Visitors, jobseekers and employers are never asked to log in with Facebook, and we never receive their Facebook data.

What the console receives

When the owner logs in with Facebook and chooses a Page to share, the console receives:

• the owner’s Facebook name and ID, to show who connected the Page and to match a removal request from Facebook;
• for each Page the owner chooses: its name, ID and category, and a Page access token.

The permissions asked for, and nothing more, are:

• pages_show_list to see which Pages the owner can choose from;
• pages_read_engagement to read a Page’s basic details;
• pages_manage_posts to publish to the Page.

What it is used for

To show which Page is connected and to publish posts that the owner writes to that Page. It does not read the owner’s friends, personal posts or messages, or anyone else’s information. It is not used for advertising or profiling, and it is not sold or shared.

How it is protected

• The Page token is encrypted (AES-256-GCM) before it is stored. The key is held only in the server’s environment, never in the database and never sent to a browser.
• The short-lived token used once at login to list the Pages is not kept.
• Only signed-in staff with the right role can connect or disconnect a Page.

How to remove it

• In the console. Disconnecting a Page deletes its stored token straight away.
• On Facebook. Removing the app in your Facebook settings ends its access at once. Facebook then tells us, and we delete what we hold automatically.
• By asking. See how to delete your data.

Account information stays until you ask us to delete it. A connected Facebook Page stays until it is disconnected or Facebook tells us the app was removed. Job listings stay up until they expire or are taken down. The staff log is kept so there is a record of changes. Our host and GoatCounter keep their records for the time their own policies say.

You can ask us to:

• show you what we hold about you;
• correct it;
• delete it, and close your account.

Write to sahiladncode@gmail.com from the email on your account. We will answer as soon as we can, and within 30 days. For information from a connected Facebook account, this page also explains how to have it deleted.

The site uses HTTPS. Passwords are stored as hashes. The database only lets each person read what is theirs, and the staff console sits behind sign-in and roles. No system is perfect: if you think your account has been misused, tell us at once.

Accounts are for people aged 16 and over. We do not knowingly collect information from younger children. If you think we have, write to us and we will delete it.

We may update this page. The date at the top says when it last changed, and we will say so on the site if a change matters.