JobDrop › Privacy Policy

Privacy Policy

Last updated 18 October 2026

JobDrop is a local marketplace where people post jobs, local businesses and taskers list services and openings, and the two connect directly. This policy explains what personal information we collect, why, and the choices you have. We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. What we collect

Account details: your email address, and your name and profile photo if you sign in with Google.
Jobs, offers and bookings: what you post (job title, description, photos, suburb or approximate location, budget, timing), offers and questions you send, and the name and contact details (email or phone) you give when you book or post.
Business profiles: business name, ABN, logo and photos, services, prices, opening hours, address or shopping centre, website, phone, email, staff members you invite, and the availability, offers and walk-in times you publish.
Family care carers: if you list yourself as a babysitter, nanny or au pair, the roles and children's age groups you work with, whether you hold first aid or can drive children, and your blue card number and expiry date.
Shift applications: when you apply for a shift, your name, phone or email, availability and message, and a link to your JobDrop profile if you have one. Businesses that post shifts give us the ad details and see the applications for their own ads.
Claims: information you provide to show you own or manage a business listing.
Reports and messages to us: what you tell us when you report a listing or contact us.
Technical and security information: IP address, browser and device type, sign-in times, and a device label used to warn you about new sign-ins. Our hosting and database providers keep short-term server logs.

We do not ask for or store payment card details. Payments are arranged directly between customers and providers.

2. How we collect it

Mostly directly from you when you use JobDrop. Some business listing information comes from public sources (see section 7). If a business invites you as staff, they give us your email address so we can send the invitation.

3. How we use it

To run JobDrop: show jobs, offers, listings and openings; connect customers with providers; manage bookings and claims.
To sign you in and keep your account secure, including sign-in codes and new-device alerts.
To send service emails you would expect, such as booking confirmations, offer and booking notifications, and staff invitations.
To prevent scams, spam and misuse, and to act on reports.
To understand how JobDrop is used and improve it.
To meet legal obligations.

We do not sell your personal information or use your account, job or message details for third-party advertising. Travel accommodation offers and affiliate attribution are described below.

4. What is shown publicly

Jobs, offers, business profiles and openings are public so that people can find them. Business profiles show the details the business chooses to publish (for example name, phone, website, address, hours and prices). For jobs we show a suburb or approximate area, not your exact address. Contact details you enter when booking are shared only with the business you are booking with, and a business's booking details are shared with the customer who booked. Please don't put private information in public text such as job descriptions. When you apply for a shift, only that business sees your contact details and message. For family care carers we publicly show your roles, age groups, first aid and driving details, your blue card expiry date and only the last 4 characters of your card number. We never show your full blue card number publicly. In family care jobs, please don't include children's names, photos, school or address.

A small number of JobDrop administrators can see listings, reports and claims, including contact details, when they need to check a report, verify a business claim or remove content that breaks our Terms. Every administrator action is recorded.

We use trusted service providers to run JobDrop. They handle data only to provide their service to us:

Supabase: database, sign-in, file storage and private change notifications.
Cloudflare: website hosting, security and email forwarding.
Resend: sending emails such as sign-in codes and notifications.
Google: only if you choose "Continue with Google", and for web fonts.
Photon / OpenStreetMap: when you search for a place, the text you type is sent to look up the location. Map tiles are loaded from OpenStreetMap.
Australian Business Register (ABN Lookup): to look up publicly listed business details from an ABN.
Stripe: only if you buy a boost. Stripe processes the payment on its own page. We receive the amount, the payment reference and the email address you give Stripe, so we can switch the boost on and help with any problem. We never see or store your card details.

We may also disclose information if the law requires it, to protect someone's safety, or to investigate fraud or misuse.

Phone notifications. If you turn on notifications, your browser gives us a notification address and encryption keys for that device. We store them with your email address so we can send your alerts, bookings and replies to that device, using the push service run by your browser or phone maker (for example Google or Apple). The message text passes through that service. Turn notifications off at any time in your account or your device settings, and we delete the address.

Partner offers. When you click a partner offer or hotel search link (for example a Viator tour, a hotel booking site, a car hire, transfer or eSIM site, a business insurance comparison or an energy comparison site), we count the click for that offer, without recording who you are, and you go to the partner's website. What you do there, including any booking, is covered by the partner's own privacy policy.

Stay22 travel offers. On our public travel guides, we use Stay22 to provide accommodation links and offers and attribute bookings. Our travel planner also embeds Stay22 accommodation maps and links. Stay22 processes technical information such as IP address, browser and device details, approximate region and interactions with these travel pages, together with booking information from participating providers. The planner sends your chosen destination, dates and guest count to display relevant stays. Stay22 may add accommodation links or open relevant accommodation results in a new tab after an interaction. JobDrop may earn a commission if you book through these offers. See Stay22's Privacy Policy and Cookie Policy.

6. Overseas storage

Some of our providers store or process data outside Australia, including in the United States and other countries where they operate. We choose reputable providers with strong security practices.

7. Business listings from public sources

To help people find local businesses, JobDrop shows basic listings compiled from public sources: Foursquare Open Source Places (Apache 2.0) and the public ABN Lookup service. These listings contain business information such as name, category, address, and public phone or website. They are marked as unclaimed until the owner claims them. We do not send marketing emails to these businesses.

If you own a listed business you can claim it to manage it, or ask us to correct or remove it by emailing [email protected]. We act on removal requests promptly.

8. Emails we send

Most emails we send are service messages linked to something you did, such as a sign-in code, a booking, an offer or a staff invitation. If we ever send marketing or newsletters, we will only do so with your consent, and every message will have a working unsubscribe link, as the Spam Act 2003 requires.

9. Cookies and device storage

We use your browser's local storage to keep you signed in, remember your preferences (such as light or dark theme), keep drafts, and remember things like which items you have already reported. If you clear your browser data, these are removed. Our hosting provider may set a strictly necessary security cookie. Stay22 and participating booking providers may use cookies and similar technologies for travel offers and booking attribution; their policies and preference controls apply to those technologies.

10. Security and retention

Data is encrypted in transit, and access to our database is restricted with row-level security. Sign-in uses one-time codes or links, so we never store a password for you. No system is perfectly secure, so please keep your email account secure and tell us straight away if you think your JobDrop account has been misused. You can sign out of all devices from your account page.

We keep information while your account or listing is active and for as long as reasonably needed for the purposes above, including resolving disputes and meeting legal obligations. Old jobs and openings expire from public view automatically.

Adult personal profiles

This optional, separate feature stores your account identifier, display name, general area, bio, interests, chosen photos, profile status and revision, and the date and version of your adult self-declaration and rules acceptance. We do not collect a birth date, identity document or biometric age-check evidence for it. Ordinary profile photos are not used to verify age or identity.

Drafts and pending profiles are accessible only to their owner and authorised moderators. Approved profiles are shown to signed-in members who have accepted the adult-profile rules, inside the Adults area. Your account email is not included in member profiles. Account identifiers are used internally for access control and photo references, and are not displayed as profile fields. These profiles are excluded from ordinary provider search, family tools, notification previews and public profile links. Photos are stored in a private bucket and loaded using authenticated access; no public photo URL is generated by this feature. Members can still copy content they can see.

Moderators can review your profile, photos, review status, reasons and reports. Report and block records are private; a reported or blocked profile is hidden from the reporting member, and blocking also hides profiles in the other direction. Save draft keeps a revision private; submitting it sends it for review. You may delete your profile at any time; it is removed from browsing immediately and its profile data and photo references are deleted. The app also requests deletion of its stored photo files and offers a retry if that fails. Other members' blocking preferences remain linked to your account so they continue to work if you return. Limited technical abuse-prevention records, containing an account reference, action, time window and request count, may also remain; expired counters are cleared during later rate-limited activity. Deleted profile text and photos are not copied into these records. Contact [email protected] for a privacy or deletion issue.

Optional online and last-seen status

Activity sharing is off by default and has its own control under My profile. If you enable it, approved adult members can show an Online now or approximate Last seen label to other signed-in adult members who can view their profile, subject to blocking and reporting controls. Online now means the app recently checked in from a focused, visible Adults page; it can remain briefly after a connection drops, for up to one minute. Last seen uses the most recent shared check-in, rounded to a minute, with ages over one week grouped together.

We store your sharing choice, a random identifier and short expiry for each active browser tab, and only the latest shared activity time. Activity check-ins happen only while you have the Adults area visible, focused and online. Closing one tab ends its own active session; another active tab may keep the profile online. Browser identifiers stay in memory rather than persistent device storage. Expired tab records are ignored immediately and removed during later activity or membership deletion. The latest shared activity time remains until you hide activity, approval is withdrawn, or your adult membership is deleted. This feature does not create a visit history.

Turning sharing off clears stored activity sessions and the latest shared activity time. Your status then becomes unavailable to other members; observations or copies they have already made cannot be withdrawn. A new opt-in starts fresh shared activity. Activity metadata stays inside the adult member area and is excluded from public links, email, push notifications and the ordinary notification bell.

Optional adult private messages

When you enable messaging, we store your messaging preference and the version and time of your rules acceptance. We store conversation participants, request and acceptance status, plain-text messages, message identifiers and timestamps, and private read markers used to count unread messages. If you choose to share read receipts, we also store a separate shared read marker. Your account email is not shown to the other participant, and your contact details are never inserted into messages automatically.

Conversation text is available only to its two joined participants through authenticated access, subject to blocking and reporting controls. A first-message request is visible to its recipient before acceptance. New requests, acceptance and sending require both members to have approved profiles and messaging enabled. Existing history remains available to joined participants when messaging is turned off or a profile is under review; hidden current profile details and photos are not added to the conversation. Inbox lists show no message-body previews. Typing indicators and read receipts are separate optional sharing settings, both off until you enable them in Messaging settings. Sharing applies only to accepted conversations while both members have approved profiles and messaging enabled. Pending requests do not show either signal.

If you enable typing sharing, we store a short expiry for your typing state in the conversation, without draft text or keystrokes. Each update replaces the previous deadline instead of creating an application activity log. The indicator becomes inactive within nine seconds unless renewed, and the app clears it when you stop typing or leave the composer where possible. If you enable read receipts, messages actually viewed in the active conversation can be marked Read for the sender. Enabling it does not immediately reveal previous private unread markers. Supabase retains technical delivery records of empty typing and change signals for three days. Turning sharing off hides the shared status and clears your shared markers; private unread counts continue to work. Copies or observations another member has already made cannot be withdrawn.

Adult messages are separate from ordinary JobDrop chats. We do not send adult message text, names or previews through email, push notifications, the general notification bell or shared links. This feature keeps its browser data in memory and clears it when you sign out, switch accounts or leave the Adults area. Messages remain stored on JobDrop's servers for the participants; they are not end-to-end encrypted.

While you have the Adults area open and visible, an authenticated private connection to Supabase tells the app when to check for changes. Its channel uses your account identifier and carries only an empty change signal with an unrelated delivery identifier, without message text or another member's details. The app retrieves messages through the existing participant access checks. The live connection pauses when the page is hidden or offline and closes when you leave the area, sign out or delete your personal profile. Returning to the area refreshes its state; limited automatic checks recover missed updates or a disconnected live connection. These updates do not create email, push or general-inbox previews.

If a participant reports a received message, we store the selected message and limited surrounding conversation context with the reason and details, for authorised moderation. Reviewers receive that report context rather than a general ability to open unreported conversations. Blocking or reporting a message or profile stops further conversation access and sending for both members. Turning messaging off retains existing history. Deleting your personal profile removes your messaging preference and removes its shared conversations, messages and related message-report context for both participants. Other members' block and declined-request preferences remain linked to the deleted profile's account while those members keep their membership, so recreating a profile cannot bypass their choice. These preferences contain account references and a timestamp, without deleted message text. This cannot erase copies a recipient has already made. Limited technical rate counters described above may remain to prevent misuse.

Adult age checks (not live)

JobDrop does not currently run an adult age-check, collect selfies, videos or identity documents for age verification, or accept adult-provider applications. Before any age-assurance feature is enabled, we will assess the privacy impacts and update this policy to name the provider and methods, explain the purpose and retention, and describe alternatives and a way to challenge a result. Our proposed design is for a specialist provider to process any selfie, video or ID directly and return only the minimum result needed to JobDrop. Do not email or upload identity documents to JobDrop for an age check.

11. Access, correction and deletion

You can edit most of your information yourself in JobDrop. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it or delete your account, by emailing [email protected]. We will respond within 30 days. If we can't do what you ask (for example because the law requires us to keep something), we will explain why.

12. Children

JobDrop is for people aged 18 and over. We do not knowingly collect personal information from children. Parents posting family care jobs should describe children only in general terms (for example ages), and we may remove posts that identify a child. If you think a child has given us their information, contact us and we will delete it.

13. Complaints and contact

For privacy questions or complaints, email [email protected]. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy from time to time. We will post the new version here with a new "last updated" date, and tell signed-in users about any significant changes.

14. Optional business connections

When enabled, owners can authorise Square or ServiceM8. JobDrop stores encrypted account tokens, connection status and a limited summary on its backend. Square provides booking settings and a booking link. ServiceM8 job records are read to calculate aggregate counts; customer records are not imported. Disconnecting removes stored tokens and summaries. ServiceM8 access can also be revoked in provider settings.

ABN checks store the register entity name, status and lookup date. Optional Google Maps searches send search text to Google. Live results are not saved in JobDrop's directory. See the Google Privacy Policy.