Privacy

What we collect

• Your account. A display name, which side of the marketplace you are on, and an email address if you have one on file. If you sign in with a password we store only a salted hash of it, never the password. If you sign in with Google or Facebook we store the identifier that provider uses for your account, and the name and email address the provider shares.
• What you post. Job requests (title, description, budget, timeline, photos, and a ZIP-code area — never a street address), messages you send to contractors or homeowners, and searches you choose to save.
• How search is used. We log which results a search showed and what was clicked, to improve ranking. These logs are about queries, not identities.
• Security signals. Sign-in attempts and rate limits are keyed to a one-way hash of your IP address; we do not store the address itself for these. Session cookies keep you signed in; an optional remembered-device cookie skips the emailed code on browsers you have verified.

Contractor listings are public records

Contractor profiles are built from the California CSLB public licence register — business name, licence number, status, classifications, and the business address the register publishes. This is public data we republish, not data contractors gave us. Ratings and review excerpts shown on a profile come from Google and are labelled as such. A contractor who claims their listing can add a bio, photo and contact details; the register data itself can only be corrected through the CSLB.

What we never do

• No selling or sharing of your data for advertising. There are no ads.
• No lead fees — contractors do not pay for your contact details, so your details are not the product.
• A homeowner's precise location is never published. Jobs are shown at ZIP-area level, and a protected contractor address is only ever shown at the accuracy the contractor chose.
• Signing in with Google or Facebook never grants access to an existing account that merely shares the email address — accounts are matched by provider identity, which is what prevents account takeover through a look-alike login.

Who processes data for us

Hosting on Google Cloud. Sign-in popups for Google and Facebook run through Firebase Authentication. Email (sign-in codes, job alerts) is delivered by Resend; every alert carries a working unsubscribe link. Maps are drawn with OpenStreetMap tiles, which means your browser requests map images from OpenStreetMap's servers.

Your choices

You can use the product without an email address on file. You can unsubscribe from job alerts in one click. You can ask us to delete your account and its data — here is exactly how, and exactly what gets deleted.

Questions: support@contractorsmarketplace.co.