Legal
Privacy policy
What we collect, why we collect it, who helps us process it, and the choices you have.
Summary
- We collect what we need to run the program: your account, your profile and the work you do on the platform.
- We don’t sell your personal data, and we don’t show advertising.
- We don’t use AI services. A resume you upload is read in your browser to fill in your profile.
- Optional analytics only run if you allow them. You can change your mind at any time.
- You can ask to see, correct, export or delete your data.
Who we are
Branchout (thebranchout.app) is a sole proprietorship run from British Columbia, Canada (“Branchout”, “we”, “us”). We are responsible for the personal information described in this policy, and the person who runs Branchout is accountable for how it is handled. For privacy questions, use the contact form.
What we collect
Information you give us
- Account details: your email address and password (stored in hashed form by our authentication provider), or the name, email and profile picture from Google or GitHub if you sign in with them.
- Profile and resume: details you add to your profile, such as your name, skills, goals and working preferences, and any resume or other files you upload.
- Program activity: your track, level and timezone, progress, pod membership, messages to your pod, the work your pod hands in (links, files and notes), the scores and feedback a mentor gives it, your certificate and its verification code, applications you make, and support tickets.
- Messages to us: what you send through the contact form — your name, email address, topic and message.
- Email preferences: whether you’ve agreed to receive news from us, and when you agreed or changed your mind.
- Recruiters: your company, job title and the roles you post.
Information collected automatically
- Technical request data: your IP address, browser type and the pages you request, which our hosting provider processes to serve the site, and which we use to rate-limit forms and other requests.
- Certificate lookups: when anyone enters a verification code on the verify page, we record the code they entered, the time and their IP address.
- Error reports: technical details when something breaks, with personal data collection turned off.
- Performance measurements: timings from a sample of page loads — only if you allow analytics.
How we use it, and our legal basis
| Purpose | Legal basis (where the law asks for one) |
|---|---|
| Running your account and the program: pods, projects, applications, certificates | Performing our agreement with you |
| Letting recruiters review applications you choose to send | Performing our agreement with you |
| Showing your verified work to someone who has your verification code, and logging lookups to stop guessing | Your consent: you choose whether to share your code and your pod’s repository link. The log is our legitimate interest in preventing abuse |
| Replying to messages and support requests | Our legitimate interest in answering you |
| Keeping the service secure: rate limiting, abuse prevention, error reports | Our legitimate interest in a safe, working service |
| Measuring page performance | Your consent, which you can withdraw at any time |
| Sending news about new tracks, briefs and events, only if you opt in | Your consent, which you can withdraw at any time from your dashboard or any email we send |
We do not use your data for advertising, and we do not sell it.
AI features
Branchout doesn’t use AI services at the moment, so none of your data is sent to one. A resume you upload is read in your browser to fill in your profile, and the file is kept with your account so you can open it again. If we turn AI features on, we’ll update this policy first and say exactly what each one sends.
Your certificate and the verification page
When a mentor passes your pod’s project, you get a verification code. Anyone who has the code can enter it on the verify page, without signing in, and sees:
- your name and the tracks you have completed;
- for each pod you finished: its project, its dates, the mentor’s scores, and a short summary the mentor wrote for employers; and
- your pod’s repository link, only if you chose to show it. You choose in your pod, and each teammate chooses for themselves.
They never see your email address, phone number, photo or location, the mentor’s private feedback, or your teammates. Without the code, the page shows nothing about you. You can switch your public page off from your dashboard at any time: your code stays the same, and a lookup finds nothing until you turn it back on.
Each lookup is recorded: the code that was entered, the time and the IP address it came from. We keep these for 12 months, to limit guessing and to show you how often your code was checked, and each address can look up 10 codes a minute.
Who we share it with
We use the service providers below to run Branchout. They process data on our behalf and only for the purposes described.
| Provider | What for | Data involved |
|---|---|---|
| Supabase (privacy policy, opens in a new tab) | Accounts and sign-in, the database behind the platform, and file storage for resumes. | Account and profile details, program activity, messages, and files you upload. |
| Hostinger | Hosting the website and running its server code. | Technical request data such as IP address, browser type and the pages requested. |
| Resend (privacy policy, opens in a new tab) | Sending account and service emails. | Your email address and the content of the email. |
| Sentry (privacy policy, opens in a new tab) | Error reports so we can fix problems; if you allow analytics, performance measurements from a sample of page loads. | Technical details of errors and page performance. Collection of personal data is turned off. |
| PostHog (privacy policy, opens in a new tab) | Product analytics, only if you allow analytics: which pages are visited and how people use the site. | Pages visited, clicks outside the dashboard, browser and device type, approximate location from your IP address and, if you are signed in, your account id (never your name or email). |
| Upstash | Rate limiting, to stop abuse of forms and other requests. | IP address and a count of recent requests. |
| Google sign-in (privacy policy, opens in a new tab) | Signing in with your Google account, only if you choose to. | Your name, email address and profile picture from that account. |
| GitHub sign-in (privacy policy, opens in a new tab) | Signing in with your GitHub account, only if you choose to. | Your name, email address and profile picture from that account. |
We also share information in these cases:
- Your pod: other students in your pod see your name and the messages and work you share there.
- Recruiters: when you apply to a role, the recruiter who posted it sees your application and the profile details it includes. You are never obliged to apply.
- Anyone you give your verification code to: they see the record described under “Your certificate and the verification page”.
- When the law requires it: to comply with a legal obligation, or to protect the safety and rights of people using Branchout.
- If the organisation changes: if Branchout is merged or transferred, your data would move with it under the same protections, and we would tell you.
International transfers
Our providers may process data in countries other than yours, including the United States. Where the law requires safeguards for these transfers, we rely on our providers’ contractual commitments to protect personal information to the standard Canadian privacy law requires.
How long we keep it
- Account, profile and program data: while your account is open, and for 12 months after you close it, unless you ask us to delete it sooner.
- Messages to us: for 12 months after we have dealt with them.
- Certificate lookup records: 12 months, then they are deleted.
- Your cookie choices: 180 days, then we ask again.
Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw consent you have given. We honour these requests wherever the law gives you the right, and we won’t treat you differently for making one.
To make a request, use the contact form with the topic “Privacy or data request”. Account and resume deletion is currently handled on request rather than in the dashboard. We may need to confirm your identity first.
You can also complain to your data protection authority — for us, that is the Office of the Information and Privacy Commissioner for British Columbia, or the Office of the Privacy Commissioner of Canada — though we would like the chance to put things right first.
Children
Branchout is designed for students and new developers, not young children. If you’re a parent or guardian and believe a child has given us personal information without your permission, contact us and we will delete it.
Security
We protect data with encryption in transit (HTTPS), database access rules (row-level security) that control which records each account can read and change, rate limiting, and restricted admin access. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
Cookies and similar technologies
We use a small number of necessary cookies and browser storage, and optional analytics only with your consent. See the cookie policy, or change your choices on the cookie preferences page.
Changes to this policy
We will update this page when our practices change, and change the effective date at the top. If a change is significant, we will tell account holders by email or in the dashboard before it takes effect.
Contact
Branchout, British Columbia, Canada. Use the contact form.