Skip to main content
Sign in
Legal

Privacy Policy

Last modified September 24, 2026. The rest of the papers live on /legal.

1. Overview

This page describes what JustBAU collects, who else sees visitor or account data from this site, and how to reach us. It is not a compliance stamp. The website and the native iOS and Android apps use the same processors. By using JustBAU, you agree to the practices below, which we may update.

JustBAU is a public profile tool for independent workers. It is not a healthcare provider. A listing for therapy, coaching, or similar work is a public professional page, not a medical record.

JustBAU is operated by Onitsoga Labs, Inc., 82 Nassau St, Suite 62471, New York, NY 10038. Paper mail can go there. Everything else goes through the support form.

2. Legal Basis

  • Contract: accounts, hosting listings, discovery, verification, support replies.
  • Legitimate interest: security, abuse prevention, visit counts, product mail to account holders (news, marketing, required notices, and listing reminders), improving the service, and approximate city-level area for nearby search when you choose “use my area”.
  • Consent: Stay in touch (news and marketing), and any extra permission your device asks for. If we later send promotional texts, we will update this page first.

3. Information We Collect

3.1 Account & identity

  • Sign-in is Google or email (a magic link, a one-time code, or a password), through Supabase Auth, including the native iOS and Android apps. Google sends us your name, email, and profile picture. Email sign-in uses the address you type; if you set a password, our auth provider stores it. We store your email (and Auth id) when sign-in starts. We store a name on your JustBAU profile after you finish Sign up (Terms and a first name). Unfinished sign-up records stay until you finish or delete. A Google picture that rides along with sign-in is not your public Founder photo until you upload one.
  • We set a CSRF cookie on visits. If you sign in, we also set a signed-in cookie.

3.2 Profile content

  • Text, tags, languages you say you speak, Founder bio answers, listing pitch, brand color and typeface, Contact Methods, and media you publish (including photos, a cover, a gallery, and a pitch video). Media is stored on our object store and served from this site.

3.3 Location

Live listings store a US city (name and coordinates) or a list of up to 10 US states, plus how you meet (you travel to the client, they come to you, or remote). City mode and state mode are separate. Going live requires one of those place modes, not both. JustBAU is US-only for now and is not a pin-less worldwide directory.

When you choose “use my area” (or typed a place), we use an approximate city-level point for nearby search. That point comes from city coordinates Cloudflare already attaches to the request — we do not ask the browser or native app for GPS, and we do not send your IP to a separate geolocation vendor. We remember your yes/no choice in the browser, and if you use your area we keep a short jb_geo cookie (coordinates, optional city or state) so nearby results can load on the first visit. Clearing location deletes that cookie.

When the browser looks up a place it may call Open-Meteo (city search) and Nominatim (OpenStreetMap reverse geocode). Maps load tiles from OpenStreetMap. Those requests come from your device. When you save a listing city, we may also look the pin up from our servers (Nominatim) to confirm it is in the United States.

3.4 Technical data

Server logs (IP, browser, referrer, time). Visit counts through Pirsch on public pages (not loaded on dashboard, edit, onboard, or analytics). Product analytics through HeyCatch on pages that load the app shell (including signed-in pages): page views, clicks, sessions, device and IP, and after you sign in your account id plus name and email so the dashboard can show a person instead of an opaque id. Site chrome and listing typefaces are served through Cloudflare Fonts from this site. We request those faces using Google Fonts stylesheet URLs so Cloudflare can cache and serve the files from this domain; your visit does not load a Google Analytics beacon, and we do not send listing copy to Google for fonts.

3.5 Messages you send us

The Support form collects the name, email, and message you type, plus a Turnstile token so we can tell humans from bots.

3.6 Stay in touch

A Stay in touch link on Sign in and Sign up opens a form that collects an email, the topics you check, and a Turnstile token. That is not an account. JustBAU updates is the product news list, and Offers and launches is the marketing list — the same lists we use for account holders. You can leave those in the emails themselves or at justbau.com/subscriptions.

3.7 Mail we send you

We keep a record of every message we send you: the address, the subject, what the message said, and what happened to it. Our email provider tells us whether a message was delivered, bounced, or reported as spam, and it can also report that a message was opened or a link in it was clicked. We keep that against the record so we can answer “did this actually reach you”, stop mailing addresses that are dead, and not send the same thing twice.

3.8 Contact cards

On a live listing, a seeker can save a contact card of the Contact Methods they can see. We run Turnstile on that save. The card is a file the seeker’s device (or contacts app) keeps. We are not sending that card to a separate contacts company.

4. How We Use Information

  • Run listings, search, and sign-in (Google or email).
  • Security, sessions, and bot checks (Cloudflare Turnstile).
  • Email and SMS about your account (verification, security, listing status, policy notices).
  • Reminders when an account is unfinished, a listing never went live, or a live listing has gone stale.
  • Product news and marketing lists, on by default for your login email when you finish Sign up, whether you used Google or email (see section 5).
  • Stay in touch news and marketing, if you submit that form.
  • Understand traffic with Pirsch and HeyCatch.

5. Sharing, publishing, and sale

We currently do not sell personal data for advertising. We may share data with the processors listed here so JustBAU can run. We may change how we use or share data, including paid or commercial uses, later. If we do, we will update the date on this page.

When you finish Sign up we add your login email (the Google address or the email you sign in with) to Emailit so we can deliver account mail, and we put you on the product news list and the marketing list there. That is on by default. Contact Method addresses on a listing are not added to those lists. Stay in touch JustBAU updates and Offers and launches join those same news and marketing lists. You can leave news or marketing at justbau.com/subscriptions, or with the unsubscribe link in those emails (including the one-click kind mail apps handle for you). Leaving one list does not take you off the others. Codes, sign-in, and policy notices are not optional lists — having an account means you can get those. If you delete your account we remove the Emailit contact when the deletion job succeeds.

5.1 What we publish, and to whom

A live listing is a public web page. So is a Founder profile once it has a picture, a written bio, a live listing, and a handle you picked yourself — before that, it stays off the public Founders pages and out of what we hand to search engines.

For pages that are public, we do the things that make a public page findable: we list them in our sitemaps, name them in the llms.txt files that AI crawlers read (your display name, handle, bio, listing pitch, profession, and service area), publish machine-readable details of the page including any website or social accounts you added, and notify indexing services through IndexNow when something is new or changed. Contact Methods are not in that machine-readable data, and you can require sign-in before they are shown.

Search engines, AI companies, and anyone else can fetch those pages. What they keep afterwards is theirs, not ours. Taking a listing offline stops us publishing it and frees the handle; it does not reach into someone else’s index or model.

6. Processors on this site

Named because visitor or account data from this site reaches them. We are not listing every vendor we might use for internal email or ops.

  • Pirsch — path-level visit counts on public pages.
  • HeyCatch — visit and session analytics (pages, clicks, device, IP, and after you sign in your account id, name, and email) so we can see which pages help people find listings. Events go to in.heycatch.ai, and the browser fetches the script itself from the esm.sh package CDN. HeyCatch processes that as our processor. See HeyCatch’s privacy policy.
  • Cloudflare Turnstile — human checks on Support, Stay in touch, when someone reveals Contact Methods, and when they save a contact card. That script loads only then, not on every page. Cloudflare is a controller for Turnstile data; see Cloudflare’s privacy policy.
  • Cloudflare — this site (Workers, KV, media storage). Cloudflare Fonts serves site chrome and listing typefaces from this domain. We do not use Cloudflare Web Analytics or Zaraz on this hostname. Turnstile is listed above. “Use my area” uses city coordinates Cloudflare already attaches to that request; we do not send your IP to a separate geolocation vendor.
  • Google — sign-in (OAuth), including the native apps. Listing typefaces start as Google Fonts stylesheet URLs that Cloudflare Fonts rewrites onto this origin.
  • Supabase — authentication (Google and email) and the Postgres database behind listings.
  • Emailit — account mail, news, marketing, Stay in touch (same news and marketing lists), and the contact record for your account. They hold who is on which list. They deliver the message and report back what happened to it (delivered, bounced, reported as spam, sometimes opened or clicked). Support tickets are emailed onward by us; the form posts to JustBAU first.
  • Twilio Verify — SMS or voice codes when you verify a phone Contact Method. We may also text account-related messages to a number you gave us. If we later send promotional texts, we will update this page first.
  • Open-Meteo and OpenStreetMap (Nominatim plus map tiles) — place search, reverse geocode, and maps from your browser. We may also call Nominatim from our servers to confirm a listing pin is in the United States.

7. Cookies & local storage

We use cookies required to run the site: a CSRF cookie on visits, and a signed-in cookie if you log in (currently about seven days). If you use your area, a short jb_geo cookie stores those coordinates (about 30 days) so Discover can show nearby listings on the first load. Sign-in also stores Supabase keys in localStorage (the native apps use the same storage in the in-app browser). We store a yes/no choice to use your approximate area in localStorage. Pirsch is configured not to set advertising cookies. HeyCatch may set analytics cookies or localStorage keys (often ph_ prefixed) for sessions and identity. We do not show a cookie banner. We may add other cookies later; this page would be updated.

8. Retention & deletion

Use Delete my data while signed in, or Support if you cannot sign in (use the email on the account). We delete your profile text, listings, media, Contact Methods, and sign-in user (Google or email), release your handles, and drop you from the Emailit list. Anonymized logs may remain for about 30 days for security. We do not currently process payments on this site, so we are not keeping card records here.

What survives is deliberately small: a closed-account record holding the email address, and the log of mail we already sent to it. That is what stops a suppressed or banned address quietly coming back as a fresh account, and what lets us answer a question about a message later.

9. Your Rights

Depending on where you live, you may have rights to access, correct, delete, port, or object to certain processing, or to withdraw consent (for example, Stay in touch). Clear your area on Discover or Search to drop the approximate-area cookie. Use Support.

10. Security

We encrypt data in transit and use sessions, CSRF tokens, and Turnstile. No setup is perfect. Report problems through Support.

11. Children

JustBAU is not directed at anyone under 18. You must be at least 18 years of age to create a profile. We do not knowingly collect information from children.

12. Transfers

JustBAU is operated from the United States. Listings are US-only for now. If you use it from elsewhere, your information is still processed in the US.

13. Changes

When this policy changes in a material way, we update the date above. Keep using JustBAU after that and you accept the updated policy.

14. Contact

Privacy questions, access, and deletion requests go through Support. We do not publish a staff email or phone on this site.

Signing in…