Privacy Policy

Definitions

For the purposes of this Privacy Policy:

• "We", "our" or "us" refers to 0x234 Pty Ltd, an Australian proprietary limited company.
• "You" or "your" refers to the person or entity accessing or using the service.
• "Service" or "platform" refers to Xprt Dev, our website at xprt.dev, and the content, application and infrastructure that power it.
• "Xprt Jobs" refers to our job search and hiring service at xprt.jobs, which shares its account system with Xprt Dev.
• "Account" refers to a unique account created for you to access the service or parts of the service.
• "Career profile" refers to the optional professional profile you can build, publish and share through the service.
• "My Market" refers to the one market, an ICT specialisation and an Australian location, that an account can save to return to.
• "Device" refers to any electronic device that can access the service, including a computer, a mobile phone or a tablet.
• "Personal data" refers to any information that relates to an identified or identifiable individual.
• "Login service" refers to GitHub, GitLab, Google or LinkedIn, which you can use to log in or to create an account.
• "Usage data" refers to data collected automatically, either generated by the use of the service or from the service infrastructure itself (for example, the duration of a page visit).
• "User" refers to any person or entity accessing the service, with or without an account.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

When creating an account, we ask for or receive personal information that identifies you so we can manage the account and the features you choose to use. The account information we may receive is:

• Email address
• A display name, commonly a first name, a last name, or both, when a login service supplies it or you add it to a Career profile

When you log in by email, we send a one-time code to your email address to confirm that it is yours.

Saving a market in My Market is optional. If you use it, we store your selected Australian location and ICT classification preference, being Australia or one state or territory and one ICT specialisation, so the service can return you to that market view.

In addition, based on your usage, we automatically collect your:

• Browser type
• Device IP address
• Visited pages of the service

Profile Data

Email registration on Xprt Dev creates an account without creating a Career profile. Setting the account up on Xprt Jobs asks for your name and location and stores them on the shared profile. If you register with a login service, the service creates a basic Career profile using the display name that service supplies. Completing, publishing and sharing a Career profile on Xprt Dev are optional, and it stays private until you choose another access mode.

A profile may include a display name, a headline, an introduction, a website address, and the usernames of other public profiles you choose to list. It may also include your work and education history, certifications, projects and code repositories, which can name a current or past employer. You choose how specific the location is:

• Country
• State and country
• City, state and country

When you choose that location, your browser may ask for your device's location so we can suggest nearby places. We send the coordinates only with that search, and never save them to your account or profile. We store the place you select.

Where a login service supplies a profile photo, the service may import it, and you can upload a photo of your own. Profile photos, and images you add to a project, are stored in our public file storage in Australia, because they are shown wherever your profile appears. Share only what you have the right to share, particularly anything covered by a confidentiality obligation.

If you link a GitHub or GitLab account and turn on public contributions, we read the contribution counts that service already shows publicly for your username, such as how many contributions you made each day. We do not request the contents of private repositories. We cache those counts for six hours, and we use our own access to the service to read them, not ongoing access to your account.

You choose who can see a Career profile. It can be public or available only through a protected profile link. Public mode requires a linked GitHub or GitLab account. A profile link can have its own password and expiry, and you can delete it at any time. You can update the profile, its access setting and its links from your account.

Profile Link Visits

When someone opens a profile link, we record the visit: the date and time, the page, the visitor's IP address and browser details, a pseudonymous visitor identifier held in the session, and their account if they are logged in. Profile owners see how many visits and visitors their links receive, never who the visitors are. We also use these records to protect the service from abuse.

After 90 days, we remove the visitor's IP address and browser details from the visit, and keep only what we need to count visits.

Information About Other People

Some features ask for another person's details. When you send an invitation by email, we store the recipient's email address with the invitation, and count visits to the invitation and the accounts created through it. When you email a profile link, we use the recipient's name and email address, together with your subject and message, to send it. Only send invitations and profile links to people who would expect to hear from you.

Usage Data

Usage data is collected automatically when you use the service. It includes your device's IP address, browser type and version, the pages you visit, the time and date of the visit, the time spent on those pages, and other diagnostic data. Your browser sends the same kind of information when you use a mobile device.

We use Umami, a privacy-first analytics system hosted on our own infrastructure, to understand how the service is used and to improve it. Analytics are collected in an anonymised and aggregated form where possible, and are not used to identify you or to advertise to you. The product events we send are limited to coarse facts such as which market page was opened. They do not include your name, email address or profile.

IP addresses may be recorded in server logs for security and operational purposes. They are not stored as part of the analytics dataset.

Information from Login Services

You can create an account and log in through these login services:

• GitHub: github.com
• GitLab: gitlab.com
• Google: accounts.google.com
• LinkedIn: linkedin.com

When you register or log in through one of these services, it shares details from your account there with us. What it shares depends on the service, and can include your name, email address, username, profile photo and other public profile details, such as a bio or location. We keep your email address, and your username and account identifier on that service. When you register, we also keep your name and profile photo for your Career profile. We use anything else it shares only to log you in, and do not store it. For GitHub and GitLab, we also use the username to show public contribution counts when you have turned that on. We do not keep access to these services after you have logged in.

Cookie Data

A cookie is a small piece of data stored on your device, either by us or by a service we rely on. A session cookie lasts for the current visit and is usually removed when you close the browser. A persistent cookie stays until it expires or you delete it.

Xprt Dev uses two first-party cookies. The login cookie keeps you logged in. The visitor cookie holds a pseudonymous visitor identifier so we can count unique visits. That identifier is not used to identify you. If you block or delete these cookies, you will be logged out, and parts of the service may not work.

We do not use third-party cookies for analytics or advertising. Google reCAPTCHA, described below, sets its own cookie.

For further information on cookies used, please refer to the table below:

If the device is not your own, including a public or work device, use it only with the owner's permission. By continuing to use the service, you confirm that you are allowed to accept cookies on that device.

Local Storage Data

Like cookies, the service uses your browser's local storage so a few preferences can stay on your device between visits. This data includes:

• Settings for your personalised experience, such as your theme.
• An invitation code, if you arrive through an invitation link, so the invitation can be credited when you create an account.
• Whether you have dismissed a notice, such as the one announcing an update to this policy.

If the device is not your own, including a public or work device, log out before you leave, and clear the browser data for the service.

Use of Your Personal Data

We may use your personal data for the following purposes:

• Account management: We use your personal data to run your account, My Market and your Career profile.
• Communication: We email you about your account and the features you use. That includes a welcome message, one-time login codes, security notices, and the invitations and profile links you ask us to send.
• Marketing: We do not send marketing email. If that ever changes, we will ask you first.
• Customer support: When you report a bug, request a feature or report a profile, we use your personal data to handle that request.
• Analytics and improvements: We may analyse usage data to understand how the service is used and to improve it. We do not use it to advertise to you.
• Safety and abuse prevention: We use usage and visit records, and Google reCAPTCHA, to detect and prevent spam, scraping and other abuse of the service.

Xprt Dev and Xprt Jobs

Xprt Dev and Xprt Jobs are both operated by us and share one account system. If you log in to Xprt Jobs with the same email address or login service, you use the same account and the same Career profile. Basic details from that profile, such as your name, location and introduction, may prefill an application on Xprt Jobs, and only for a role that accepts applications there. They are sent to an employer only when you submit that application. The employer receives that application, not your Career profile. Xprt Jobs may use the location on your profile to prefer jobs near that place. A phone number or resume saved while using Xprt Jobs stays on the same account. Xprt Dev does not show or publish either of them. An application you make on an employer's or recruiter's own site is separate, and Xprt Dev does not receive it. The Xprt Jobs Privacy Policy explains what Xprt Jobs collects for job search, applications and payments.

Links on the market pages that open Xprt Jobs carry only the market being viewed, never your account or profile.

Market Information

The market pages publish figures calculated from job listings on Xprt Jobs that advertise pay. The figures include counts of active roles, advertised salaries, work arrangements, employment types, the organisations advertising them, and, on the overview, movement over 30 days. They contain no information about Xprt Dev users. Your saved market, Career profile and activity are never published, sold or used as market data.

Non-Sale of Your Personal Data

We do not sell, rent or lease your personal data to anyone, for marketing or for any other purpose. We use it to run the service and to improve it.

Ownership of Your Personal Data

Your personal data belongs to you. We do not harvest what you add to your profile or sell it, and we show it only as your settings allow. When a login service creates a basic Career profile, you decide whether to complete, publish or share it, and what to add. Email registration on Xprt Dev does not create a Career profile. The controls below are how you decide who can see one.

You can limit who sees a profile. Make it public or keep it available only through a profile link. A link can be password-protected and can expire, and the profile address can be a public alias you choose. Public mode requires a linked GitHub or GitLab account.

A change or deletion on the service, including removal of a public profile, may not show in search results straight away. A search engine can keep its own copy, and we cannot make it delete that copy. If outdated information remains, ask the search engine to remove it.

Security of Your Personal Data

We take reasonable steps to protect your personal data from misuse, loss, and unauthorised access, change or disclosure. No way of sending or storing data over the internet is completely secure, so we cannot guarantee that it is. Data sent between your browser and the service is encrypted in transit.

If a data breach is likely to cause you serious harm, we will tell you, and the Office of the Australian Information Commissioner, where the law requires us to.

The service does not hold a password for you. Use a strong, unique password for your email account and for each login service, and turn on two-factor authentication where those services offer it.

Be conscious of the information you share online, particularly on public platforms, and maintain the confidentiality of your account details. Should you have any concerns regarding the security of your data, please do not hesitate to contact us immediately.

Capturing and Printing Your Personal Data

People who can see a page can photograph, screenshot or print it. Once they have that copy, we cannot control what they do with it, and our responsibility for that copy is limited. Think about that before you show a Career profile, or a profile link, to someone else.

Retention of Your Personal Data

Your personal data will be retained only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Your usage data will also be retained for internal analysis purposes. Usage data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of the service, or we are legally obligated to retain this data for longer time periods.

Visit records lose what identifies the visitor on a fixed schedule, described under Profile Link Visits.

Deletion of Your Personal Data

You have the right to delete or request that we assist in deleting the personal data that we have collected about you.

You may update, amend or delete your information at any time by logging in and using the account or profile pages that let you manage it. There is no control on Xprt Dev or Xprt Jobs that closes the whole account. Email [email protected] or [email protected], from the address registered to the account, to ask for access to, correction of, or deletion of personal information you cannot change yourself, including closure of the account. A request to either address closes the account on both sites. We may ask for further identification before we close it, so that we do not act on a request from someone else. Closure deletes the account and the data held for it, including your Career profile and My Market. A job application is the exception. Its record, and the resume and cover letter attached to it, stay for the period in the Xprt Jobs Privacy Policy. Closing the account does not shorten that period, and it does not recall a copy an advertiser has already downloaded.

Please note, however, that we may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

We may disclose your personal data where that is necessary to:

• Comply with a legal obligation through court or Government agency.
• Protect and defend our rights or property.
• Prevent or investigate possible wrongdoing in connection with the service.
• Protect the personal safety of users of the service or the public.
• Protect against legal liability.

Data Storage and International Transfers

Your personal data is primarily stored and processed on servers located in Singapore. We securely transfer encrypted backups for storage in Australia for disaster recovery purposes. Files shown publicly on the service, such as brand logos and Career profile photos, are stored in Australia and may be cached and served from globally distributed edge locations to improve performance.

Depending on your location and how you use the service, your data may be transferred across borders. Google and Sentry process data in the United States, and Atlassian may process a support request outside Australia. We take measures to ensure that your data is treated securely and in accordance with this Privacy Policy, and where required by law we implement appropriate safeguards for international transfers.

Third-Party Services

We utilise third-party services to enhance the functionality and improve the quality of our service. These third-party services may store data in jurisdictions other than your home country, which is outside of our control.

Google reCAPTCHA

To protect the service from spam and abuse, we use Google reCAPTCHA. This service helps to differentiate between human users and automated bots by analysing their interactions with the service. Google reCAPTCHA may use cookies and collect certain information as part of its analysis, which is processed by Google. For more detailed information on how Google handles your data, please refer to Google's Privacy Policy and Terms of Service.

• Website: google.com/recaptcha/about
• Privacy Policy: policies.google.com/privacy
• Terms of Service: policies.google.com/terms

Jira Cloud

When you report a bug, request a feature or report a profile, we send your display name and email address, together with what you write and any screenshots you attach, to Jira Cloud. Jira Cloud stores that request so we can track and reply to it. Xprt Dev does not have a separate public contact form. For how Atlassian handles that data, read Atlassian's Privacy Policy and Terms of Service:

• Website: atlassian.com
• Privacy Policy: atlassian.com/legal/privacy-policy
• Terms of Service: atlassian.com/legal/cloud-terms-of-service

Sentry

We use Sentry to capture errors and to understand performance. When an error occurs, Sentry may collect your IP address, browser type, and the state of the application at that moment. On a sample of ordinary visits, and whenever an error occurs, Sentry may also record a replay of the session. Text in a replay is masked and media is blocked. Sentry processes this data in the United States, and we use it only to find and fix faults. For how Sentry handles it, read Sentry's Privacy Policy and Terms of Service:

• Website: sentry.io
• Privacy Policy: sentry.io/privacy
• Terms of Service: sentry.io/terms

Email Delivery

We send email through a third-party email delivery provider. It processes the recipient's email address and the content of each message in order to deliver it. The messages are a welcome message, one-time login codes, security notices, and the invitations and profile links you ask us to send. We do not send marketing email.

Minimum Age

The service is intended for people aged 16 or over, as the Terms of Service require. We do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us and we will delete it.

Links to Other Websites

Market pages link to Xprt Jobs, which we operate. Its own terms and privacy policy apply once you are there, as described above.

A Career profile may also link to websites we do not operate, such as a personal site or another public profile. If you follow one of those links, that site's own terms and privacy policy apply. We do not control those sites, and we are not responsible for their content or for what you do there. We will make a reasonable effort to remove or block a harmful link a member has added, once we know about it. We cannot promise we will find every such link first.

Read the privacy policy and terms of any other site before you share personal information there.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or as necessary to address new features or services. We encourage you to review this policy periodically to stay informed about how we collect, use and protect your information.

We will notify you of any material changes to this Privacy Policy by posting a prominent notice on the service, or by other means as required by applicable law. Your continued use of the service after the effective date is your acceptance of the updated policy.

Contact Us

If you have a question about this policy or your personal data, email [email protected].

To complain about how we have handled your personal data, or to ask for access to it or a correction, email us with the details. We will look into it and give you a written response within 30 days. For an urgent privacy matter, put "Urgent: Privacy Concern" in the subject line.

If you are not satisfied with our response, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.