Privacy Policy

Version 1.0 · Last updated: 15 October 2026

Notice: This policy is pending formal legal review. It describes our actual data practices and the protections we have implemented.

1. Who we are

NinoForge ("we", "us", "our") operates ninoforge.com, including the professional profiles platform and job marketplace. NinoForge is operated by Himanshu Sharma. Contact: hello@ninoforge.com.

2. What we collect

Account information

• Email address (required for registration)
• Password (stored as a one-way hash — we cannot read your password)
• Name (as provided by you)
• Country of registration
• Account role (candidate or employer)

Professional profile

• Professional headline, summary, location
• Work experience, education, skills, certifications
• Portfolio projects and professional links
• Profile image URL
• Username (for your public profile URL)

All profile fields are voluntarily provided. You choose what to include.

Employer information

• Company name, description, website
• Business verification information (reviewed by administrators)
• Job listings and their content

Applications and communications

• Job applications (cover messages, application status)
• Contact inquiries (sender name, verified email, subject, message)
• Replies to contact inquiries

Technical data

• IP address (for rate limiting and security — not linked to your profile)
• Session tokens (encrypted, HttpOnly cookies)
• Analytics data (PII is scrubbed before collection)
• Cloudflare Turnstile verification tokens

3. How we use your data

• Provide and operate the platform
• Authenticate your identity and protect your account
• Display your professional profile (according to your visibility settings)
• Deliver job applications to employers
• Deliver contact inquiries to professionals
• Send transactional notifications (application updates, verification emails)
• Enforce security controls, rate limits and abuse prevention
• Comply with country-specific marketplace regulations
• Improve the platform based on aggregated, anonymised usage data

We do not sell your personal data. We do not use your data for advertising.

4. Profile visibility

Email and phone are never publicly displayed unless you explicitly enable them in your settings. Contact inquiries are delivered through the platform without revealing your email address.

5. Data sharing

We share your data only with:

• Employers — when you apply for a job, the employer sees your application and profile. Contact details (email, phone) are only shared after the employer shortlists you.
• Contact inquiry senders — when you reply to an inquiry, your reply is delivered via NinoForge email. Your personal email address is not shared.
• Service providers — Cloudflare (hosting, security), Neon (database), Resend (email delivery). These providers process data on our behalf under appropriate agreements.

6. International data processing

NinoForge operates across European countries and India. Your data may be processed in:

• European Union / EEA (Cloudflare, Neon infrastructure)
• United States (Cloudflare Workers, Resend email delivery)

We rely on Cloudflare's and our providers' data processing agreements and appropriate safeguards for international transfers.

7. Data retention

• Active accounts: Data retained while your account is active
• Deleted accounts: Profile data removed immediately upon deletion request. Core account record retained for 30 days for recovery, then permanently deleted.
• Rate-limit records: Automatically expire after 24 hours
• Verification tokens: Expire after 30 minutes
• Job listings: Retained until employer removes them or they expire
• Applications: Retained while both candidate and employer accounts are active

8. Your rights

• Access: Export your data via Account Settings (JSON format)
• Correction: Edit your profile and account information at any time
• Deletion: Request complete account deletion via Account Settings
• Restriction: Set your profile to Private to restrict processing
• Portability: Export your profile, experience, education, skills and applications
• Objection: Contact us to object to specific processing

To exercise these rights, use the in-platform tools or email hello@ninoforge.com.

9. Cookies and tracking

• Essential cookies: Session authentication (HttpOnly, Secure, SameSite)
• Analytics: Google Analytics with PII scrubbing (41+ blocked fields)
• Session recording: Microsoft Clarity with data masking on sensitive fields
• Bot protection: Cloudflare Turnstile (no persistent tracking cookies)

We do not use advertising cookies or cross-site tracking.

10. Security

• Passwords stored using PBKDF2 with 100,000 iterations (one-way hash)
• Session tokens hashed with SHA-256 before storage
• HttpOnly, Secure, SameSite cookies
• Rate limiting on authentication and contact forms
• Cloudflare Turnstile for bot prevention
• Encrypted connections (HTTPS/TLS)
• PII scrubbing in analytics

11. Children

NinoForge is not intended for children under 16. We do not knowingly collect data from children under 16.

12. Changes

We may update this policy. Material changes will be communicated via email or platform notification. The version number and date at the top of this page indicate the current version.

13. Contact

For privacy inquiries or data requests: hello@ninoforge.com