Privacy policy

1. Who runs this service

Ziopps is a public-interest directory maintained by a small team. We are the data controller for any personal information this site collects. You can reach us through the About page.

2. What we collect, and why

You can browse the entire directory without any account.

Visitors (not signed in)

• Standard web request data — your IP address, the page you requested, your browser, timestamp. Our hosting provider logs these to serve the request. We use the IP address as a key for per-IP rate limits that stop automated abuse.
• Theme preference — if you switch between light and dark, we save that choice in your browser’s localStorage. It never leaves your device.

Signed-in users

• Your Google account identity — email, name, and Google user ID — supplied to us by Google when you sign in. We do not see your Google password.
• Your Saved and Applied list — which opportunities you bookmarked or marked as applied, plus the timestamp.
• Notifications — update notices we generate when a saved listing changes, until you mark them read or delete your account.

We do not collect anything you did not provide, we do not sell anything, and we run no advertising on this site.

3. Cookies and local storage

We use only strictly-necessary cookies, so no consent banner is required under EU/UK and comparable rules:

• Auth session cookie — set when you sign in, so the site recognises you between pages. Removed when you sign out.

We also store a theme preference (light/dark) in your browser’s localStorage. It is not a cookie, not sent to any server, and only read by this site.

4. Who processes your data on our behalf

• Supabase — our database and auth provider (hosted in Frankfurt, EU). Stores your account, your Saved/Applied data, and your notifications.
• Google — supplies “Sign in with Google” and tells us the identity information listed above. Google’s own privacy policy covers how they handle your sign-in.
• Our hosting provider — serves these pages and keeps short-lived request logs for operational reasons.

We don’t share your data with anyone else, except when we are required to by law.

5. Where data lives

Our primary data store is in Frankfurt, Germany (EU). Google’s OAuth flow runs on Google’s global infrastructure. Your browser connects to our site over TLS; data in transit is encrypted.

6. How long we keep it

• Account data stays until you delete your account.
• Saved / Applied / Notifications are deleted automatically when your account is deleted.
• Rate-limit counters keyed by IP are kept for the length of the active window only (minutes to an hour).
• Server request logs are kept by our hosting provider for a short operational window, then rotated out.

7. Your rights

You can:

• Access what we hold about you — your account page and tracker show the lot.
• Delete your account — self-service from the account page. Deletion is immediate and permanent: your profile, your Saved and Applied list, and your notifications are all removed.
• Lodge a complaint — if you believe we have mishandled your data, you can complain to your local data protection authority.

8. Children

This service is not aimed at under-16s. If you believe a child has signed up, contact us and we will remove the account.

9. Changes to this policy

If we change what we collect or how we handle it, we update this page and change the “last updated” date at the top. Material changes to signed-in users’ data will also be surfaced on the service before they take effect.