Privacy policy

01In short

• No phone numbers and no ID documents. A first name or a handle is enough; nobody has to share their full name.
• Public work only. Signing in with GitHub lets Maiev read your public repositories and merged pull requests. Maiev never asks for access to private repositories.
• Not contactable unless you choose. Companies can only approach people who signed in and switched on Open to job offers.
• No ads and no data sales. We don’t sell or rent personal information, and there is no advertising or advertising tracking.
• Some things are public by design. Your profile, ranks and posts are public. Payments and payouts in USDC are recorded on a public blockchain.

02Who we are

Maiev (“Maiev”, “we”, “us”) operates maiev.xyz and app.maiev.xyz from New South Wales, Australia, and is responsible for the personal information described here. Contact us at privacy@maiev.xyz.

03What we collect

When you sign in

From GitHub, Google or X: your account id with that service, your username, display name and profile picture, and your email address if the service shares a verified one. We use the email only to run your account and contact you about it; it is never shown to anyone.

Your profile

What you enter: a name or handle, skills, location, whether you’re open to remote roles and to offers, an optional salary floor, and anything you add later, such as a headline, bio, links, profile photo, work history and the companies you hide from.

Your public GitHub work

At sign-in with GitHub, and at most once a day after that, we read your public repositories, the public projects you’ve had pull requests merged into, their languages and stars, and your number of commits to each. We use this to calculate your score in each skill. The access GitHub gives us is used once and then cancelled.

Activity on Maiev

• Hearts and validations: who you heart or validate, for which skill, work or role, and when, and those you receive.
• Validation links: the role a link is for and the name you enter for the colleague you send it to, and who confirmed it.
• Posts, follows and news votes: your short posts, who you follow and who follows you, and your votes on news stories.
• Ranks over time: a daily snapshot of your ranks, so we can show how they move.
• Profile views: one view per viewer, per profile, per day, with where it came from and the skill being looked at. Members are counted by account; share-link visitors by a code made from their network address and browser that changes every day and can’t be turned back into either. Nobody is ever shown who viewed them.

Hiring accounts, hunts, messages and bounties

If you set up or join a hiring account: its name, domain and profile, its teammates, and how it was verified (if by work email, that address and a scrambled copy of the code, deleted once used). We keep the hunts companies send and how they’re answered, roles posted on Maiev and applications to them, private chat messages, reports about accounts, and bounties and the bids made on them.

Payments, credit and earnings

• Card payments: Stripe’s reference numbers, the amount, date and status, and whether a payment was refunded or disputed. We never receive your card details.
• USDC payments: the amount, the transaction signature and the time it was confirmed.
• Earnings and payouts: what you’ve earned and when, the Solana wallet address you give us for payouts, and the transaction signature of each payout.

People on the leaderboards who haven’t signed up

Leaderboards start with people who contributed to the public repositories of the projects we track, and security researchers with public results on Code4rena and Immunefi. For them we store only public data: username and account id, display name, profile picture, the location on their public profile, and their public contributions or results. They can’t be contacted through Maiev, and anyone can remove their listing by signing in with GitHub and choosing Remove me, or by emailing us.

Technical data

Our hosting provider keeps standard request logs (such as IP address, browser and time) for security and to keep the service running.

04What we never collect

• Phone numbers.
• Private repositories, private code or anything behind your GitHub login.
• ID documents or selfies.
• Passwords: you sign in with GitHub, Google or X, and we never see your password.
• Payment card details, or the private keys or seed phrases to any wallet.

05How we use it, and why

• To provide Maiev (performing our contract with you): run your account and profile, keep you signed in, calculate and show ranks, match you to roles, let verified companies find and contact you if you’re open to offers, run hunts, chats and bounties, and process payments, credit and payouts.
• To keep Maiev safe and fair (our legitimate interests): detect and prevent fraud, abuse, fake or duplicate accounts, ranking manipulation, spam and security threats, and enforce our terms.
• To improve Maiev (our legitimate interests): understand how the service is used, mainly from aggregated and anonymous data.
• To meet legal obligations: including tax, accounting, sanctions and anti-money-laundering requirements, and responding to lawful requests.
• To contact you about your account and important changes. No marketing email unless you ask for it.

Ranks are calculated automatically from public work and other members’ activity. They don’t on their own produce legal or similarly significant decisions about you: companies decide who to contact and hire. You can ask us to review your rank, or remove yourself from the leaderboards at any time.

We may also publish aggregated or anonymised information that doesn’t identify anyone, such as the salary index.

06Who can see what

• Everyone, including search engines and AI assistants: the name or handle you choose, profile picture, skills, ranks, city or country, work history, public repositories you’ve worked on, posts, follower count, and hearts and validations you’ve received. This information may also be shown through Maiev’s public agent and data endpoints, and in share cards and link previews.
• Verified companies and recruiters: if you’re open to offers, the name you appear as, your city, current title, skills with scores and responsiveness. They see your note when you apply to their role, and their chats with you. Your current employer can never find you once you add your current role, and verified members can hide from other companies.
• Your company’s team: everyone on a hiring account sees its hunts, roles, applications, credit, bounties and chats.
• A bounty poster sees the bids on their bounty once bidding closes.
• The public blockchain: USDC payments and payouts, including wallet addresses, amounts and times, are permanently visible on the Solana blockchain. We can’t change or delete them.
• Never shown: your email address, salary floor, payout wallet address (on Maiev) and the account ids we store.

We may also disclose information to our service providers (below), to professional advisers, to a buyer or successor if Maiev is sold or restructured, and where the law requires it or we reasonably believe it’s needed to protect someone’s safety or our rights.

07Services we use, and where data goes

• Vercel hosts the website and app, keeps request logs and provides privacy-friendly page-view analytics.
• DataFast provides website analytics: which pages are visited, where visitors come from, and unique visitor and session counts.
• Neon runs our database, in the Sydney region (AWS ap-southeast-2).
• GitHub, Google and X provide sign-in. Their own privacy policies apply to your accounts with them.
• Stripe processes card payments as merchant of record. Stripe’s privacy policy applies to what you give them.
• Resend sends verification-code emails for hiring accounts.
• Solana network providers are used to read the blockchain to confirm USDC payments.

Some of these providers process data outside Australia, mainly in the United States and the European Union. By using Maiev you understand that your information may be transferred to and processed in those countries. We use reputable providers and take reasonable steps to make sure they protect it.

Company logos, job listings and news are fetched by our servers from public sources, so your browser doesn’t contact those sites through Maiev.

08Cookies, storage and analytics

Maiev uses one cookie to keep you signed in, and a short-lived cookie while you’re signing in. Both are essential and can’t be read by scripts. The app also keeps a few small notes in your browser’s storage, such as that you were signed in and which view you last used, so the app behaves as you expect. We use Vercel Web Analytics and DataFast to understand how people find and use Maiev. DataFast sets first-party cookies to count unique visitors and sessions; neither service is used for advertising. There are no advertising cookies.

09Keeping and deleting your data

• Your account: kept while you use Maiev. Email privacy@maiev.xyz to delete it and we’ll delete your account, profile and the hearts and validations you gave within 30 days.
• What we keep after deletion: records we must keep for legal, tax or accounting reasons (such as payments, credit, earnings and payouts, generally for seven years), information needed to prevent fraud or abuse or to resolve disputes, and anonymised or aggregated data.
• Your leaderboard listing: choose Remove me on your profile, any time.
• Shorter-lived data: profile views are deleted after 90 days, rank snapshots after 60 days, and verification codes once used or expired.
• Hiring accounts: closing one deletes its profile, roles, hunts, chats and credit ledger, apart from the payment records above.
• Backups are overwritten on a regular cycle.

10Security

We take reasonable steps to protect personal information, including encryption in transit, signed and secure session cookies, limited access, and no stored passwords or card details. No system is completely secure, so we can’t guarantee the security of information. If a data breach is likely to cause serious harm, we will notify affected people and the regulator as the law requires.

11Your rights and contact

You can ask to access the information we hold about you, correct it, delete it, or (where the GDPR applies) restrict or object to how we use it, or receive a copy in a portable format. Email privacy@maiev.xyz. We may need to confirm it’s you, and we’ll reply within 30 days. We may refuse a request where the law allows, and we’ll tell you why.

If you’re unhappy with how we’ve handled your information, tell us first so we can try to fix it. If you’re still not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au), or your local data protection authority.

Maiev is not for anyone under 18. If we learn we hold information about someone under 18, we’ll delete it.

12Changes

If we change this policy, we’ll update this page and the date at the top, and tell signed-in members about significant changes in the app before they take effect.