Privacy policy

Side Hustle Catalog (“the site”, “we”) at https://sidehustle.linkedbits.net is operated by VGJ LLC. For anything in this policy, write to [email protected].

Browsing the catalog needs no account. Our web server keeps standard request logs (IP address, user agent, requested page, timestamp), rotated automatically after a short period, to keep the site running and detect abuse. Analytics are collected by a self-hosted Plausible instance that uses no cookies and stores no personal identifiers.

Your account. When you sign in we store your email address, the time you signed in, and, if you use Google sign-in, the name, avatar URL and Google account id that Google returns. Magic-link sign-in stores a hashed, single-use token that expires after 15 minutes. A session cookie (sh_session) keeps you signed in.

Your profile. To score ideas we store what you tell us in the onboarding screens (role, experience, skills, projects, audience, capital, hours, constraints, goals) and anything you import: pasted resume or LinkedIn text, the public repository list for a GitHub username you give us, and the text extracted from a PDF or DOCX resume you upload. The uploaded file itself is discarded after the text is extracted; it is never written to disk.

Fit scores. For each idea we store the score, a short reason, an angle and a first step generated for your profile, plus token counts and cost of each scoring job.

MCP access. If you create an MCP token we store only a hash of it, its prefix and label, and when it was last used. The plain token is shown to you once.

Billing. Stripe handles payment. We store your Stripe customer id, subscription id, plan status and renewal date. We never see or store card numbers.

Affiliate clicks. When you follow a link tagged “affiliate” we record the link, the idea page it was on, the referrer and a salted hash of your IP address and browser for that day. The raw IP is not stored. If you are signed in, the click is associated with your account until you delete it.

Your profile exists to produce fit scores. A summary of it, together with the public idea briefs, is sent to our AI scoring provider to generate the scores. Your imported text is never published, never used to train models, never shown to other users, and never used for advertising. Catalog pages show only public content; your fit badges are visible to you alone.

If you share what you earned on a platform or idea, we store the numbers, whether you were paid, the optional state and note, and your account so you can update or delete it. Before anything is shown, the note is screened by our AI provider for spam and personal details, and a person reviews the report. Approved reports appear without your name or email: only the state (if you gave one), the period, hours per week, the amount and your note. Deleting your account deletes your reports.

• sh_session — signed session cookie, HttpOnly, Secure, set when you sign in and cleared when you sign out.
• sh_oauth — short-lived state cookie for Google sign-in, deleted after the callback.

There are no advertising or third-party tracking cookies.

• MiniMax — AI model provider that generates fit scores from your profile summary and the public idea briefs. It receives your profile summary, not your raw imports.
• Stripe — payments and subscription management (stripe.com/privacy).
• Google — optional sign-in. We request only your email, name and profile picture.
• GitHub — if you import a username, we read its public repositories through the public GitHub API.
• Apple iCloud Mail — delivers sign-in links and the weekly digest.
• Plausible (self-hosted) — cookieless page-view analytics on our own server.

The site and its database run on servers we control in the United States. We do not sell personal data and do not share it with anyone else.

Data obtained through Google sign-in is used only to create and sign you in to your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to third parties except as needed to operate the site, and never for advertising.

Account, profile, score, token and billing records are kept while your account exists. Sign-in tokens are deleted after use or expiry. Request logs rotate automatically. Weekly digest send records are kept while your account exists.

You can delete your account at any time from your account page. Deletion removes your profile, imports, fit scores, scoring jobs, MCP tokens and sign-in links, anonymizes your affiliate clicks, cancels any Stripe subscription and scrubs your email from the account record. Stripe keeps the invoices it is legally required to keep.

Wherever you live, you can ask us to show you the data we hold about you, correct it, export it, or delete it. Write to [email protected] and we will answer within 30 days. If you are in the EU, UK or California you have additional statutory rights, including the right to complain to your supervisory authority; we honor them for everyone.

Data is transmitted over HTTPS, session cookies are signed and HttpOnly, sign-in and MCP tokens are stored only as hashes, and the database is reachable only from the application. No system is perfect; if we learn of a breach affecting your data we will notify you by email.

The site is for adults. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

If this policy changes materially we will update the effective date above and, for signed-in users, mention it by email or on the site before it takes effect.

VGJ LLC · [email protected]