Privacy notice

Effective 30 August 2026. Opportunity Radar is operated by Klejdi Hoxha (“we”, “us”). We are the data controller for the personal data described here. Contact us at support@opportunityradarapp.io. Opportunity Radar is not affiliated with or endorsed by Upwork or any other marketplace.

What you give us

Everything below is data you enter or upload yourself.

• Account: your email address and display name. Your password is set and held by Firebase Authentication and is never visible to us.
• Professional profile: your profession, services, skills and levels, experience, hourly and project rates, currency, availability, preferred and unwanted project types, writing voice and goals.
• Portfolio: project titles, descriptions, links and tags you add.
• Opportunity content: the full text of any job post, message, enquiry or referral you paste in, plus any link, title, budget, client name or note you attach to it.
• Pipeline and outcomes: the stage of each opportunity, your pursue/maybe/skip decision and any skip reason, follow-up dates, and the value, hours and result you record when work closes.
• Proposals and drafts: text generated for you and any edits you make.

A warning about what you paste

Opportunity text often contains someone else’s confidential information — client names, budgets, unreleased product plans, and sometimes personal data about third parties. You decide what to paste. Please paste only what you are entitled to share, and remove anything you are under an obligation to keep confidential. If you paste personal data about another person, you are responsible for having a lawful basis to do so.

What we collect automatically

To run and protect the service.

• Authentication tokens and session identifiers.
• Usage counters — how many analyses and proposal drafts you have run in the current billing period, so plan limits can be enforced.
• Technical logs from our infrastructure: timestamps, error codes, request identifiers and approximate location derived from IP.
• For each AI call: the model used, token counts, duration and whether it succeeded. This is metadata about the call, recorded so we can monitor cost and reliability.
• Device and browser information, and Firebase App Check signals used to block automated abuse of our servers.
• On our public marketing pages only: which page was viewed, roughly where in the world the request came from, and which site or search referred you. This is how we tell whether anyone is finding us, and it is separate from your account.

Why we process it, and on what legal basis

Under the GDPR we rely on the following.

• To provide the service you signed up for — scoring opportunities, estimating effort, suggesting prices, drafting proposals and keeping your pipeline. Legal basis: performance of a contract.
• To take payment and manage subscriptions. Legal basis: performance of a contract.
• To keep the service secure, prevent abuse, debug faults and monitor cost. Legal basis: our legitimate interests.
• To connect to a marketplace API, where you have switched that on. Legal basis: your consent, which you can withdraw at any time in Settings.
• To meet accounting, tax and other legal duties. Legal basis: legal obligation.

AI processing — please read this one

Scoring an opportunity means sending text to an external AI provider. This is not optional and is not a background feature: it is how the product works.

• When you run an analysis or generate a proposal, we send the opportunity text you provided and a summary of your professional profile — profession, skills, rates, preferences and, for proposals, relevant portfolio entries — to OpenAI for processing.
• We do not send your email address, your name, your password, your payment details or your pipeline history.
• The provider processes this on our instructions to return a result. We use their API, under terms that do not permit our submissions to be used to train their general models. We cannot control what the provider does in breach of those terms.
• Nothing is sent until you actively ask for an analysis or a draft. Saving an opportunity without analysing it sends nothing.
• AI output is generated text. It can be wrong, incomplete or confidently mistaken, and it is decision support rather than advice.

Who else processes your data

We use these providers to run the service. They act on our instructions as processors.

• Google (Firebase): authentication, database, file storage, serverless functions, and abuse protection. Hosts substantially all of your data.
• Google (Analytics): visit statistics for our public marketing pages only — which pages people arrive on and where they came from. It does not run inside the app, so it never sees an opportunity, a profile or anything you are signed in to.
• OpenAI: the AI processing described above.
• RevenueCat: subscription billing. Payment details are collected by RevenueCat’s payment provider, or by Apple or Google if you subscribe inside a mobile app — we never see or store your card number. We store only the subscription and entitlement identifiers RevenueCat gives us.
• Upwork: only if you connect an Upwork account, which requires Upwork to approve our application first. This integration is not currently active.

Where your data goes

Our infrastructure and our AI and payment providers are located in the United States, so your data is transferred outside the European Economic Area. These transfers rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one applies to the provider.

How long we keep it

• Your account and its contents — profile, opportunities, analyses, proposals, pipeline and outcomes — for as long as your account exists.
• Content retrieved from a marketplace API, and anything derived from it, for no more than 24 hours.
• Marketplace access tokens until you disconnect the integration, at which point they are deleted.
• AI call metadata (model, token counts, timing) for up to 24 months, so we can account for cost and reliability. It does not contain the text of your opportunities.
• Records we must keep for tax and accounting purposes, for the period the law requires.
• When you delete your account we remove your data from our live systems promptly. Residual copies may persist in encrypted backups for up to 30 days before being overwritten.

Your rights

If you are in the UK or the EEA you have the right to access your data, correct it, delete it, receive a portable copy, restrict or object to processing, and withdraw consent where processing relies on it. Similar rights apply in a number of other jurisdictions.

• Access and portability: Data & privacy → Export your data gives you everything on your account as JSON, immediately.
• Deletion: Data & privacy → Delete your account removes your profile, every opportunity, analysis, proposal and note, and your sign-in.
• Correction: edit your profile and opportunities directly, at any time.
• Anything else, or if a control does not work: email support@opportunityradarapp.io. We respond within one month.
• You may also complain to your data protection supervisory authority.

Security

Data is encrypted in transit and at rest by our infrastructure providers. Access to workspaces is enforced on our servers and in database rules, not only in the app. We limit administrative access to what is needed to operate the service. No system is perfectly secure, and we cannot guarantee absolute security.

What we do not do

• We do not sell your personal data.
• We do not use your opportunity text or profile to advertise to you.
• We do not make your content available to other users.
• We do not use automated decision-making that produces legal effects about you. The scores are advice to you about your own work.

Storage on your device

We store your sign-in session in your browser or app so you stay logged in, and small preferences such as your theme. We do not use advertising or cross-site tracking cookies, and we do not sell or share what we measure with anyone.

• Necessary, always on: your sign-in session, your theme choice, and a marker saying this browser has an account so the marketing page can send you straight to the app instead of showing you the pitch.
• Analytics, only if you allow it: our public marketing pages ask before Google Analytics stores anything. Decline and it stores nothing on your device; Google still receives an anonymous, cookieless record that a page was viewed, which includes your IP address and cannot be tied back to you by us.
• If your browser sends Global Privacy Control or Do Not Track, we do not load analytics at all and do not ask.
• Your answer is remembered in your own browser. Clearing your site data asks again.

Children

Opportunity Radar is for professional use and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will remove it.

Changes

If we change how we handle your data in a way that materially affects you — a new sub-processor, a new category of data, a new purpose — we will update this notice and tell you in the app before the change takes effect. The effective date at the top always reflects the current version.