Privacy & data processing

• The pages you view on upworkrank.com (page_view).
• The Upwork URL or agency name you paste into the Claim modal, plus whether we found a match (the connect_* events that power the Claim funnel).
• Your IP address: Google truncates IPv4 to /24 (and IPv6 to /48) before storage.
• Your browser type and operating system, bucketed into the device-class level.
• Approximate location at the country level (no city, no postcode).
• A recording of a sample of browsing sessions, but only if you accept analytics in the consent banner. A recording is a replay of what happened on the page — the pages themselves, your clicks, scrolling and mouse movement. What you type is hidden, apart from searches you make on this site (an agency name, or the Upwork URL you paste into the Claim modal). Your email address and the sign-in code we send you are hidden everywhere they appear, including where the page displays them back to you.

None of this asks who you are, and you can read every ranking on this site without telling us.

Signing in is optional and only needed to claim a profile. If you never sign in, we hold no contact detail for you at all and the section above is the whole story.

When you do sign in, we store two things about you:

• Your email address, as given to us by the sign-in provider (for example, the address on the Google account you used).
• A user identifier issued by Auth0, our sign-in provider, an opaque string that lets us recognise you on your next visit without storing a password.

Why: to give you an account, so a claimed profile has an owner and you can manage it later. Lawful basis: performance of a contract, GDPR Art. 6(1)(b). You asked us for an account and this is what one requires.

How long: for as long as your account exists. Ask us to delete it and the email and identifier go with it. We don't send you marketing email, and your address is never sold or shared for advertising.

We never see your password. Sign-in happens on Auth0's own hosted page, not on ours. There is no password field anywhere on this site.

• Any contact detail from you unless you choose to create an account.
• Your phone number, postal address, or date of birth. Ever, account or not.
• Your Upwork password (we never ask and never see it).
• Anything you type into our site that isn't an Upwork URL or agency search.
• Cross-site browsing history or identifiers that follow you to other websites. We do not run remarketing, ad personalisation, or social-network pixels.

Aggregate analytics: to know which features are used and which pages need work. Lawful basis: legitimate interest, GDPR Art. 6(1)(f).

Cookies that recognise returning visitors, and session recordings: set and made only after you accept the consent banner. Lawful basis: consent, GDPR Art. 6(1)(a). Until you choose — and if you reject — analytics runs in cookieless mode: we count page views and which features get used, but store nothing on your device and cannot recognise you on a later visit. Nothing is recorded.

Account data: to provide the account itself. Lawful basis: performance of a contract, GDPR Art. 6(1)(b). A sign-in cookie is set when you log in; it is strictly necessary for the account to work and is not used to track you.

• Google Analytics 4: receives event names + the parameters listed above. Subject to Google's data-processing terms. Servers in the EU and US.
• Auth0 (Okta, Inc.): runs the sign-in page and holds your email and user identifier so we can authenticate you. Only involved if you create an account.
• PostHog: receives the same event names and parameters as above, plus the sampled session recordings described earlier — with typing masked apart from on-site searches. Used to see where people get stuck in the Claim flow. Lawful basis: consent, GDPR Art. 6(1)(a) — nothing is sent to PostHog, and no recording is made, unless you accept. Servers in the US.
• Vercel: hosts upworkrank.com and logs request metadata for site operations.
• GigRadar Inbound backend: the index of public Upwork profiles you see ranked, and (if you have an account) the record of which profiles you own.

• Use the consent banner to reject cookies. Analytics drops to cookieless mode, no session is recorded, and we stop recognising you across sessions. You can change your choice at any time with Privacy choices in the footer of any page — turning analytics back off stops any recording immediately.
• Your browser's Global Privacy Control and Do Not Track signals are respected; if either is set, we treat that as a rejection.
• Don't sign in. Every ranking on this site is readable without an account.
• For deletion or correction requests, to close your account, or to ask what we hold about you, message us in our help centre. Say it's a data request and we'll route it to a person.

We update this notice when we add or remove a category of data. The "last reviewed" date above will change in the same PR.