Privacy

Goodworking is run by BAHRCO Labs. This page says what Goodworking keeps about you, why, and for how long.

If you scanned a nametag

When you scan an employee's nametag, or open their page at goodwork.ing, we record the scan: which employee, at which business and location, and when. That is how the employee gets credit for good work.

• One cookie, for 24 hours. The page sets a cookie named gw_scan holding the employee's handle and the scan's id, so a refresh shows the same page. It expires after 24 hours and holds nothing about you.
• Your IP address and browser, hashed, for 30 days. We keep a keyed hash of your IP address and of your browser's user agent, never the address or the user agent itself, to tell a real scan from an automated or repeated one. Both hashes are deleted after 30 days.
• The button you pressed. When you press a review button, we record which one, with the scan.

The page has no advertising, analytics or tracking scripts. It never asks for your name, email or phone number, and we do not know who you are.

If you visited goodwork.ing

The goodwork.ing home page, the demo page, and the privacy and terms pages, use a few services to count visits, keep bots out and show the map. None of this runs on an employee's page.

• Visits, through PostHog. We count visits with PostHog: the pages you open, where you came from (the link, its tags and the site that sent you), which headline you saw, what you click, and whether you start a search, ask for an audit or ask for a demo. Your visit may be recorded so we can watch how the page is used, with anything you type hidden. The audit box (the business you search for and your email) is never recorded. PostHog stores this for us in the United States.
• A bot check, from Vercel. When you search for a business, ask for an audit or ask for a demo, Vercel's bot check runs in your browser to tell a person from a script.
• The business search, from Google. What you type in the business search is sent to Google to find the business. Only the business you choose comes back to Goodworking, to make its audit.
• An audit, if you ask for one. When you ask for an audit we keep the email address you give, the Google Place ID of the business you picked, and a keyed hash of your IP address (never the address itself), to limit how many audits one connection can ask for. We keep them until we delete them: there is no set period yet. We use your email address only to send the audit and, if you ask for a demo, to reply to you. We never add you to a mailing list.
• The map, from OpenFreeMap. The map tiles come from OpenFreeMap, so its servers see your IP address, as any website you load does.
• Your rough location. We centre the map on the location from your IP address that our host, Vercel, works out. It is used to draw the page, not stored.
• Asking for a demo. What you put in the form is emailed to us and used only to reply to you; we keep that email.

If you left a review

Goodworking reads the public reviews of the businesses that use it, on sites such as Google. For each review we store what the site shows publicly: the text, the star rating, the reviewer's public name and reviewer id, and when it was posted. An AI model reads the text to find which employee it is about. We use reviews to credit employees and for nothing else, and we never contact reviewers.

If you are an employee

Your employer invites you with your name and email address. Your page is public: anyone with the link sees your first name, photo and titles, and the business you work for. Your email is for signing in and for Goodworking's emails, and never appears on the page.

We tie reviews to you, through scans of your nametag and the names in reviews, to work out what you earn. Your employer and Goodworking staff see your earnings and the reviews behind them.

Who else handles it

We use service providers to run Goodworking: hosting and the database (Supabase), hosting this website and its bot check (Vercel), counting visits to it (PostHog), the business search (Google), map tiles (OpenFreeMap), collecting reviews (Apify), reading reviews (Anthropic), sending email (Resend) and error reports (Sentry). They handle data for us, not for themselves. We do not sell data.

Asking about your data

To ask what we hold about you, or to have it deleted, email hello@goodwork.ing.