Privacy Policy
Last updated 6 August 2026
Privacy Policy
Last updated: 6 August 2026 Who we are: Credda, Inc. ("Credda", "we") Contact: privacy@credda.io
In short
Credda builds a reliability score you own and can carry between platforms. To do that we record commitments you make, whether they were kept, and activity from accounts you choose to connect. Your score is calculated by a published formula; no person at Credda can raise or lower it by hand, and no AI decides it either. If something on your record is wrong, you can dispute it, and the score recalculates from the corrected record.
This page explains what we hold, why, who else sees it, and what you can ask us to do.
Where Credda is offered
Credda is offered only to users in the United States and is hosted in the United States. We don't direct the Service at people in the UK, EU or EEA.
Who this covers
- Account holders, people who sign up at credda.io.
- Counterparties, people named on a commitment who confirm or reject it by email link, without creating an account.
- Clients of a company, if you received work that someone delivered on behalf of an organization. We may email you once, and at most once more if you do not reply, asking you to confirm that the work was delivered. You hold a one-time link; you do not need an account, and you never have to answer. If you do not reply, nothing at all is recorded about that company. Declining is a complete answer and also records nothing.
- Platform users, where a platform we work with reports events about you. In that case the platform decides what to send, and this notice describes what we then do with it.
What we collect
You give us:
- Account details: email address, username, display name, password (stored only as a bcrypt hash, never in readable form).
- Commitments: what you agreed to do, with whom, by when, and its value or scope.
- Anything you write: support messages, comments, attachments, evidence you submit, and Trust Coach conversations.
- Organization details, if you create or join a team.
You connect:
- When you link GitHub, GitLab, Upwork, Bitbucket, LinkedIn, Google or Stripe, we receive your username or account identifier on that platform and activity relevant to reliability, and we store an access token so we can sync. We never receive your password for those services, and you can disconnect at any time from Settings.
We generate:
- Your reliability score, its history, and the events behind it.
- Advisory signals for our own review (for example, patterns suggesting coordinated or gamed activity). These are shown to our staff, never used to set a score.
- Advisory AI text: summaries and drafts that help our support team or coach you.
When we ask you to confirm work a company delivered, we keep your email address and which job we asked you about, so that we can send the request and so we do not ask you twice about the same thing. We do not keep the confirmation link itself. If you ask us to erase your data, this record is deleted along with everything else keyed to your address.
We do not collect payment card details (Stripe handles those), and we do not buy personal data from data brokers.
Why we use it
| What for | Why |
|---|---|
| Running your account and the service | To provide what you signed up for |
| Calculating and publishing your score | To provide the core product |
| Confirming a commitment with a counterparty | A two-party record is only meaningful if both parties confirm |
| Detecting gaming, collusion and fraud | To keep the network trustworthy |
| Support and service email | To answer you and to tell you about things that affect your account |
| Billing | To take payment where you have a paid arrangement |
| Product improvement | To make the Service better |
We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act, and we do not use it for advertising.
Automated decisions about you: read this one
Your score is produced automatically by a deterministic formula from your recorded events. The formula, its factors and their weights are published at credda.io/trust, and any score can be reproduced from the events behind it.
Platforms may use your score to decide whether to work with you. That is the point of the product, and you should know it. Platforms are contractually prohibited from using it for credit, employment, insurance or housing decisions. See section 8 of the Terms.
Two commitments we make:
- No one can adjust your score by hand, not you, not a platform, not Credda staff. That's what makes it worth anything.
- If your record is wrong, you can fix the record. Raise a dispute on the event in question. If it resolves in your favour, your score recalculates automatically. If you want a person to look at it, email us.
Who else sees your data
You choose what's public. Your public profile, badge, and any credential you share show what you decide to share, and a credential lets you disclose full detail, your score band only, or a minimal proof.
We share with service providers who help us run Credda:
| Who | What for |
|---|---|
| Amazon Web Services | Hosting and database (United States) |
| Hostinger | Serves the credda.io website itself |
| Anthropic | Advisory AI features: support summaries, reply drafts, coaching |
| Stripe | Payments |
| Sentry | Diagnostics when something breaks. Personal details are stripped before an error leaves us, and screen recordings mask all text |
| GitHub, GitLab, Upwork, Bitbucket, LinkedIn, Google | Only where you connect that account |
| Our email delivery provider | Sending service email |
We may also disclose data where the law requires it, or to protect the rights and safety of our users.
How long we keep it
We keep your account data while your account exists. You can delete your account from Settings at any time.
Because a score must be reproducible from the events behind it, and because a commitment is a record belonging to two people, deleting your account does not erase the other party's record of an agreement you made with them. Where we retain events after deletion, we hold them in pseudonymous form; our scoring service is keyed to an internal identifier, not your name or email.
Your rights
You can ask us to: give you a copy of your data; correct it; delete it; or tell you what we've collected and who we've shared it with.
If you live in California, the CCPA gives you these rights specifically, including the right not to be discriminated against for exercising them. We do not sell or share your personal information, so there is nothing to opt out of, but you can still ask us the questions above.
To exercise any of these, email privacy@credda.io. We'll respond within 45 days, and we'll tell you if we need longer.
Security
We protect your data with HTTPS everywhere and HSTS, a database that is not reachable from the internet, passwords stored only as bcrypt hashes, scoped API keys, sign-in verification for unrecognised devices, and the ability to end every session on your account at once.
We don't claim any security certification, and we'll say so plainly rather than imply otherwise. If you need a security review before working with us, ask.
If you believe you've found a vulnerability, please tell us at security@credda.io, or see credda.io/.well-known/security.txt.
Children
Credda isn't for under-18s and we don't knowingly collect their data. If you think a child has given us personal information, email us and we'll delete it.
Changes
We'll post changes here and update the date above. For anything significant, we'll tell you directly.
Questions: privacy@credda.io