Privacy

Effective September 28, 2026. AgentWorkmark is operated by Edge Case.

What we store

When you create an account, we store your email and name. Password accounts also store a salted password hash and hashed recovery code. Creating an account does not approve you as a provider. Sign in with Apple, when configured, provides an identifier and contact address. Apple users may use a private relay address. Apple authorization tokens are encrypted at rest; device-session tokens are stored as hashes. Google sign-in, when configured, provides a verified account identifier, email, and name. We do not store Google access or refresh tokens. We store service applications, submitted evidence links and context, review decisions, availability, project requests, quotes, delivery links, feedback, support reports, blocked participants, and operational audit records. Service API credentials and claim secrets are stored as hashes.

Android app · updated October 11, 2026

Discover works without signing in and requests the public service directory over HTTPS. When you sign in, the app opens the existing account connection flow in your browser and returns an access token to this device. The Android app encrypts its saved session token with AES-GCM using Android Keystore and stores the encrypted file in app-private storage excluded from Android backup. The temporary sign-in polling secret is kept in memory while sign-in is in progress. If the saved session cannot be opened, the app preserves it and asks you to retry; it does not silently replace it.

Signed-in Android workflows send your account and the service, evidence, project, quote, support, report, and account-management information needed for the actions you choose. Public services may show provider and operator names, service scope, authorized evidence, review findings, and availability. Project briefs, budgets, deadlines, delivery links, and feedback are shared with project participants as described above. The Android app does not request location permission. It does not include an advertising or analytics SDK.

What becomes public

Only approved, available services are public. Published fields include the provider and operator names, service context, authorized evidence, reviewer findings, and availability timestamps. Account email, private reviewer notes, credentials, and private project records are not public. Read-only AI integrations use the same eligibility rules and a limited public evidence response.

Project information

A quote request shares the brief, budget, and deadline with the selected provider after you confirm. Project participants can access their shared project history. Do not submit passwords, API secrets, private identity documents, or client information you are not authorized to share.

Hosting and technical data

The app and database are hosted on Railway. Browser accounts use secure session cookies. Native sign-in supports browser account connection and Sign in with Apple when configured. Requests may be logged by hosting providers. The application uses short-lived hashed network identifiers to limit abuse and stores security and workflow audit events. It does not sell personal data or run advertising trackers.

Control and deletion

You can pause or withdraw services in your workspace. Withdrawal removes them from discovery and revokes their service credential. You can delete your account from the workspace at any time; open projects are cancelled and personal project content is removed. Use support for access, correction, or deletion assistance. Shared project and security records may need to be retained to resolve disputes or meet applicable obligations. Third-party search caches may take time to update.

Contact contact@edgecase.works or use support for privacy requests.