Security and privacy
You hand Thalamus your relocation plans and your documents. Here is the short version, without legal language: what we collect, what we never collect, where it lives and how we make money. The full wording is in the privacy policy.
What we collect
- Your email and password, so you can log in. The password is stored as a hash — nobody sees it in the clear, us included.
- Telegram sign-in, if you use it: your account number, name and photo from Telegram. Telegram never gives us your messages.
- Your profile: name, city, where you are moving from and to, languages. That is what an expert is matched against.
- Your goals and requests: what exactly you are asking for. A human works the request, not an algorithm.
- A business's verification documents — licence, registration. They sit in a private bucket; only the card owner and we can reach them.
- A visit counter: the page address and the site you came from. No IP, no cookie, no identifier — that row cannot identify a person.
- A question for the Parents library: the question itself and the channel to send the answer to. A published entry carries no name of yours.
- A record of what we sent you: about what, through which channel and when. It shows what went out in our name and keeps us from writing twice.
- Communities: where you belong and what you wrote in posts and comments. In a public community your posts and the name next to them are visible to everyone, including people who are not signed in.
- The course you teach: lesson texts and checklists, with your name and credential next to them. A published course is visible to everyone, including people who are not signed in.
What we never collect
- No third-party analytics: no Google Analytics, no pixels, no ad networks.
- We do not sell data and do not pass it to advertisers.
- We build no advertising profiles and score no one algorithmically.
- Fonts are hosted by us, the map loads only after your click — before that not a single request goes to Google.
- Cookies are technical only: your login session and the chosen language. That is why there is no consent banner.
Where the data lives
- Database and files — Supabase, Paris region, European Union.
- The site runs on Vercel (US), email goes through Brevo (France). Transfers outside the EEA are covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
- Notifications — about an answer to your question, about your request, about a matching position in Jobs — go through the channel you chose in your profile: Telegram or email. The choice is followed literally: we will not write anywhere else.
- The Spain-residency checklist emails go only to people who ticked the box on the signup form. That list is kept separate from service email in Brevo, and one click in any of those letters unsubscribes you.
How long we keep it — and what enforces that
- You delete your account yourself, with one button in the profile. Goals, requests and favourites go with it.
- The «looking for work» card in Jobs you delete yourself, with a button. Introductions and recommendations about you go when you delete the account.
- Verification documents are erased 30 days after the decision. A daily job on the server does it — not a person's memory.
- Visit-counter rows are deleted after 12 months, also on a schedule.
- A request with no movement lives 24 months, then a monthly job on the server erases it along with the deal history. Any activity counts: a stage change, a note, a call, a task.
How we make money
- Businesses pay — for a place in the catalog and for working the requests. It costs you nothing.
- Ranking cannot be bought. There is no paid promotion in the catalog; if it ever appears, those cards will be labelled as ads.
- The Studio is a subscription.
- Payments are switched off right now: the service runs as a test launch and no payment data exists on our side.
Found a hole — write to us
- Write to hello@thalamus.community. We answer within three working days.
- Describe what you found and how to reproduce it. A screenshot helps.
- What we ask: do not run load tests against the site and do not touch other people's accounts. There is no permission for that.
- We do not pay for findings yet. We will name you in the credits if you want.