TIME2INCOME Privacy Policy

Last Updated: 8 November 2026

TIME2INCOME is a global marketplace for discovering local and remote services, flexible work and professional opportunities.

TIME2INCOME is operated by Suraj Sah under the business name TIME2INCOME.

This Privacy Policy explains what information TIME2INCOME collects, how it is used, how it is stored and the choices available to users.

This document is a draft and must be reviewed against the live application, actual data practices and applicable legal requirements before publication.

1. Who Operates the Service

Platform: TIME2INCOME
Website: https://time2income.com
Operator: Suraj Sah
Business Name: TIME2INCOME
Business Address: RAMI PARK, DINDOLI, SURAT, GUJARAT, INDIA - 395010
Privacy & Support Email: [email protected]

For privacy-related questions, data requests or account-related assistance, contact [email protected].

2. Information the Service Handles

Depending on how you use TIME2INCOME, the service may handle the following information:

2.1 Account Information

• Email address handled by Supabase Authentication.
• Profile name.
• Country and city.
• Account role.
• Language preferences.
• Currency preferences.

2.2 Profile Photos

Users provide a professional head-and-shoulders photo for their account.

• Photos are stored in private Supabase Storage.
• Signed-in marketplace members may view them where account profiles appear, including eligible provider listings and booking or offer activity.
• The browser resizes and re-encodes profile photos, removing embedded image metadata.

A profile photo is not identity verification and does not establish a person's legal identity.

2.3 Private Professional Profiles

Signed-in users may create multiple professional profiles for purposes such as:

• Job seeking.
• Freelancing.
• Professional services.
• Businesses.
• Entrepreneurship.
• Investing.
• Study.
• Creative work.

Profile details are stored in the user's account metadata.

Optional profile photos and uploaded PDF, Word, PowerPoint, PNG, JPG, JPEG or WebP files are stored in private Supabase Storage buckets accessible only to the relevant account.

These professional profiles are not included in provider search and are not shared with other users.

Uploaded originals remain unchanged. Profile exports and downloaded copies of uploaded PDFs include a "time2income.com | Powered by Spactisu" footer.

2.4 Provider Profiles

Provider profiles may include:

• Skills and service categories.
• Biography and professional information.
• Work preferences.
• Service city and country.
• Rates and pricing information.
• Languages.
• Portfolio images.

Published provider profiles are available to signed-in marketplace users.

2.5 Signup Identity Documents

New accounts must confirm their email address and sign in before submitting a photo or PDF of a valid identity document showing the user's photograph and ID number.

• Users may select a file or take a photo using a compatible device camera.
• The original file is stored unchanged in a private Supabase Storage bucket for authorized review only.
• Embedded photo metadata may remain in the original document.
• The document and ID number are not displayed on marketplace profiles.
• While email confirmation is pending, the selected file may be temporarily staged in browser storage and removed after upload or local staging cleanup. The exact staging window must be confirmed before publication.
• No final retention period for identity documents has been approved. This retention period and the related deletion procedure must be confirmed before publication.
• The ID number is not separately extracted into account metadata.

Document submission does not automatically mean that an identity has been approved or verified.

Review outcomes do not determine account access. After approval, an identity-reviewed badge or status may appear on marketplace listings. Verified profiles may receive ranking priority over unverified profiles.

Where mutual reviews are enabled, weighted reviews for either party may influence provider, offer and task ordering within marketplace results. Until that feature is enabled, task posts use recency within verification groups.

2.6 Provider Selfie Review

Users must submit a selfie for private review before publishing a provider profile. A provider profile may be published while the review is pending. The selfie is not shown on the public provider profile, and the identity-reviewed badge appears only after a reviewer approves the submission. If a submission is not approved, the user may submit a new selfie.

• The browser resizes and re-encodes the image, removing embedded image metadata.
• The selfie is stored in a separate private Supabase Storage bucket.
• It is used for private review and is not displayed on the public provider profile.

A selfie alone does not establish a person's legal identity.

2.7 Optional Provider Location

Providers may choose the "Set approximate location" option.

• The browser rounds coordinates to one decimal place before saving them with the provider profile.
• These coarse coordinates are used to rank nearby providers.
• The approximate coordinates are visible to signed-in marketplace users.
• Providers can remove this information from their profile.

2.8 Nearby Alerts Location

Users may separately opt in to nearby task or provider alerts by sharing an approximate location and selecting alert categories.

• The browser rounds the coordinates submitted for nearby alert matching to three decimal places.
• The location is stored privately and used to match nearby alerts, it is not shown on a public profile.
• Nearby alerts cover an approximate 15 km area. Matching categories are notified first, other opted-in nearby users may be notified 30 minutes later.
• Users can turn off nearby alerts in Profile settings. This is separate from provider profile location and browser notification permission.

2.9 Search Location

Visitors may grant browser location permission to rank providers by distance.

• Search coordinates remain in page memory for the current session.
• The website does not write these search coordinates to the user's account or browser storage.
• Manually entering a city remains available as an alternative.

2.10 Marketplace Activity

The service may handle:

• Tasks and task descriptions.
• Offers and offer statuses.
• Booking requests and booking statuses.
• Booking messages.
• Reviews submitted after completed bookings.

Marketplace rules may change whether a task listing is visible or can be removed. Listing expiry or removal does not determine retention of related bookings, messages, transaction records, backups, or audit data, the schedule for those records remains pending legal review.

2.11 Browser Preferences

The website stores selected language, currency and manually entered marketplace city preferences in browser storage.

2.12 Notifications and Device Data

• In-app notification records may contain booking, task-offer, booking-chat or wallet update details and are available through the notification bell.
• Notification category choices control which eligible updates may be sent as browser push notifications. These choices do not remove in-app notification records from the notification bell.
• Account-wide quiet-hours settings, including the time zone detected on the device when the settings are saved, are stored with the account. Quiet hours defer eligible browser push notifications, they do not prevent users from viewing in-app notifications.
• Browser notifications are optional. If enabled, a device-specific browser push subscription, including its delivery endpoint and cryptographic subscription keys, is stored to send notifications to that device. Users can enable or turn off browser notifications separately on each device.
• Push notification content may appear on the device's lock screen or other notification surfaces according to the user's device and browser settings. Users can manage those display settings on their device.
• Nearby alerts use separate location and category consent. Browser push permission is not required to use in-app notifications.
• Notification records, subscription details and delivery records are processed through Supabase services. Depending on the device and browser, web push delivery may also involve the relevant browser or operating-system push service, such as Google, Mozilla, Apple or Microsoft.

2.13 Task-Action Payments

When enabled, Razorpay processes applicable fees for:

• Task posts after the first free post.
• Task-detail openings after the first free opening.

Razorpay handles checkout payment details. The website sends payment and order references, along with task-action records, to Supabase for verification.

TIME2INCOME does not currently process payments for service bookings.

3. Why We Use Information

Information may be used to:

• Create and authenticate user accounts.
• Operate provider profiles and professional profiles.
• Enable task and service discovery.
• Support offers and booking requests.
• Display reviews and relevant marketplace information.
• Rank nearby providers when location features are enabled.
• Remember browser preferences.
• Review submitted identity documents.
• Verify task-action payments when checkout is available.
• Create in-app notifications and deliver optional browser push notifications, apply selected browser-notification categories and defer eligible browser push alerts during quiet hours.
• Use separately opted-in approximate location and selected categories to match nearby task and provider alerts.
• Respond to customer support and privacy requests.
• Maintain platform security and prevent misuse.

Information should only be used for purposes consistent with applicable privacy requirements and the actual features of the deployed service.

4. Service Providers and Information Sharing

TIME2INCOME uses third-party services to operate its platform.

The currently identified service providers include:

Supabase: Authentication, database and file storage services.

Razorpay: Payment processing for task-action fees when checkout is enabled.

When a user enables browser notifications, the relevant browser or operating-system push service may process the push endpoint and notification payload to deliver the alert to that device. Depending on the device and browser, this may include Google, Mozilla, Apple or Microsoft push services.

Marketplace information is shown to other signed-in users as described in this Privacy Policy.

The complete list of hosting, email, analytics, monitoring and other third-party service providers must be confirmed before publication.

TIME2INCOME must not expose private identity documents, private selfies or account-restricted professional files through public marketplace listings.

5. Data Retention

TIME2INCOME has not finalized retention periods or deletion deadlines for identity documents and KYC records, payment evidence and transaction records, user accounts and profiles, task and booking records, chat and messaging data, or notification records, browser push subscription details and delivery records. No fixed schedule should be inferred from this draft. Existing listing expiry or local-file cleanup behavior is separate from the retention of related records, backups, messages, and audit data.

The final schedule and deletion procedure are pending legal review. Where legally permitted, eligible personal information should be securely deleted or anonymized. Records must be preserved where required by law or a valid legal hold applies, and the reason for delayed or denied deletion should be explained to the user.

A policy-driven retention scheduler and account-deletion workflow are not available. The signed-in account form and support database provide intake-only request tracking with a ticket ID and visible status. Submitting a request does not automatically delete or change account data, a person must review it, status updates require an authorized staff process that is not yet available in the app, and legally required records or valid legal holds may affect processing. For help, users may contact [email protected].

6. Security and Access

TIME2INCOME uses private storage for sensitive uploaded documents and account-restricted files.

Access to identity documents and provider selfies must be limited to specifically authorized KYC administrators and compliance personnel. Customer support should see verification status only by default, developers and general IT staff must not have routine access. Sensitive reads and deletion decisions must be audit-logged. These access restrictions and audit controls must be verified against the production configuration before publication. Where an authorized KYC provider can verify a document, TIME2INCOME should store the provider reference and verification status rather than duplicate the document.

The platform should maintain appropriate technical and organizational safeguards, including:

• Access controls.
• Secure authentication.
• Private storage permissions.
• Restricted administrative access.
• Appropriate handling of security incidents.

No internet-based service can guarantee absolute security.

7. Your Privacy Choices and Requests

Depending on applicable law and the features available, users may request assistance with:

• Accessing their personal information.
• Correcting inaccurate account details.
• Updating professional profiles.
• Requesting account deletion.
• Asking about identity-review information.
• Removing optional approximate provider coordinates.
• Changing notification categories and quiet hours, turning off browser notifications on a device, or disabling nearby alerts and removing their saved location.
• Raising concerns about personal information handling.

When available, signed-in users may use the account form to submit and track a request. Otherwise, contact [email protected].

Requests may require reasonable account verification before action is taken.

Some information may need to be retained where required by applicable law or legitimate record-keeping obligations.

8. Children's Privacy

TIME2INCOME is intended for users who are legally eligible to use the services offered in their jurisdiction.

Age requirements and safeguards must be confirmed and implemented before public launch. If information is collected from a person who is not legally eligible to use the service, contact support for assistance.

9. International Users and Data Processing

TIME2INCOME is designed for a global marketplace.

Depending on the user's country and the service providers used, personal information may be processed or stored in locations outside the user's country.

Applicable international data-transfer requirements must be reviewed and addressed before launch.

10. Changes to This Privacy Policy

TIME2INCOME may update this Privacy Policy when its features, data practices or legal obligations change.

The latest version will be published on the official website with its updated date.

Where required by applicable law, users will be notified of material changes.

11. Contact and Privacy Support

For questions, complaints or requests relating to personal information, contact:

TIME2INCOME Support & Privacy Team

Email: [email protected]

Website: https://time2income.com

Operator: Suraj Sah
Business Name: TIME2INCOME

12. Important Publication Notice

This Privacy Policy must be checked against:

• The actual production website and mobile application.
• Supabase database, authentication and storage permissions.
• Identity-document review and required provider-selfie review procedures.
• Notification categories, browser push subscriptions, push providers, lock-screen payloads and quiet-hours behavior.
• Nearby-alert location precision, visibility, consent and deletion behavior, separately from provider profile location.
• Actual data retention and deletion processes for account, marketplace, location, notification and payment records.
• Razorpay payment configuration.
• Hosting, email, analytics and other third-party providers.
• Applicable Indian privacy and data protection requirements.
• International privacy obligations for supported countries.

Retention periods and deletion procedures for all listed data categories remain pending legal review and must be approved before publication.

The operator must also establish a working privacy request, account deletion, identity-document review and security incident response process.

This document is a draft and is not legal advice. It should not be published as a final Privacy Policy until reviewed and approved by qualified legal counsel.

TIME2INCOME
A marketplace for time, skills and opportunity.

Operated by Suraj Sah