1. What Are Cookies?

Cookies are small text files stored on your device — whether computer, tablet, or smartphone — when you visit or use Daily Worker Hub services. Cookies are sent by the platform server and stored in your browser for various purposes, ranging from remembering language preferences and login status to tracking usage activity so we can improve your experience on our platform.

When you create an account on Daily Worker Hub, cookies allow us to recognize your device so you don't need to log in again every time you visit the platform. Cookies also help us understand how you interact with features such as job search, worker search, daily project management, and the Escrow payment system.

It is important to understand that cookies do not run program code, do not contain viruses, and cannot read other data stored on your device. Cookies only store information in plain text form that you can manage through your browser settings at any time.

2. Types of Cookies We Use

Daily Worker Hub uses three main categories of cookies, each with different functions. Understanding these differences helps you know what we collect and why we need them.

We do not use cookies for advertising or cross-site tracking purposes. The analytics data we collect is not linked to your personal identity unless you are explicitly logged in and using platform features.

3. Third-Party Cookies

Daily Worker Hub relies on several third-party services that, in their operation, also place cookies on your device. Below are these services along with an explanation of the data they collect:

Supabase:As our platform's backend, Supabase uses session cookies to manage user authentication and authorization. These cookies ensure that whenever you access features such as viewing dispatch invitations, applying for jobs, or requesting withdrawals, the system can securely verify your identity. Supabase does not use cookies for commercial tracking purposes.

Web Push (VAPID): To send push notifications — such as dispatch invitations, attendance reminders, and dispute updates — we use the standard Web Push protocol. Your browser may store a notification endpoint and cryptographic keys locally. You can disable Web Push at any time via your browser or device settings.

PostHog (product analytics): We use PostHog (hosted in the United States) to understand how visitors use the platform — which pages are visited, where they drop off in the signup funnel, and which features are used most. PostHog sets a first-party cookie (named ph_phc_*_posthog) that stores an anonymous device identifier and session metadata. No name, email, or other personal identifier is sent to PostHog unless you have signed in and we have explicitly linked your account via our analytics wrapper ($set_once on signup source). We never sell or share PostHog data with third parties. The cookie expires after 12 months; you can clear it at any time from your browser, or via the Reset analytics option in your account settings.

Google Identity Services (One Tap sign-in):When you visit the /login or/register page, Google may set a cookie named g_state to power the Google One Tap sign-in flow. This cookie holds an encrypted token that lets Google pre-select an account you have already used on this device. No data is sent to Google from pages outside the sign-in flow; the One Tap script only loads on /loginand /register. The cookie typically expires after about 6 months, and you can clear it from your browser at any time.

Resend: For transactional email (dispatch invitations, top-up approvals, withdrawal confirmations), we send through Resend via Amazon SES. They may use first-party cookies or local storage tied to their embed if you load a Resend-hosted preview/unsubscribe page; we never embed their trackers in the platform UI.

Upstash Redis (rate limit / cache):Backend caching and per-endpoint rate limits run on Upstash Redis. Upstash does not set cookies in your browser. We mention this only for completeness so you understand the full set of services involved in platform operation.

Each third-party service has its own cookie and privacy policies that operate independently of this policy. We strongly encourage you to read the privacy policies of each respective third party to understand how your data is managed outside our infrastructure.

4. How to Manage Cookies

You have full control over cookies stored on your device. Every modern web browser provides settings that allow you to block, delete, or restrict certain cookies. Below are general guides for each browser:

Google Chrome:Go to Settings → Privacy and security → Cookies and other site data. Here you can block cookies from all sites, block third-party cookies only, or delete specific cookies from Daily Worker Hub. Use the "Block third-party cookies" option if you want to stay logged into our platform without accepting tracking cookies from other sites.

Mozilla Firefox:Go to Options → Privacy & Security → Cookies and Site Data. You can choose whether to accept all cookies, cookies from visited sites only, or block all cookies entirely. The "Delete cookies when Firefox is closed" option is very useful if you are using a shared device.

Safari:Go to Preferences → Privacy. Safari allows you to block all cookies or only third-party cookies. You can also delete all stored cookies through the "Manage Website Data" option.

Please note that disabling essential cookies will significantly impact platform functionality. For example, you will not be able to stay logged in, the Escrow System cannot verify transaction sessions, and fund deposits cannot be processed securely. For the best experience, we recommend accepting essential cookies from Daily Worker Hub while blocking third-party analytics and functional cookies if you are concerned about privacy.

5. Cookie Policy Updates

We periodically update this cookie policy whenever there are changes in our data collection practices, new third-party service integrations, or changes to applicable regulations in Indonesia — particularly the Personal Data Protection Law (UU PDP) which came into full effect in October 2024. Any significant changes will be communicated through multiple channels:

First, we will send an email notification to all users who have verified their accounts, explaining a summary of the key changes and the effective date of the new policy. Second, when you log in to the platform after the policy is updated, we will display a re-consent banner asking you to review and accept the latest policy before continuing use.

Third, for minor changes such as service name updates or editorial corrections, we will update the "Last updated" date at the top of this policy without requiring explicit re-consent. By continuing to use Daily Worker Hub services after notification of changes, you are deemed to have accepted the updated policy.

We strongly encourage you to periodically review this policy, especially before making large Escrow Fund transactions or connecting new payment methods to your Daily Worker Hub account. If you have any questions or concerns about our cookie policy, please contact our team through the Contact page available on the platform.