Skip to content
Post a job
Home
This page is also available in: Čeština, Українська, Slovensky

How we protect your data

Updated: September 20, 2026

This page explains, in plain language, how we keep your personal data safe on FixIt. It's the companion to our Privacy Policy - the policy covers your legal rights, this page covers what we actually do day-to-day.

Developer or security researcher? See the technical detail page for an engineering-faithful walkthrough - concrete primitives, module paths, and falsifiable claims.

I. Verifying who you are

The verification method depends on your role and the process available in the app. We use Bank iD; if you do not hold an account with a bank connected to Bank iD, an authorized FixIt staff member verifies you on an online call by checking your identity document. We retain verified details and necessary supporting records to evidence identity and meet legal duties.

  • Bank iD - the Czech bank-based identity service. You sign in with your bank, the same way you would for online banking. We never see your banking credentials - only the verified result (name, date of birth, address, document number).
  • Verification on a call - an authorized FixIt staff member checks your identity document on a video call and records only the verified details (name, date of birth, address, document number). We do not store an image of the document.

Verification and signing have audit records. Verification materials, operational copies and employment documents have different retention periods according to purpose and legal duties. See the Privacy Policy and worker information.

II. Signing in and your devices

Sign-in supports one-time email codes and other methods available in the app, such as Google, Apple and passkeys. Worker identity verification is a separate step and is not the same as signing into an account.

Sign-in uses short-lived access tokens and refresh tokens. A refresh token changes when the session is refreshed, not on every request. We store its cryptographic hash in the database; the replacement token is also held briefly in a server cache to recover from interrupted connections.

Sessions expire on their own. After 14 days of inactivity (or 1 year of continuous use), you're signed out automatically.

Session protection. Suspicious reuse of a refresh token invalidates the affected session. The system allows a short retry after connection loss so that an ordinary network failure does not sign you out. Other independent sign-ins are not automatically terminated; you can end them in the device list.

Your active devices. Open Account → Sign-in to see every device currently signed into your FixIt account, when it was last active and roughly where it was used. You can sign out a single device, or all of them at once.

III. Files and documents

Private documents are held in non-public storage. Access is controlled by user permissions; we use temporary signed links to deliver them. Public profile and listing images are intended for publication. Once a recipient has obtained a file or link, it should not be treated as protection against further copying.

We also enforce who is allowed to see what:

  1. Public images - available on public profiles and listings.
  2. Job documents - access depends on participation in the job and the document type.
  3. Company and employment documents - access depends on membership, role and the document's purpose.

Authorized FixIt staff can access necessary data for support, disputes or statutory duties.

IV. Encryption in transit and of selected data at rest

In transit. Public website and app interfaces use HTTPS/TLS to protect data in transit.

At rest. We encrypt selected sensitive data, such as birth numbers and payroll bank accounts, at application level using AES-256-GCM. This is not a claim that every file or the entire database disk uses the same encryption.

Content and links. The app validates inputs and permissions, renders user content safely and restricts server-side link fetching. These measures reduce risk; they do not guarantee that every submitted file or link is harmless.

V. Privacy rights and contacts

FixIt.app s.r.o. is the controller of your personal data under the GDPR. Our Privacy Policy explains your rights - access, correction, deletion, portability - and how to exercise them.

Found a security issue? Email security@fixit.app with steps to verify it. We assess reports according to severity; please coordinate publication with us so we can protect affected users.

Questions about this security description can be sent to security@fixit.app.

Home