Privacy Policy

What we collect

Data	Why
Username, email address, password	To run your account. Passwords are stored only as a salted hash; we can't read them.
Your page content and uploads	To show your page. Everything on your page is public by design.
Discord user ID (if you add it)	To show your live Discord status on your page.
IP addresses	To protect the site from attacks and abuse (rate limits and blocks), and to count each visitor once per day. View counting uses a one-way hash that's reset daily.
Purchase records	To apply what you bought and handle billing questions. Card details go straight to Stripe; we only see what you bought, when, and the last details Stripe shares (like the email on the receipt).
Account activity	An internal log of account actions (sign-ups, username changes, purchases, badge changes) used by staff to fix problems and stop abuse.

Cookies and storage

We use one cookie, rb_session, to keep you logged in. The dashboard also remembers small preferences in your browser (like your last open tab and preview size). We don't use advertising or analytics cookies.

Services we rely on

PebbleHost hosts the site and its database.
Cloudflare R2 stores uploaded files (avatars, backgrounds, music) and delivers them to visitors.
Stripe processes payments.
Discord: our bot reads the presence of people in the ReBio server who added their ID, and staff receive the activity log in a private Discord channel. Lanyard may be used as a backup for presence.
Google Fonts serves the fonts on pages, so Google sees your IP address when fonts load.
We look up which network an IP address belongs to using a public IP-to-network database stored on our own server; no data is sent out for this.

Who can see what

Your page (name, bio, uploads, links, badges, view count if shown, and Discord status if enabled) is public. Your email, password hash, IP addresses and purchase history are private and only accessible to ReBio staff when needed to run the service.

How long we keep it

Account and page data: until you delete your account.
Daily view-count hashes: reset every day; per-day view totals kept for 60 days.
Security blocks: removed automatically when they expire.
Activity log: the most recent 1,000 entries.
Purchase records: as long as needed for accounting and disputes.

Your choices and rights

Edit or remove anything on your page at any time.
Delete your account in Settings; your page, uploads and presets are deleted.
Ask us for a copy of your data, or for it to be corrected or erased. Depending on where you live (for example the EU, UK or California) you may have further rights, and you can complain to your local data protection authority.

Children

ReBio isn't meant for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has an account, contact us and we'll remove it.

Changes

We'll update this page when what we do changes, and change the date at the top.