Privacy Policy

This policy explains what personal data Rablem uses, why, for how long and what rights you have, in line with the General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

1. Who is responsible

The controller of your data is Rablem, identified in the Legal notice. For anything about your data, write to legal@rablem.com. Rablem has not appointed a data protection officer.

2. What data we use

Data you give us

• Account: username, display name (optional), email address and password. The password is stored only in scrambled form (hashed), never as plain text. If you sign in with Google, we receive your email address from Google, and we also store your Google account identifier and your name.
• Drafts: if you save a creation as a draft, we store its text, image and poll until you publish or delete it. Only you can see your drafts. They are deleted with your account, and so are their images.
• Polls: if you create a poll, we store its question, choices and length. If you vote, we store which choice you picked, only to count it and to make sure each person votes once. Votes are private: nobody can see who voted what, not even the author of the poll. Others only see the total of each choice. Your votes and the polls you created are deleted with your account, and the results of the polls you voted in are adjusted.
• Email address: it is required to create an account. We use it to identify your account, to make sure one email is not used for two accounts, and to contact you about your account or about your rights over your data. It is private: it never appears on your profile, in searches or in any public page, and only you can see it (in Settings, where you can change it). We do not use it for advertising. We send you a 6-digit code to verify it (we keep only a scrambled copy of the code, for 15 minutes) and a welcome email. We also store the language of your browser at sign-up, to write those emails in your language.
• Age and terms: when you sign up, you confirm that you are at least 14 years old and accept the Terms and this Policy; we store the date of that acceptance.
• Profile (optional): description, location, website, profile picture and header image. Other people can see these, together with your username and display name.
• Search engines: profiles are open to search engines such as Google, and we list them in our public sitemap. Search engines can show your display name, @username, description and profile picture, and nothing else: never your location, website, email, follower counts (even if you hid them), messages or creations. Your creations, replies, Spotlight, messages, notifications and settings are never open to search engines. Search engines may keep a copy of your profile until they refresh it, and you can ask them to remove it.
• Content: your creations and replies (text and images), including scheduled ones, and your direct messages (text and images). Messages are stored on our servers and are not end-to-end encrypted.
• Activity: who you follow and who follows you, your likes, saved and shared creations, notifications, and the settings you choose (such as Zen mode or who can message or reply to you).
• Knock code: every profile has a random 6-digit code. Anyone who knows it can send you one first message even if you do not follow each other. We keep it in two forms: a keyed hash (HMAC), used to check a code typed by a visitor without ever decrypting it, and an encrypted copy (AES-256-GCM, with a key held on our server) so that you, and only you, can see your code in Settings or on your profile. You can change it (a new random code replaces the old one) or turn Knock off, which deletes both copies. We also keep a record that a Knock was sent from one account to another (who, to whom, when and whether it was answered), which is never deleted when the code changes, and we use it only to apply the limit of one message per pair and the limit on attempts; and the message itself, like any direct message. Whoever has access to our database and to the encryption key could read the codes.
• Push notifications (only if you turn them on): for each device where you turn them on we store the address of your browser's push service (it identifies that browser for us), the two encryption keys your browser gives us so that only it can read what we send, and the dates it was added and last used (up to 10 devices per account). We also store which kinds of notification you want (new messages, Knocks, replies, mentions, new followers and likes; all on by default) and, to group them (for example “3 people liked your creation”), the time of the last push of each group. A push has a short title and text and never contains the text of a message: it only says who wrote. It travels encrypted through the push service of your browser's company (for example Google, Mozilla, Apple or Microsoft), which can see that something was delivered to your device but not what it says. You can turn it off at any time in Settings → Notifications.

Data used to recover and protect your account

• Password reset: when you ask for a code, we store a scrambled version of the code (never the code), how many times it was tried and when it was created and used. Codes expire after 15 minutes. We only use the email address of the account.
• Security emails: when the password, the email address, the username or two-factor authentication changes, we send an email with the date, an approximate browser and system taken from your browser's identification, and a “This wasn't me” button. We keep a scrambled version of the link's key, the address it was sent to and whether it was used, for the seven days it works. We do not keep your IP address or your location for this.
• Locks: when you press “This wasn't me” (or after a password reset), we keep the date until which sessions started before are refused, and the date the account was locked, until it is recovered.
• Limits on repeated requests: to stop automatic attempts (guessing passwords or codes, mass sign-ups, spam), we count how many times an action is made in a short period, for example signing in or sending a report. For this we store the kind of action, a counter and when the period starts and ends, together with a scrambled version (hash, made with a secret key of the server) of your IP address, your username or your account identifier. We never store the IP address itself for this, and the scrambled version cannot be turned back into it.
• Security check (captcha): to tell people from automatic programs, Rablem uses its own check, based on the open-source ALTCHA (MIT License) and running only on our server: no company outside Rablem takes part. It has no images and no tracking. What is processed is only the challenge (random numbers that our server signs) and its solution (a number that your device finds by calculation, with its own processor). Neither of them contains personal data, and the check sets no cookie and stores nothing in your browser. Our server keeps the random identifier of each solved challenge, and nothing else, for a few minutes, so the same solution cannot be used twice. The check runs by itself (nothing to click) when you sign up, ask for a password reset code, resend an email code or send a report. In other cases it only appears, as a small “Quick check” window, if something looks like abuse: several failed sign-ins for the same account or from the same IP in a few minutes, a sign-in from a network or browser the account has not used before, many follows, likes, saves or messages in a few minutes, or the same creation posted again and again. To decide that we count your recent actions, using data we already have, and the counters described in the previous point (keyed hashes, no IP address). When you solve the check, we remember it for 30 minutes (one hour for accounts less than a day old) with one more counter of that kind, so we do not ask again. To know which networks and browsers an account has signed in from, we store only keyed hashes of the IP address and of the kind of browser (without version numbers); they are deleted when the account is deleted and after 90 days without use.
• “My account was hacked” form: the username and original email of the account, a contact email, the date you lost access, what changed, your description and any evidence you attach. They are handled like any other report (see below), and a person checks them before anything changes on the account. We never ask for your password.

Data in the reports you send

Anyone can send a report from the Report center, with or without an account. For each report we store:

• What you tell us: the kind of report, the addresses (URLs) of the content, your description, the answers to the questions of that form (for example the rights holder and the work in a copyright report), the declarations you accepted, and your electronic signature when the form asks for one.
• Who you are: your name, email address, country, and your organisation and role if you give them, and on whose behalf you act. In child safety reports name and email are optional. If you were logged in, the report is linked to your account.
• Evidence files (optional): up to five images or PDF files. They are kept in a private storage area that cannot be opened from the internet. An identity document sent in an impersonation report is used only to check who is who.
• A keyed hash of your IP address (not the address), only to count how many reports come from the same place and stop abuse. It cannot be turned back into your IP address.
• The state of the report and its history (received, in review, action taken, no action, needs more information, closed), with the dates, and any message we leave for you.

We never ask for more than the form needs. Do not send us intimate images or material that shows children in sexual situations: the address of the content is enough.

Data created by using Rablem

• The date your account was created and the date of each creation, reply and message.
• A counter of views per creation. It is only a number that goes up by one when a creation stays visible on your screen for a second. It does not record who viewed it, your IP address or when. Your own views of your own creations are not counted (to know that, the server checks your session at that moment and does not save it). So that the same creation is not counted twice in the same tab, your browser keeps a marker (“viewed”, with the creation's identifier and the value 1) in its session storage; it is never sent to us and it disappears when you close the tab.
• A session cookie that keeps you logged in (see the Cookies Policy).
• Your cookie choices: the first time you visit (and again after 12 months or when the policy changes), Rablem asks you to accept or reject cookies by category. We keep your choice in a cookie, and if you have an account also in the account, so it applies on all your devices. To be able to show that you consented or withdrew, we keep a record of each choice: the date, the version of the policy, what you allowed in each category, whether it was given, changed or withdrawn, where you made it (banner, footer or Settings) and the random identifier of the cookie. The record has no IP address and no browser data. If you have an account, it is linked to it; if you delete your account, the record stays without that link.
• Measurement cookie (only if you allow “Measurement”): a random identifier with no meaning, in a Rablem cookie of 13 months, used to limit how often you see the same ad and to count impressions and clicks for the statistics advertisers see. It is not shared with anyone, and it is deleted as soon as you withdraw the consent.
• Technical data of each request, such as your IP address, browser and time, which our hosting provider, Vercel, processes to deliver the website and keep it secure. Rablem is hosted on Vercel, so Vercel sees your IP address in its server logs, which it keeps under its own policy. We also count requests per IP address in the server memory, only to slow down abuse; this count is not saved in our database.

We do not use third-party analytics or advertising tools, we do not share your data with advertising companies, we do not ask for your location or your contacts, and we do not make decisions about you only by automated means. Ads are chosen by country and language; only if you allow “Personalized ads” may they also use the interests, age, gender and activity in Rablem described in the Advertising Policies. You can say no and use Rablem in full.

3. Why we use it and on what legal basis

• To give you the service (create your account and identify it by its email, show your profile and creations, deliver replies and messages, send notifications, apply your settings): performance of the contract with you, article 6.1.b GDPR.
• To keep Rablem safe (prevent abuse, fraud and unauthorised access, limit repeated requests, run the security check (captcha), review reports and apply our rules, defend legal claims): our legitimate interest, article 6.1.f GDPR.
• To comply with the law (for example, to answer orders from authorities under the Digital Services Act): legal obligation, article 6.1.c GDPR.
• To handle the reports sent to the Report center (read them, ask for more information, decide, tell you the decision, let the other person answer a copyright or trademark notice, handle counter-notices and appeals, and keep a record): legal obligation, article 6.1.c GDPR, for the notices and complaints the Digital Services Act requires us to handle (articles 16, 17 and 20), and our legitimate interest, article 6.1.f GDPR, for the rest. The confirmation email is part of handling the report.
• To protect your account (limits on repeated requests, password reset codes, security emails, locking an account that someone else may be using, and reviewing “My account was hacked” reports): our legitimate interest in the security of the service and of your account, article 6.1.f GDPR, and the performance of the agreement with you, article 6.1.b GDPR.
• Strictly necessary cookies and storage (session, security, security check, remembering your cookie choice): they are needed to give you the service and to keep it safe, so they rest on the performance of the contract, article 6.1.b GDPR, and our legitimate interest, article 6.1.f GDPR. They are exempt from consent under article 22.2 LSSI-CE.
• Preferences, Measurement and Personalized ads: your consent, article 6.1.a GDPR and article 22.2 LSSI-CE. They are off until you turn them on, you can accept or reject them with the same ease, and you can withdraw your consent at any time from “Cookie settings” (at the bottom of the page and in Settings); withdrawing does not affect what was done before. Rablem works the same if you say no.
• To show that you consented or withdrew (the record of your cookie choices): legal obligation to be able to demonstrate consent, article 7.1 GDPR, and our legitimate interest in defending possible claims, article 6.1.f GDPR.
• Sign in with Google: it is your choice. We use the data Google sends us only to create and open your account.

Rablem is meant for people aged 14 or over. If you are under that age, do not create an account; if we learn that someone younger has one, we will delete it.

4. How long we keep it

• Account and profile: while your account exists. When it is closed, we delete it as explained below.
• Deactivated account: up to 30 days from the moment you deactivate it. During that time we keep all your data as it was, hidden from everybody, and we do not notify you of anything except the emails about the deactivation. If you reactivate it, it all comes back. If you do not, we delete it as explained below.
• Creations and replies: they stop being shown after 24 hours (48 if extended) or after 30 days in Spotlight, but they stay stored, and visible to you in your archive, until you delete them or close your account. When you delete a creation it is removed from our database, together with its replies, saves and shares.
• Messages: until you or the other person deletes the conversation (deleting it removes it for both) or until the account is closed.
• Notifications, likes and follows: while the account exists.
• Push subscriptions: until you turn push notifications off, you sign out on that device, the push service tells us the device no longer exists, or you delete your account. The time of the last push of each group is deleted automatically after one day.
• Counters of repeated requests: a few minutes to an hour, until their period ends; expired ones are deleted automatically soon after. This includes the counters of the security check: failed sign-ins (15 minutes) and the note that a Quick check was solved (30 minutes, or one hour for accounts less than a day old).
• Security check (captcha): the identifier of a solved challenge, about six minutes. The keyed hashes of the networks and browsers an account signed in from, until the account is deleted or 90 days pass without using them.
• Reports sent to the Report center: for as long as we need to handle them and any appeal, and then up to three years after the case is closed, so we can show what was decided and defend possible legal claims. The evidence files are deleted together with the report. An identity document sent in an impersonation report is deleted 30 days after the case is closed. A file that was uploaded but never attached to a report is deleted within a few days. If the person who sent a report deletes their account, the report stays, no longer linked to the account, for the same time.
• Cookie choices: the consent cookie lasts 12 months and the measurement cookie 13 months; both are deleted when you withdraw the consent (the consent cookie is replaced by your new choice). After 12 months, or if the cookies policy changes, we ask again. The record that proves your choices is kept for as long as it may be needed to show them, and with no link to an account once the account is deleted.
• Old username: if you change your username, we keep the old one reserved for 30 days, so nobody else can take it and pass for you, and its link redirects to your new one. After that it is released.
• Session: your login lasts at most one day. The temporary cookies used for Google sign-in last ten minutes.
• After you ask us to delete your data: we delete it from our database. For a limited time, some data may remain in security backup copies, and we may keep what we need to handle possible claims or to comply with a legal duty; after that it is destroyed.

5. Who receives your data and international transfers

• Other users, according to what you publish and your settings (see section 3 of the Terms of Service).
• Our providers, who process data on our behalf: Supabase (database and storage of images), Vercel (hosting of the website) and Resend (sending of the emails of your account, such as the verification code and the welcome email; its servers are in the European Union, in Ireland).
• The people who handle reports. Only the people at Rablem who review reports can read a report and its files. The user a report is about is never told who sent it, with one exception: in copyright and trademark notices and in counter-notices the law lets the other party answer, so we pass on the sender's name and email and the text of the notice, and nothing else (each of those forms says so before you send it).
• Wikidata, Wikipedia, X and Anthropic, when a username or a name is typed in the address bar, in Connect, in a message or when someone signs up. To know whether it belongs to a famous person (and to keep brands out, because Rablem is only for people), the text that was typed (a username or a name, never who typed it or your account data) is sent to Wikidata and Wikipedia (Wikimedia Foundation), to the X API and, only if those cannot tell, together with the public data of the matching X account, to Anthropic, which runs the AI model that helps to decide whether an account is a person or a brand. Each service acts under its own privacy policy. The answer is kept in our database so the same name is not asked twice.
• Google, only if you choose to sign in with it. Google acts under its own privacy policy.
• Search engines, which can index profiles. See the “Search engines” item in section 2 for what they can see. They act under their own privacy policies.
• Authorities, judges and courts, when the law requires it.

We do not sell your data. Our providers may process data outside the European Economic Area, including in the United States. When that happens, the transfer relies on the safeguards the GDPR accepts, such as the European Commission’s standard contractual clauses or an adequacy decision. You can ask us for more information about them at legal@rablem.com.

6. Your rights and how to use them

You have the right to:

• access your data and get a copy of it;
• correct data that is wrong (you can edit most of it from your profile);
• delete your data;
• restrict the use of your data, or object to it when it is based on our legitimate interest;
• receive the data you gave us in a common, machine-readable format (portability);
• withdraw any consent you have given, at any time, as easily as you gave it: use “Cookie settings” at the bottom of the page or in Settings → Privacy and safety.

You can delete your account and download a copy of your data yourself, at any time, in Settings → Your account. Deleting it removes your profile, creations, replies, messages, likes, saves, follows, blocks, notifications, the reports you made and your images. The reports other people made about you are kept without any link to your account, as the Digital Services Act record. The reports you sent through the Report center are kept, no longer linked to your account, for the time in section 4; you can ask us at legal@rablem.com to delete them earlier, and we will unless we need them for a legal obligation or a claim. The file you download in Settings includes your cookie choices and their record, and the reports you sent from the Report center (also those sent without logging in, if you used your verified email), with their state and history, but not the files you attached. To use any of the other rights, write to legal@rablem.com from the email linked to your account, or tell us your username so that we can check it is you. We will answer within one month, which can be extended by two more months if the request is complex, and it is free of charge.

Deactivating your account: in Settings → Your account you can deactivate it instead of deleting it. For 30 days your profile, creations, replies and mentions are hidden from everybody, your sessions are closed, and your follows are kept but do not count in other people's numbers; we keep your username and email reserved. We save the date and the number of deactivations (at most 3 a year) and we email you when you deactivate it, 3 days before the deletion and when you reactivate it. If you sign in within the 30 days you can reactivate your account; if you do not, it is deleted automatically as described above. The file you download in Settings includes the state and history of your deactivations.

If you think we are not treating your data properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, or with the authority of your country of residence. We would be grateful if you contact us first, so we can try to solve it.

7. Security

Passwords are stored hashed. The session cookie cannot be read by scripts on the page and is sent only over secure connections in production. We limit repeated login and sign-up attempts, and the counters are kept in our database with a scrambled version of the IP address, never the address itself. No system is completely safe; if a data breach puts your rights at risk, we will tell you and the AEPD as the law requires.

Two-factor authentication is optional. If you turn it on, we store the secret of your authenticator app encrypted, and your backup codes only in scrambled form (hashed); the codes are shown to you just once. Turning it on or off sends an email to your address. We also keep the last accepted code and a count of recent attempts, so a code cannot be used twice and guessing is limited.

If you forget your password, we send a six-digit code to the email of the account. It works for 15 minutes and for five tries, and the answer is the same whether the account exists or not. Changing the password this way, or from Settings, signs out your other devices. If you did not make a change, the “This wasn't me” button in the security email signs out every device, makes the password unusable and turns off changes to the account until you recover it; if you changed your email, the old address can use it for seven days. Rablem will never ask you for your password or a code by email, message or phone.

8. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will tell you through Rablem if a change is important.