Privacy Policy

What we collect

• From Google, when you sign in with Google (scopes openid email profile): your Google account ID, email address, name and profile photo URL. Your name and photo become your profile's display name and avatar, which you can change in Settings. Your email is never shown on the site.
• If you use handle sign-in instead: your handle and, if you set one, a passcode, stored only as a salted hash.
• What you add: your profile (handle, display name, bio, avatar), the films, TV, dishes and places you log, scores and score changes, notes and reviews, comparisons between entries, traits generated from your entries and your decisions on them, CSV files you import, and your visibility and research-consent settings.
• Sign-in records: when you signed in, and a session token.
• Server logs: our server's system logs may record technical details such as IP addresses and errors. They are used only to keep the service running and are rotated automatically.

We don't collect your location. Places are only what you choose to log.

How we use it

Only to run mybits: to sign you in, show your profile, entries and traits, and let others see what you've made public. We do not sell your data, show ads, or share it with advertisers or data brokers. Traits are currently generated on our own server with simple rules; if we ever send your entries to an AI provider for this, we will update this policy first.

Research consent is off by default. If you turn it on, it only records that you're open to anonymised research; any actual study will ask you again.

Google user data

mybits's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google account ID, email, name and photo only to sign you in and set up your profile. We don't transfer them to anyone else, use them for ads, or use them to train AI models, and no person reads them except when you ask for help, for security, or when the law requires it.

What others can see

• Profiles are public by default: anyone can see your public entries, scores, notes and accepted traits. You can make your profile unlisted (link only, not indexed) or private, and make any entry or note private.
• Draft traits are private until you accept them.
• Places on your profile map are rounded to city level (about 11 km); exact coordinates are never sent to visitors.

Other services

• Google handles Google sign-in. Your Google profile photo is loaded from Google's servers.
• TMDB provides film and TV data. Title searches are sent to TMDB from our server; posters are loaded by your browser from TMDB.
• OpenStreetMap / Nominatim provide place search and map tiles. Place searches are sent from our server; map tiles are loaded by your browser from tile.openstreetmap.org.
• Wikimedia Commons hosts dish and place photos, loaded by your browser.

When your browser loads images or map tiles from these services, they see your IP address, as with any website. We don't send them your account details.

Cookies

We use only what sign-in needs: a session cookie (dp_session, up to 30 days, removed when you sign out) and a short-lived cookie that protects the Google sign-in step (dp_oauth_google, 10 minutes). No analytics, advertising or tracking cookies.

Where it's stored and for how long

Data is stored on a server we rent from Contabo in the European Union. We keep your data while your account exists.

You can download everything you've added as JSON from Settings. Deleting your account in Settings permanently removes your profile, your Google sign-in link and email, sessions, entries, score history, comparisons and traits. Titles, dishes and places you added to the shared catalog may stay, but are no longer linked to you. We keep database backups on the server and on one separate private machine we control, only to recover from mistakes or failures. Backups are deleted on a rolling basis, so deleted data is gone from all of them within about two months.

Children

mybits is for adults (18+). It is not directed to children, and we don't knowingly collect data from anyone under 18. If you believe a child has an account, email us and we'll delete it.

Your rights and changes

You can see, correct, export and delete your data yourself in Settings, or email contact@hyperailab.com for anything else, including questions under data-protection laws such as the GDPR or Japan's APPI. If we change this policy, we'll update the date above and, for significant changes, tell you on the site.