Privacy Policy

rift.page (rift.page) is run by Rift.page, in the United States. For anything about your privacy, contact ruibusiness@icloud.com.

When you create an account:

• Your email address, username and password. Your password is stored by our login provider as a one-way hash, so nobody (including us) can read it.
• If you turn on two-factor authentication: the fact that you use an authenticator app or email codes.

What you put on your page: your display name, bio, links, pronouns, location, images, videos, music and anything else you add. This is public: anyone who visits your page can see it.

If you log in with Google or Discord: that service tells us your account ID, email address (if you allow it), name and profile picture. We never see your password for that service. Logging in with Discord also connects your Discord ID to your page.

If you connect Discord: your Discord user ID, username and avatar (we only ask Discord for basic profile access). If you show live Discord status, your status, game or music activity is fetched while people view your page.

If you buy something: what you bought, the amount and when. Card details are handled entirely by Stripe and never reach our servers.

When anyone visits a rift.page page: we record a view or link click for the page owner's analytics. Each record holds:

• a random visitor ID from a cookie, which we scramble (hash) before storing,
• your country (worked out from network headers or your browser's language; we don't store your IP address with it),
• your device type (mobile, tablet or desktop), the site or link that sent you, and the time.

Security information: to stop abuse, our servers briefly use your IP address and browser details (for example to limit login attempts). This is held in memory for a short time and not stored with your account.

• To run rift.page: creating your account, logging you in, hosting and showing your page, and sending confirmation, password-reset and login-code emails or texts.
• To process purchases and keep records for tax and accounting.
• To keep rift.page safe: bot checks, limiting login attempts, and detecting and stopping spam, abuse and fraud, and enforcing our Terms.
• To show page owners how their page is doing: view and click counts by country, device and source, shown as totals. Page owners can't see who you are.
• To meet legal obligations and respond to lawful requests.

We don't sell your personal information, and we don't "share" it for cross-context behavioral (targeted) advertising. We don't use it to build advertising profiles.

We use service providers to run rift.page. They only get what they need to do their job and are not allowed to use it for anything else:

Pages can also show content you link to from other sites (for example images, music or videos hosted elsewhere). When someone views your page, their browser loads that content from those sites, which have their own privacy policies.

We may also disclose information if the law requires it, to protect people from harm, or as part of a merger, sale or transfer of rift.page (in which case this policy will still apply to your information).

We use a small number of first-party cookies. We don't use advertising cookies or track you across other websites.

You can block or delete cookies in your browser settings. Blocking the essential ones will stop you logging in. Blocking vid has no effect on how the site works.

Because we don't sell personal information or use it for targeted advertising, there's nothing to opt out of through "Do Not Track" or Global Privacy Control signals, but you're welcome to use them.

• Your account and page: until you delete them. Deleting your account (Settings → Danger zone) removes your login, pages, links, uploaded files and their analytics. If someone else is using one of your files through a public template you shared, that file stays while they use it.
• Analytics: kept while the page they belong to exists, and deleted with it.
• Payment records: our copy is deleted with your account. Stripe keeps its own record of each transaction, which we use for tax and accounting for as long as the law requires (generally up to 7 years).
• Two-factor login records: up to 90 days.
• Security data (like login attempt counts): minutes to hours, in memory only.
• Backups: deleted information may stay in backups for up to 30 days before it's overwritten.

• Passwords are hashed, and new passwords are checked against known data breaches.
• Optional two-factor authentication by authenticator app or email.
• Bot checks, login attempt limits and account lockouts against password-guessing.
• Encrypted connections (HTTPS) everywhere, and secure, HTTP-only cookies.
• Changing your password signs you out on every other device.

No system is perfectly secure. If we learn of a breach that affects your information, we'll notify you as required by law.

Anyone can, at any time:

• see and change their account details and page in the dashboard,
• delete their account in Settings → Danger zone,
• disconnect Discord, and turn two-factor on or off.

State privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws), you may have the right to:

• know and access the personal information we hold about you, and get a copy in a portable format,
• correct inaccurate information,
• delete your information,
• opt out of the sale of personal information, sharing for targeted advertising, or profiling (we don't do any of these),
• not be discriminated against for using these rights, and
• appeal if we decline your request.

To make a request, contact ruibusiness@icloud.com. We'll confirm it's really you (usually by asking you to confirm from your account email) and respond within 45 days. You can use an authorized agent; we'll ask for proof they can act for you. To appeal a decision, reply to our response with "Appeal" and we'll review it within 45 days. If you're still unhappy, you can contact your state Attorney General.

California "Shine the Light": we don't disclose personal information to third parties for their own direct marketing.

rift.page is not for children under 13, and we don't knowingly collect personal information from them, in line with the Children's Online Privacy Protection Act (COPPA). If we learn that a child under 13 has created an account, we'll delete it. If you believe this has happened, contact ruibusiness@icloud.com.

rift.page is run from the United States, and our providers may process information in the US and other countries. If you use rift.page from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those where you live.

If we make material changes, we'll update the date at the top and tell you by email or on the site before the change takes effect.