Privacy Policy

1. Introduction

RateMyFeet ("we", "our", "the Platform") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our service. By using RateMyFeet, you agree to the practices described in this policy.

The data controller is the publisher of RateMyFeet, a private individual (see the Legal Notice at the end of our Terms). For anything about your personal data, write to privacy@ratemyfeet.io.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address and password (stored in hashed form). A random username is generated for you, which you can customize later along with an optional avatar and bio.

2.2 Content You Upload

When you upload a photo or a video, we store the file, its title, a unique file hash (used for duplicate detection), and metadata such as upload date and moderation status.

2.3 Usage Data

We collect data about how you interact with the Platform, including: pages viewed, content viewed, votes cast, creators followed, search queries, and your timezone (stored via a cookie for localized date display).

2.4 Automatically Collected Data

We use Vercel Analytics and Vercel Speed Insights to collect anonymized usage and performance metrics. These services do not use cookies and do not collect personally identifiable information.

2.5 Subscription Data

When you ask a creator for access to her backroom, we store the request and its status, the creator it concerns, the price and currency at the moment you asked, the reference we generated, the dates that matter (asked, accepted or refused, payment declared, confirmed, access end) and a record of every decision with its author and its reason. We never see or store your payment details: the payment happens outside the Platform.

2.6 Backroom Data

Inside a backroom we store what you publish and what you write: photos, videos, stories, comments and replies, and the hearts you give. We record which stories you viewed, so that a creator can be told how many people saw each of hers, and we journal every opening of a backroom gallery by the operator.

2.7 Messages

When you use messages, we store what you write (text only), when it was sent, edited and read, the reactions you give, the requests you open, accept, delete or cancel, and the members you block, with the date of each Block. To apply the rules of the Terms, every message goes through a filter when it is sent and when it is edited; a refused message is not stored. The filter runs on our own servers, and no third party reads your messages. The operator reads a conversation only through the copy a report froze, or when the law requires it.

2.8 Privacy Settings

We store whether you turned messages off, and since when. If you allow RateMyFeet to feature your posts, we store the date you gave that consent, and we clear it if you take it back; while it stands, your public posts may be shared on our Instagram and X accounts, credited to your username.

2.9 Custom Content

When you order custom content, we store your order and its status, the offer as you saw it (its title, line, price, currency, delay and pack), what you asked for, the dates that matter (ordered, delivered, payment declared, confirmed, expired) and a record of every decision with its author and its reason. Each order also records, with its date, that you confirmed being 18 or older. When a creator delivers, we store her files, her note, the length of each video and the state of its encoding. Her files sit in the same private storage as her backroom and are served through links that expire.

3. How We Use Your Information

• Provide the service: Display your content, calculate rankings, enable community interactions (voting, following), and open a backroom to the subscribers who paid for it.
• Content moderation: Look at what is published, backroom galleries included, so that the rules are held, and record the reports you send us. No automated analysis is run on your uploads, in public or in a backroom.
• Improve the Platform: Understand usage patterns, optimize performance, and develop new features.
• Security: Detect and prevent abuse, spam, and unauthorized access.
• Communication: Send important service-related notifications (e.g., account issues, policy changes) and, unless you unsubscribe, emails about your messages: a request accepted, unread messages at most once a day, requests waiting at most once a week. These emails name who wrote, never what they wrote.
• Legal bases: We process your data to provide the service you signed up for (your account, your posts, your subscriptions, your messages, your custom content orders); on our legitimate interest in keeping the Platform safe, moderating it and measuring its audience; on your consent where we ask for it (featuring your posts on our social accounts); and to comply with the law.

4. Data Processing & Storage

Your data is processed and stored using the following third-party services:

• Supabase: Handles authentication and file storage. Data may be hosted in the EU or US depending on infrastructure availability.
• Supabase Realtime: Tells your open pages that one of your conversations changed, so new messages appear without reloading. It carries a signal and the identifier of the conversation, never the content of a message.
• PostgreSQL (via Supabase): Stores account data, content metadata, votes, and interaction records.
• Google Sign-In: Optional. If you choose to sign in with Google, Google tells us your email address and confirms that the account is yours; we ask for nothing else and never receive your Google password. Your name and profile picture are not used on RateMyFeet: your public username is one you choose yourself. Google learns that you signed in to RateMyFeet, so if you would rather it did not, use the email and password route instead. Signing in with Google is never required, and you can go back to a password at any time by resetting it.
• Bunny.net: Delivers and encodes the media of the Platform, the photos, videos and stories of a backroom included. Files are served through links that expire; Bunny receives the request that fetches a file, never your account data.
• Resend: Sends the emails of the Platform: your account, your messages, your subscriptions and your custom content orders. It receives your email address and the content of each email we send you, never your password.
• Vercel: Hosts the Platform and provides anonymized analytics.
• Microsoft Clarity: Provides usage analytics and session replay (recordings of page interactions) to help us understand and improve the experience. When you are signed in, your username is attached to your session so we can trace behaviour back to your account for support and abuse prevention. Operated by Microsoft in the United States.
• Creator payment services: A creator lists her own payment services (a transfer, a payment link) on the instructions page. The payment goes through that service, outside the Platform, under its own terms and privacy policy. We receive no bank details, no card number and no confirmation from it: only your declaration that you paid, and the creator's confirmation.

5. Cookies & Local Storage

We use minimal cookies and browser storage:

• Session cookies: Essential for authentication. These keep you signed in.
• Timezone cookie: Stores your timezone to display dates in your local time.
• Anonymous identifier: A random identifier kept for a year, so that a vote or a view counts once even when you are not signed in. It is not linked to your identity.
• Preference cookies: Remember the language you chose and that you opened the feed without an account, so the site does not ask you again.
• Local storage: Stores UI preferences and interaction states (votes, reports) for a smoother experience.

We do not use advertising cookies. Our analytics provider (Microsoft Clarity) sets cookies to measure usage and replay sessions, as described in Data Processing above.

6. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with the third-party services listed in Section 4, strictly for the purposes described in this policy.

We may disclose your information if required by law or to protect the rights, safety, or property of RateMyFeet, our users, or the public.

7. Subscriptions & Discretion

A subscription is seen by three parties and nobody else: you, the creator you asked (who sees your username, your public avatar, the age of your account, the reference and the amount of your request), and the Platform's operator, who reads the same data and the record of decisions when a dispute has to be settled.

We never publish who subscribes to whom. No page, ranking, statistic or notification reveals the link between a visitor and a creator, and the subscription pages are never indexed, cached or recorded by our analytics tools.

Inside a backroom, the other subscribers see you under an alias drawn for that backroom alone, never your username; the creator sees your username. A heart you give is counted and never attributed, to her or to anyone.

Custom content is seen by the same three parties: the fan who ordered it, the creator who made it, and the Platform's operator, who may inspect a delivery to answer a report or settle a dispute, and journals each inspection. The fan sees the files only once the creator has confirmed his payment; before that, he sees what the delivery holds and her note. Nothing about an order or a delivery is ever public.

8. Data Retention

We retain your account data and content for as long as your account is active. If you delete your account, we will remove your personal data and uploaded content within 30 days. Some anonymized usage data (e.g., aggregated analytics) may be retained indefinitely.

Three things outlive that rule. A declared payment blocks the deletion of the accounts it concerns until the case is settled, thirty-seven days at most, because deleting one would take the history the case is judged on. The file of a story is kept thirty days after it disappears, and longer if it has been pulled out of sale, so that an inspection made in that window can still see it. The journal of the operator openings of a backroom is kept as the record of what was inspected and when.

Subscription data, the record of decisions included, is kept as long as the accounts it concerns exist, and is deleted with them, within the same thirty days as the rest of your data.

Messages are kept as long as both accounts of a conversation exist. Deleting a conversation hides it from you alone. Deleting your account deletes your conversations, your messages, your reactions and your Blocks, within the same thirty days. The copy frozen by a report outlives the deletion of either account: it is kept as long as the report and our legal obligations require.

A delivery left unpaid is deleted thirty days after the order expired or was closed by arbitration, its files first; the files of an order closed before anything was delivered are deleted at once. A paid delivery is kept as long as both accounts exist. Deleting your account deletes the custom content you ordered and the custom content you delivered, files included, within the same thirty days. A file withdrawn by moderation is kept as long as its review requires.

9. Your Rights (GDPR & EU Residents)

If you are located in the European Union, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing of your data for certain purposes.
• Right to restriction: Request limitation of processing in certain circumstances.

To exercise any of these rights, contact us at privacy@ratemyfeet.io. We will respond within 30 days.

You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of the country where you live.

10. Children's Privacy

RateMyFeet is not intended for anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has created an account, we will take steps to terminate the account and delete the associated data.

11. International Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws, including Standard Contractual Clauses (SCCs) where required.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the revised policy on this page and updating the "Last updated" date. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

13. Contact

For any questions or concerns about this Privacy Policy or your personal data, contact us at privacy@ratemyfeet.io.