Rebornly Website Privacy Policy (rebornlyapp.com)
1. Who we are
Rebornly is a new app for people who collect and make reborn dolls. This policy explains what personal data we handle when you visit rebornlyapp.com, sign up for the beta there, or use the beta forum there.
The controller of your personal data is Therese Fors, sole trader, trading as Rebornly ("Rebornly", "we", "us").
You can contact us about privacy at support@rebornlyapp.com.
2. The beta sign-up form
What we collect
If you fill in the form to join the beta, we collect:
- your email address;
- your name;
- your activity level in the reborn community — one of "New in the community", "Active sometimes", "Very active" or "Artist or sculptor";
- a message, only if you choose to write one;
- your confirmation that you are 18 or older;
- which version of this policy was in force when you signed up, and when you signed up.
We do not ask for, and ask you not to write in the message, anything sensitive, such as information about your health.
Why, and our legal basis
We use this information only to:
- invite you to the Rebornly beta, and
- tell you about Rebornly's launch.
An invitation to the beta may include access to the beta forum (section 2a).
Our legal basis is your consent (Article 6(1)(a) GDPR), which you give by ticking the box on the form. You can withdraw it at any time by emailing support@rebornlyapp.com; we then delete your sign-up. Withdrawing does not affect what we did before.
We do not use your sign-up for advertising, we do not sell it, and we do not use it to make automated decisions about you. We do not combine it with anything else, including a Rebornly app account you may create later with the same address.
Who can see it
Only the people at Rebornly who run the beta. Nobody signed in to the app can read it; the database lets it be read by no app user at all.
How long we keep it
We keep it while we send the beta invitations and the launch information, and at the latest 12 months after Rebornly launches. We then delete it ourselves: the deletion is done by hand, not by an automatic job, and the launch date is not set yet. If you withdraw your consent, we delete your sign-up when we handle your email.
If you sign up twice with the same address, we keep your first answers only.
2a. The beta forum
Who it is for
The beta forum at rebornlyapp.com/forum/ is a closed forum for people we invite, used only before and during the beta. Only an address we have invited can create a forum account.
What we store
- your email address, to invite you and to send your sign-in codes;
- the name you choose for the forum;
- your confirmation that you are 18 or older, and which version of the forum rules you accepted, and when;
- what you write: threads, replies and edits;
- reports you send about posts — whether a post breaks the forum rules or is illegal, your explanation, and for illegal content your name (unless the report concerns child sexual abuse material) and your statement of good faith — the decision on each, and reports others send about your posts;
- moderators' decisions about your posts or your account: what was restricted, the ground (a forum rule or the law), the facts, what the decision followed and when it was lifted; and a moderation log;
- your sign-in session: when you signed in, and the IP address and browser you signed in from;
- a security log of sign-in events kept by our sign-in service (for example when a code was sent or used), which names your email address and the IP address the request came from.
Notices sent by email
Anyone can tell us about illegal content in the forum by email. We then use the sender's name, email address and notice to handle it and to reply, because the law requires us to (Article 6(1)(c) GDPR, with the EU Digital Services Act), and we keep the email until the forum is deleted. If you sent a notice, a request under section 7 covers it. A notice someone else sent about you is kept until the forum is deleted; if you ask for a copy of your data, we give you its content without the sender's name or address.
Who sees it
Other members see your forum name and what you write. They never see your email address. The Rebornly team, as moderators, sees your email address and the reports. When you report a post, its author is not told who reported it. A post a moderator hides disappears for other members; you still see it, with the decision and its reasons.
Why, and our legal basis
To run the forum you joined (Article 6(1)(b) GDPR), and to keep it safe and moderate it (our legitimate interest, Article 6(1)(f) GDPR).
How long we keep it
You can delete your own posts at any time; the text is then gone. When the beta ends, the forum becomes read-only for 30 days and is then deleted completely, including every account, post, report and log.
You can ask us to delete your forum account earlier (section 7). We then delete your account, your sessions, the reports you made and the sign-in log entries that name you; we wipe what you wrote; and we remove your address and our reasons about you from the moderation log and our decisions. Replies others wrote stay, and so do reports others made about your posts: the law requires us to tell them our decision, so an open one is decided then, as the post having been removed.
3. Anonymous counting
We count three things on the website, as totals per day:
- how many visits arrive through a link we have shared, and which link, by the
short name in the link's address (for example
?src=instagram); - how many times the beta form is opened;
- how many forms are sent and accepted.
These counts are anonymous. We store only the date, which of the three events happened, the link's short name for the first, and the number. We do not store your IP address, a cookie, a device or browser identifier, or anything that could tell one visitor from another, and a count is never linked to a sign-up. Counts are not personal data.
4. Technical data when you use the website
To send the page and receive the form, your browser necessarily sends us your IP address and ordinary technical information (such as the browser type).
- Our server function that receives the form uses a one-way hash of your IP address to stop the same connection sending too many forms. The hash is kept only in the working memory of the running function, only counts while it is less than ten minutes old, and is gone when the function stops. It is never written to storage or to a log.
- Technical request logs. When the website contacts our servers — when the form is opened or sent, when you use the beta forum, or when you use a password-reset link from one of our emails — Supabase automatically records technical details of the request: your IP address and the approximate country or region derived from it, your browser (user agent), the time, which service was called and whether it succeeded. When you set a new password through a reset link, or use the beta forum while signed in, your account ID is also recorded. When you ask for a sign-in code for the forum, the email address the code is sent to is recorded as well. These logs do not contain what you type into the form or write in the forum. They are deleted automatically after 7 days.
- Hosting logs. The website is hosted on GitHub Pages, which logs visitors' IP addresses for security reasons. GitHub keeps these records itself (section 6).
Our legal basis for this is our legitimate interest in running a secure website and protecting the form and the forum from abuse (Article 6(1)(f) GDPR).
5. Cookies
Rebornly does not set analytics or marketing cookies. If you sign in to the beta forum, your browser keeps your sign-in session in its local storage so that you stay signed in; nothing else is stored on your device. See our Cookie Policy.
6. Service providers
| Provider | What it does for us | Where |
|---|---|---|
| GitHub (GitHub Pages) | Hosts the website | GitHub, Inc., USA |
| Supabase | Receives the form and stores the sign-ups and counts, and runs the beta forum in a separate project | AWS eu-central-1 (Frankfurt, Germany), EU |
| Resend | Sends the sign-in codes for the beta forum | Resend, Inc., USA |
Supabase and Resend process data only on our instructions. Supabase keeps daily backups of our databases, which are retained for 7 days. GitHub is responsible for its own records of visits to the website, as described below.
Our website
Our website, rebornlyapp.com, is hosted by GitHub (GitHub Pages). It is also the page that the links in our confirmation and password-reset emails open. When you visit it, GitHub records your IP address, the time, the page you visited and details of your browser, for its own security and to meet its legal obligations. We have no access to these records. GitHub decides how long it keeps them; see the GitHub Privacy Statement.
Transfers outside the EU/EEA
The sign-ups, the counts and the beta forum are stored in the Supabase region named in section 6. Some of our providers are based in the United States, and some data is processed there:
- Our website (GitHub Pages). When you visit rebornlyapp.com, including when you open a link in one of our emails, GitHub processes your visit in the United States.
- Supabase. Supabase Inc. is a US company. Your data is stored in the region named in section 6, but its staff and subprocessors may access it from outside the EU/EEA, for example to provide support or process technical logs.
- Resend. Resend, Inc. is a US company. Your email address and the sign-in email pass through its systems when a code is sent to you.
You can ask us for a copy of the safeguards we rely on, using the contact details in section 1.
7. Your rights
You have the right to:
- get a copy of the data we hold about you (access);
- have incorrect data corrected;
- have your data deleted;
- have its use restricted;
- receive your data in a machine-readable form (portability);
- withdraw your consent at any time.
Email support@rebornlyapp.com from the address you signed up with, or, for the beta forum, the address you were invited with.
You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or to the supervisory authority where you live.
8. Age
The beta and its forum are for adults. We ask you to confirm that you are 18 or older, and we do not knowingly collect sign-ups or forum accounts from anyone under 18. If you believe a child has signed up or joined the forum, tell us and we will delete it.
9. Security
The sign-ups are kept in a database that no app user or website visitor can read. They reach it only through one server function. That function accepts browser requests only when they present the Rebornly website as their origin, limits how often forms can be sent, and checks every answer before anything is stored. The connection is encrypted.
The beta forum's database can be read and written only through checked functions that let members see nothing but the forum itself. You sign in with a one-time code sent to your email address, and only an address we have invited can create a forum account.
10. Changes
If we change this policy we publish the new version here with its date. If a change affects how we use your sign-up, we ask for your consent again.
Back to the start page