Privacy Policy

Information we collect

Account information. Authentication is handled by Clerk. When you register we receive your email address, the username you choose, and a display name. If you sign in with Google, we receive the basic profile information Google returns — your name, email address, and profile picture. We never see your Google password.

Profile details you choose to add. Rybn lets you record optional details to help others buy for you: clothing and other sizes, preferences, vehicle details, personal details, and important dates. All of these are optional, and each carries its own visibility setting.

Content you create. Wishlist items, groups and their membership, group gifts and the messages sent in their chats, gift exchanges, tracked gifts and recipients, and invitations you send.

Images you upload. Wishlist and gift photos are held in private storage. They are not publicly browsable, and access is granted per request based on the same rules that govern the rest of your data.

Links you paste. When you paste a product URL into a wishlist item, our server fetches that page to read its title, price, description, and image so it can fill the form in for you. The request comes from our server, not your browser, and we store only the details that end up on the item.

Usage data. We use Vercel Analytics, which collects aggregate page-view data. It does not use cookies and does not build a profile of individual visitors.

How we use it

• To operate the app — showing your lists, groups, and gifts to the right people.
• To enforce visibility rules, which is the core of what Rybn does.
• To send transactional email: a welcome message, group invitations, and reminders about dates you have asked to be reminded of.
• To keep the service secure and diagnose problems.

We do not sell your personal information, and we do not use it for advertising.

Who can see your information inside Rybn

This is the part worth reading carefully. Visibility is enforced in the database itself, not merely hidden in the interface.

• Your wishlist items are visible to members of groups you share with.
• Optional profile fields carry per-field settings, and can be restricted to particular groups or group types.
• Group gift chats are visible to the participants of that gift — deliberately not to the person receiving it.
• Claiming a gift is hidden from the recipient, so the surprise survives.

Anyone you invite to a group will be able to see what that group's settings allow. Consider that before adding someone.

Service providers

We rely on a small number of providers, each of which processes data on our behalf:

• Clerk — accounts, sign-in, and session management.
• Supabase — the database and private file storage.
• Resend — delivery of transactional email.
• Vercel — hosting and aggregate analytics.
• Google — only if you choose to sign in with Google.

We may also disclose information if the law requires it, or where it is necessary to protect the rights and safety of our users.

Email preferences

You can control which emails you receive from your settings page — group invitations, date reminders, gift updates, and exchange notifications are each independently controlled. Marketing email is off unless you turn it on. Some messages, such as those needed to secure your account, are sent regardless.

Retention and deletion

We keep your information for as long as your account exists. When you delete your account, the data that belongs to you — profile, wishlists, gift records, and uploaded images — is deleted along with it. Messages you posted in a shared group chat may remain visible to that group, as removing them would tear holes in other people's conversations. To request deletion, contact us at the address below.

Security

Access rules are enforced by the database through row-level security, so a request that should not return your data does not return it, even if the interface asks for it. Traffic is encrypted in transit, and uploaded images live in private storage rather than public URLs. No system is perfectly secure, but the rules are enforced at the layer that holds the data rather than the layer that displays it.

Children

Rybn is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will remove it.

Changes

If this policy changes in a way that materially affects you, we will update the date at the top of this page and, where appropriate, tell you directly.

Contact

Questions about this policy, or about your data, can go to support@rybn.app.