Privacy Policy

The short version

We store your email address so you can sign in, whatever you choose to put on your profile, and the lists you save. We count a few things to see whether the product works. We do not sell your data, we do not advertise to you, and we do not track you around other websites.

What we collect

Your account. Your email address, and your password stored as a one-way hash — we cannot read it, and neither can anyone who reaches the database. If you sign in with Google we store the connection to that account and whatever name and picture Google gives us, and there is no password at all. We also record whether you said yes to occasional product email.

Your profile. Your username, and the display name, bio, expertise tags and picture you choose to add. All of this is public: it is what appears on your curator page.

What you save. Your lists and the items in them, the notes you write, and each list’s visibility. Private lists are visible only to you. Unlisted lists are reachable by anyone holding the link. Public lists are open to everyone and may be indexed by search engines.

A little usage data. We record when a shared list is opened, and when someone taps Save or makes their own version. Each record holds the event, the list, and either your account or a random visitor id — never an IP address, a location, or which page you came from.

Ordinary technical logs. Our hosting and database providers keep the usual server logs. We also count sign-up and password-reset attempts against your email address for a short window, so the forms cannot be hammered.

Cookies

ReccoBox sets two cookies, both first-party. Neither follows you to other sites.

• A sign-in cookie, which keeps you logged in. It is removed when you sign out.
• A visitor id (rb_visitor) — a random number and nothing else, so that opening a list and then saving it counts as one person rather than two. It lasts a year, and it is not linked to anything about you until you make an account.

On the live site we also load Google Tag Manager, which places Google’s own analytics cookies. It is not loaded on preview or development builds. You can block cookies in your browser; the sign-in one is the only one the site needs to work.

Why we are allowed to hold it

Where the law asks us to name a reason: your account and your lists we hold to give you the service you asked for; the usage counting, the rate limits and the security logs we hold because we have a legitimate interest in knowing whether the product works and in keeping it safe; product email we send only if you agreed, and you can withdraw that at any time.

Who else sees it

We do not sell or rent your data, and we do not share it for advertising. We use a small number of companies to run the service, and they only ever handle data on our instructions:

• Supabase — the database and image storage, where your account, profile and lists live.
• Vercel — hosting. It serves every page and keeps request logs.
• Resend — sends the two emails we send: a verification code, and a password reset link.
• Google — Sign in with Google, if you use it, and Google Tag Manager and Analytics on the live site.

These companies run servers in several countries, so your data may be stored or processed outside the country you live in. We also disclose data where the law requires it, and to protect the service or someone’s safety.

How long we keep it

Your account and your lists stay until you delete them. A verification code is good for 10 minutes and a password reset link for one hour; the record is deleted the moment it is used, and replaced whenever a new one is requested. Rate-limit counters clear within the hour. Usage records are kept while they are useful for understanding the product, and they say almost nothing about a person on their own.

Your choices

Most of it you can do yourself, from your settings: change your username, edit or clear your profile, remove your picture, change a list’s visibility, or delete a list.

Beyond that, wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to it — and to stop product email, which you can also do from the link in the email. Write to hello@reccobox.com and we will answer within 30 days. We may need to check it is really you before we act.

Deleting your account removes your profile, your lists and your items. Two things it cannot undo: a copy someone else made of a list while it was public, and pages already cached by search engines, which fall out of the index on their own timetable. We may also keep a minimal record where we are legally required to.

If you think we have handled your data badly, please tell us first — and you also have the right to complain to the data protection authority where you live.

Children

ReccoBox is not for children under 13. We do not knowingly collect anything about them, and we will delete such an account if we find one.

Security

Passwords are hashed and never stored in a readable form. Access to lists is enforced by the database itself rather than only by the app, so a private list stays private even if a page asks the wrong question. Verification codes, reset links and secrets are kept out of our logs. No service is perfectly secure, and we will not pretend otherwise — if something happens that affects you, we will tell you.

Found a weakness? Please report it to hello@reccobox.com before telling anyone else.

Usernames and removals

Your username and your profile are public by design, and we may change, reclaim or block a username, or remove content, in the circumstances set out in our Terms & Conditions.

Changes to this policy

The date at the top says when this last changed. If we change something that matters, we will say so on the site or by email rather than quietly editing the page.

Contact

Any question about your data, or to make one of the requests above: hello@reccobox.com.