What we know about you.

Lord Denning would be proud of this one too. Short version: we collect as little as we can get away with, there's no tracking, and we don't sell anything to anyone.

Last updated 23 September 2026

Who we are

rabbithole is run from the UK, and we're responsible for the personal data described here. Contact: hello@the-rabbit-hole.app.

What we collect

• Your account: email address and username. Your password is handled by Amazon Cognito and we never see it.
• Your profile: your bio, if you write one.
• What you write: drafts and published rabbit holes.
• What you do: which rabbit holes you upvote, who you follow, and anything you flag.
• Server logs: our hosting provider records things like IP addresses and browser details when pages are requested. We use these to keep the site working and secure.

What's public

Published rabbit holes, your username, your bio and your follower counts are visible to anyone. Drafts, your email address, and which holes you've upvoted are not.

Why we use it

• To run your account, publish what you write, and send the emails the service needs, like sign-up codes and a welcome email. The legal basis is that we need it to provide the service you signed up for.
• To deal with reports, stop abuse and keep the site secure. The legal basis is our legitimate interest in running a safe site.
• To meet legal obligations, if we ever have to.

If we ever send anything like a newsletter or digest, we'll ask first and you can turn it off.

What we don't do

No adverts, no analytics, no tracking pixels, no selling or sharing your data for marketing. We'd rather not know what you do on other websites.

Who else handles it

A few companies run parts of the site for us and only use your data to do that:

• Amazon Web Services: hosting, sign-in and verification emails. Based in London (eu-west-2), with pages cached on servers worldwide.
• Neon: our database, in London.
• Resend: sends our welcome emails. Resend is based in the US, so your email address and username may be processed there under the safeguards UK law requires for international transfers.
• Cloudflare: our domain, and forwarding for emails you send to hello@the-rabbit-hole.app.

Cookies

We set two cookies when you sign in, rh-token and rh-access. They keep you signed in and are removed when you sign out. We also save your light or dark mode choice in your browser as rh-dark. All of these are strictly necessary or things you chose, which is why there's no cookie banner. There are no third-party cookies.

How long we keep it

We keep your data for as long as you have an account. If you ask us to delete your account, we'll delete it along with your rabbit holes, drafts, upvotes, follows and flags within 30 days. Server logs are kept for a short time and then deleted automatically.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a format you can take elsewhere. Email hello@the-rabbit-hole.appfrom your account address and we'll reply within a month.

If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to sort it out first, though.

Children

rabbithole isn't for anyone under 13, and we don't knowingly collect their data.

Changes

If this policy changes we'll update the date at the top, and email you if it's significant.