Privacy Policy. What Reputii keeps, why, and how to have it removed.

Applies if you entered your email in the form on reputii.com.

What we collect

Three things: your email address, the time you signed up, and which version of the sign-up notice you saw. We don't ask for your name or anything else.

The website doesn't set cookies and doesn't use analytics. We don't store your IP address or browser details with your sign-up. Our hosting provider still handles your IP address to deliver the page and protect it from abuse (see Service providers).

How we use your information

To send you one email when Reputii opens. We don't use your address for anything else, we don't sell it, and we don't use it for advertising.

How long we keep your information

We delete your address after that one email is sent. If you ask us to remove it before then, we delete it when we receive your request.

Deleted entries can remain in our database provider's automatic recovery history for up to 7 days before they're gone. We may keep counts, such as how many people signed up, without any addresses.

Applies if you create an account at app.reputii.com.

What we collect and why

Email address

To identify your account and send sign-up and security emails. Your email address is stored encrypted and isn't shown to other people or on the operator's admin screens.

Sign-in details

A passkey's public key, or a password stored only as a one-way hash. If you turn on two-step sign-in, the authenticator secret and recovery codes (stored only as hashes). We never keep your password or recovery codes in readable form.

Display name (optional)

Shown only to people who are signed in, and only if you choose to show it.

Public trade ID

Created when you join, so others can find your token and trade. It is public.

Trade record

Tokens you issue, buy, hold and sell, in in-app units. This record is what Reputii is for. In-app units have no cash value and can't be cashed out.

Eligibility confirmation

When you sign up you confirm you live in the US or EU and are 18 or older. We keep only which version of that statement you confirmed and when. We don't collect your country, date of birth or ID.

IP address

We don't store your IP address. To limit abuse, such as repeated sign-in attempts, we keep short-lived counters in shared, hashed buckets and delete them within a few days.

Graphs and messages

You can make an imagined buy-and-sell graph about yourself or another member and attach short notes to points on it. These graphs are kept apart from the real market and have no cash value.

• Dates, buy or sell, and amounts on a graph are stored as they are. Notes, sealed notes and links you attach are stored encrypted.
• A version you send can't be edited. Only the person you send it to sees it. Only they can see whether they've read it.
• A graph is published only if both you and the person it's about agree, and either of you can withdraw it later.
• The operator's admin tools have no access to graphs or notes.
• You can delete drafts, unsent versions and graphs you haven't sent. A version you've already sent stays with the person who received it, even if you delete the graph or your account; your name is then removed from it.
• A graph someone else made about you is their information. You can hide it, block that person, or decline or withdraw publication.
• Sending graphs to people who don't have an account isn't available yet. We'll update this policy before it is.

Cookies

The app only uses cookies that are strictly necessary: one that keeps you signed in, and short-lived ones used during sign-in. We don't use advertising or analytics cookies.

Deleting your information

You can request deletion in the app's settings. If you can't sign in, use the deletion request page in the app: we'll send a code to the email address on your account. You can also write to privacy@reputii.com. Deletion takes effect after 7 days; if you sign in during that time, the request is cancelled.

When it takes effect, we delete your email address, your sign-in details and your display name (including past names).

Deleted information may remain in encrypted database backups for up to 90 days, until those backups expire. If we ever restore from a backup, we re-apply deletions so deleted information isn't brought back.

Some things remain. Your public trade ID and your trade record stay, because the long-term record is what Reputii is for and it's linked to other people's trades. We also keep a one-way hash of the deleted email address so it can't be used to sign up again; the address itself can't be recovered from it.

• Cloudflare hosts reputii.com and the database for website sign-ups, forwards email sent to our @reputii.com addresses, provides our domain's DNS, and protects the operator's admin access. It handles technical data such as IP addresses to deliver and protect these services.
• Amazon Web Services, in Ireland (EU), runs the Reputii app: its servers, database, file storage and delivery. Amazon SES, in the same region, sends the app's emails.

App data is stored in Ireland. The operator manages the service remotely from the Republic of Korea.

We don't sell personal information and don't share it with advertisers.

You can ask what information we hold about you, ask us to correct it, or ask us to delete it, within the limits described above. Write to privacy@reputii.com, from the email address you used if you can.

If we change this policy, we'll update the date at the top of this page.