Privacy Policy

Last updated: 2026

What we collect

• Your username, and — depending on which way you set up your account — a password (stored as a salted Argon2id hash — we never see or store your plaintext password), a mobile phone number, or both. A phone number is never required: you can create and use an account with just a username and password. If you do link a phone, it's encrypted at rest, used to verify you're a real person and to log you in, and never shown to other members.
• An optional recovery email, encrypted at rest, used only for account recovery.
• Profile information you choose to add.
• Photos you upload — automatically stripped of EXIF and GPS metadata before storage.

Server & traffic logs

Our web server records every request it handles — including your IP address, browser user agent, the page requested, and the referring page, if any — for security and for traffic statistics (for example, telling human visitors apart from search-engine and AI-assistant crawlers, and seeing which pages get read). These records are kept for 90 days and then automatically deleted, are visible only to site administrators, and are never sold or shared with anyone.

Login & device security records

Every time you sign up, log in, or verify a text code — successful or not — we record a security event, including your IP address, the outcome, an approximate location from our own offline location database (never a third-party lookup — IP geolocation by DB-IP), your browser and device type, and a coarse device fingerprint. If you're logged in, we also keep your IP address on your session record (so we can show you your own active sessions and flag an unfamiliar one), along with your device's approximate time zone and screen size, sent directly from your browser to us and nowhere else. Your IP address is stored in the clear on these security records — the same as on the traffic logs above — not as a hash; every other record on rubmeet that mentions an IP address stores only a one-way salted hash that rotates daily and cannot be reversed back to it.

This is collected solely for account security, fraud prevention, and scam/spam detection — it is never shown to other members and never used for advertising. Only site administrators investigating abuse, fraud, or a security incident can see it, and every time an administrator looks up your phone number that access is itself logged. Login-event records are automatically deleted after a set retention period (currently 180 days). A session record is kept for as long as that session is active (up to 30 days) or until you sign out or revoke it from Settings → Sessions.

If you choose to remember a device (so future logins skip the text-code step), we store a random token — not tied to your phone or password — that you can revoke at any time from Settings → Devices.

What we don't do

• No third-party analytics, ad trackers, or fonts. Nothing you do on rubmeet is shared with an ad network.
• No selling or renting of your data to anyone.
• No requirement to use your real name.

Who can see what

Your profile is visible to other members according to your own privacy settings (for example, blurring photos to non-members). Private messages are visible only to the sender and recipient, and to our moderation team if a message is reported or automatically flagged by our scam filter.

Retention

If you delete your account, we immediately erase your credentials, photos, and messages. Your username stays reserved (not reusable by anyone else) for 90 days before final removal, purely to prevent impersonation of a recently-deleted account.

Security

Passwords are hashed with Argon2id. Sessions use random, hashed tokens. All traffic is encrypted with HTTPS. We support optional two-factor authentication (TOTP) on every account.

Your choices

You can review and revoke active sessions and trusted devices, link, change, or remove your phone number, enable two-factor authentication, and delete your account at any time from Settings.

Contact

Privacy questions: see our Contact page.