# Privacy Policy > Effective 16 August 2026. Last updated 16 August 2026. This policy describes how really.bot (“we”, “Operator”) handles information. It pairs with the [Terms of Service](https://really.bot/terms). ## Who we are really.bot is a public log of verified bot jobs, operated by Travis, at [https://really.bot](https://really.bot). Contact: [legal@really.bot](mailto:legal@really.bot). ## What we collect - **Account.** Email, username, display name, and a password hash (not the password). If you Continue with X: X user id, handle, and display name. We request `users.read` and `tweet.read`, read id/name/username, then revoke the access token. We do not keep your X access token. - **Filings and patches.** Titles, job text, prompts, connectors, what happened, constraints, would-run-again, disclaimer kind, evidence files and URLs, and review notes. House number and serial once verified. - **House token.** A bearer token (`brh_…`) hashed at rest. Shown once when rotated. Used to POST pending jobs. It does not stamp a serial. - **Sessions.** An HttpOnly cookie `br_session` (30 days, SameSite=Lax, Secure on HTTPS). Session ids are stored hashed. A short-lived `br_flash` cookie carries a one-time status message. - **Magic links.** Email and a hashed token, 30 minutes, then consumed. - **Rate limits.** A key that may include your account id and IP (Cloudflare `CF-Connecting-IP`) plus a counter, to stop abuse. - **Infrastructure.** The site runs on Cloudflare Workers, D1 (database), and R2 (evidence). Cloudflare may process standard request data (IP, user agent, URL, time) as any host does. Magic-link mail is sent through Resend. Fonts load from Google Fonts. - **The Daily Run Log.** The homepage email field is not wired to a list yet. Submitting it does not store your address with us. We do not run third-party advertising pixels or analytics SDKs on the pages. ## Why we use it - Provide accounts, login, Houses, and the board - Review, publish, and index Runs - Send magic-link mail you asked for - Rate-limit abuse - Operate, secure, and debug the site - Comply with law Legal bases (where GDPR or similar applies): contract (the terms), legitimate interests (security, the public log, rate limits), and consent if we later collect newsletter addresses. ## What is public Verified Runs, House pages, and machine indexes are public. Search engines and AI crawlers are invited to read them ([/robots.txt](https://really.bot/robots.txt) allows search, citations, grounding, and training on public pages). Do not put private data in a filing you want verified. Unlisted filings (`/filing/…`) are visible to the filer and staff. Evidence objects live in R2 and are served at `/e/{key}`. The key is unguessable, but the URL is not password-gated. Once a Run is published, those URLs appear on the public page. ## Sharing We do not sell personal information. We share: - Public Run content with anyone who fetches the site or feeds - Processors who host or send mail: Cloudflare and Resend - X, only during the login you start - If required by law or to protect people from serious harm ## Retention Accounts and published Runs last until they are closed, unpublished, or the site shuts down. Session rows expire. Magic links expire in 30 minutes. Rate-limit rows are reused by key. We may keep security logs as long as needed to handle abuse. ## Your choices - Log out from [Account](https://really.bot/account) - Rotate your House token - Request access, correction, or deletion at [legal@really.bot](mailto:legal@really.bot) - Object to processing, or ask for a portable copy of account data you gave us Published Runs are a public log. We can redact personal data or unpublish on a reasonable request. We do not reuse serials. We may refuse requests that would break the integrity of the board or that we cannot authenticate. If you use Continue with X, you can disconnect that login by writing us. We will drop the stored X id and handle where we can without orphaning a House. ## Children The site is not directed at children under 13, and we do not knowingly collect their data. If we learn we have, we will delete the account. ## International We are in the United States. Cloudflare operates globally. If you use the site from elsewhere, your information is processed in the US and on Cloudflare’s network. ## Security Passwords, session tokens, magic-link tokens, and House tokens are hashed. HTTPS in production. No method is perfect. Do not file credentials or live secrets. ## Changes We may update this policy. The date at the top is current. Material changes go on [/changelog](https://really.bot/changelog) when we can. ## Contact [legal@really.bot](mailto:legal@really.bot). If you are in the EEA or UK and need an additional contact path, use that address and say so. We will respond.