How bitmutt handles your data

What this site asks you for and why, who else gets it, and what it keeps in your browser. It updates itself when the site changes, so it always says what the site does today.

Every page of this site

What it asks for, and why

Your IP address and browser details — Your browser sends them with every visit. The site uses them to show you its pages and to slow down floods of sign-ins and form posts; it does not keep them for that.

Who else gets it

Railway — Runs this site and keeps its database and its server logs. The logs record what the site did; email addresses and the messages you send are kept out of them.
Cloudflare — Stores the pictures and other files uploaded to this site. If the site is on a domain of its own, every visit to it passes through Cloudflare, which handles your IP address and browser details to deliver it securely.
Sentry — Receives a report when something on the server goes wrong, so it can be fixed: what went wrong, on which page, and your browser's details. Your browser also sends it a report if a page tries to load something it shouldn't. Email addresses are taken out before a report is sent.

Kept in your browser

Light or dark mode (a cookie) — Remembers your choice, if you switch it (1 year)
Form protection (a cookie) — Stops other websites from sending this site's forms in your name (until you close your browser)
Sign-in (cookies) — Keeps you signed in — only if you have an account here (until you close your browser, or with "Keep me signed in" until you go 7 days without visiting)
Two-step sign-in (a cookie) — Holds your place between your password and your code — only if you use two-step sign-in (5 minutes)

The people who run this site see what you send it, and so can the staff of the platform it is built on when they help run it. This site adds no analytics, trackers or advertising of its own. A page that shows a video or post from another service (YouTube, Vimeo, Spotify, X, Instagram, Facebook or LinkedIn) loads it from that service as soon as the page opens, and that service then gets your IP address and browser details and may set its own cookies. The same goes for a picture the site shows from another website.

Requesting early access

What it asks for, and why

Your name, email address, what you want to build and a link (if you give them) — So we can answer your request. Requests are kept; nothing deletes them automatically.

Creating a site

What it asks for, and why

Your name, your email address (from your invitation), a password, your site's name and address, and your business's name if you give one — To create your account and your site, and to know who the platform's agreement is with. Your password is kept only as a one-way scrambled form, never as you typed it.
Your agreement to the platform's terms — Which versions you agreed to, when, your name and email address, your business's name if you gave one, and sometimes your IP address and browser details. Kept even if your site is later closed.
Your invitation — The email address it was sent to and the message that came with it — the record of how your site was made. Kept; nothing deletes it automatically.

Who else gets it

Postmark — Sends your invitation and welcome emails.

Running your site

What it asks for, and why

Your sign-ins — Each attempt to sign in, including failed ones, with the email address typed, the time and your IP address, and the same for password-reset requests and sign-outs — to keep accounts safe. Kept; nothing deletes them automatically.
Support requests you send from your site's admin — Your name, email address, your site and what you wrote — so the platform team can answer you and fix what you report. Your site's admins can see the requests sent from your site. Kept; nothing deletes them automatically.

Who else gets it

GitHub — The platform team may copy a bug or feature you report into a task in its private GitHub project, by hand. Your email address is never copied, and the team checks the rest for personal details before it does.
Postmark — Sends the emails about your account, such as password resets, and delivers your support requests to the platform team.
Stripe — If you connect your store to Stripe, Stripe gets your site's name and your notification email address when your Stripe account is made.

← All policies