Privacy Policy

Last updated: 2026

What we collect

• Your username, and a password if you set one (stored as a salted Argon2id hash — we never see or store your plaintext password). A password is not required — you can create and use an account with a phone number instead, or both.
• If you choose to add one, your phone number, encrypted at rest, used to sign in and to send one-time verification codes. It is never shown to another member — only a masked version (e.g. "+1 •• •• ••34") is visible to you and, if needed, to our admin team. Every account keeps at least one way to sign in, so a phone can only be removed once a password is set, and a password can only be removed once a phone is linked and verified.
• An optional recovery email, encrypted at rest, used only for account recovery.
• If you sign up as a business owner, a government-ID photo for identity verification — automatically stripped of EXIF and GPS metadata, stored privately, never shown publicly, and deleted 30 days after a decision is made on it.
• Your IP address, in full (not hashed) — retained for authentication and fraud-prevention telemetry, visible only to our admin team, for 180 days (see below).

Server & traffic logs

Our web server records every request it handles — including your IP address, browser user agent, and the page requested — for security and for traffic statistics (for example, telling human visitors apart from search-engine and AI-assistant crawlers, and seeing which pages get read). These records are kept for 90 days and then automatically deleted, are visible only to site administrators, and are never sold or shared with anyone.

Account security & login history

Every sign-in attempt — successful or not — is logged for account security, fraud prevention, and scam prevention: the outcome, the method used, your IP address, an approximate location resolved from a local database (never a third-party lookup), your device type, browser and operating system, and a coarse device fingerprint used only to spot clusters of related accounts. This log also records a small set of technical device details (timezone, screen size, whether the device is touch-capable) sent by our own first-party script — never a third party.

IP geolocation by DB-IP.

This login history is visible only to our admin team, is never shown to other members, and is kept for 180 days before it is automatically deleted. Your IP address is also kept, in full, on your active session record (so we can show you your own sessions and flag an unfamiliar one), for as long as that session is active — up to 30 days — or until you sign out or revoke it from Settings → Sessions. If you enable a trusted device, we store a hashed device token so that device can skip the text-message code for up to 30 days; you can revoke any trusted device at any time from Settings.

What we don't do

• No third-party analytics, ad trackers, or fonts. Nothing you do on rubspot is shared with an ad network.
• No selling or renting of your data to anyone.
• No requirement to use your real name.

Who can see what

Reviews you post are public and attributed to your username. Blocking another member hides your activity from them and theirs from you, in both directions. Our moderation team can see reports filed against you or by you, and (for business-owner accounts) your identity verification photo while it is under review.

Retention

If you delete your account, we immediately erase your credentials and any pending identity-verification photo. Your username stays reserved (not reusable by anyone else) for 90 days before final removal, purely to prevent impersonation of a recently-deleted account. Reviews you posted stay published under your username while it is reserved; when the account is finally removed 90 days after deletion, those reviews are deleted with it.

Security

Passwords are hashed with Argon2id. Sessions use random, hashed tokens. All traffic is encrypted with HTTPS. We support optional two-factor authentication (TOTP) on every account.

Your choices

You can review and revoke active sessions, enable two-factor authentication, and delete your account at any time from Settings.

Contact

Privacy questions: see our Contact page.