Privacy Policy

Last updated: 27 April 2025

This Privacy Policy explains how Rate'em ("we", "us", "our") collects, uses, and protects your personal data when you use rate-em.vercel.app (the "Platform"). We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Rate'em is operated as a personal project based in the United Kingdom. For the purposes of data protection law, we are the data controller.

Contact: yilanwan525@gmail.com

2. What Data We Collect

2.1 Data You Provide Directly

Profile information: Username, display name, and bio that you set on your profile
User Content: Topics you create, items you add, ratings you submit, comments you post, and images you upload

2.2 Data Collected via Google OAuth

When you sign in with Google, we receive from Google:

Your email address
Your Google account name
Your Google profile picture (used as your default avatar)

We do not receive your Google password.

2.3 Data Collected Automatically

Guest session identifier: If you rate items without an account, we store a randomly generated session ID in your browser's local storage to associate your ratings with your session. This is not a cookie and contains no personal information.
Technical data: Our hosting providers (Vercel and Supabase) may collect standard server logs including IP addresses and browser type for security and operational purposes.

3. How We Use Your Data

Purpose	Data used	Legal basis
Providing the Platform (accounts, ratings, comments)	Profile info, Google OAuth data, User Content	Contract (providing the service you signed up for)
Displaying your content to other users	Username, display name, avatar, User Content	Contract
Preventing abuse and enforcing our Terms	All data	Legitimate interests
Platform security and error monitoring	Technical/log data	Legitimate interests
Guest rating functionality	Guest session ID	Legitimate interests

4. Where Your Data Is Stored

Your data is stored using the following third-party services:

Supabase — our database and authentication provider. Data is stored on servers hosted by Amazon Web Services (AWS). Supabase is GDPR-compliant. See supabase.com/privacy.
Vercel — our hosting provider. See vercel.com/legal/privacy-policy.
Google — handles authentication via OAuth. See policies.google.com/privacy.

Some of this infrastructure may process data outside the UK or EEA. Where this occurs, we rely on appropriate safeguards such as standard contractual clauses.

5. How Long We Keep Your Data

Data type	Retention period
Account and profile data	Until you delete your account
User Content (topics, ratings, comments)	Until you delete the content, or your account is deleted
Images uploaded to the Platform	Until the associated content is deleted
Guest session ID	Until you clear your browser's local storage
Server logs	As determined by Vercel and Supabase (typically 30–90 days)

When you delete your account, your profile data is removed. Some content you created (such as comments) may be anonymised rather than deleted, to preserve the integrity of discussions.

6. Sharing Your Data

We do not sell your personal data. We do not share your personal data with third parties except:

Service providers: Supabase and Vercel, as described above, solely to operate the Platform
Legal obligations: If required by law, court order, or to protect the rights and safety of users

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate data
Right to erasure ("right to be forgotten") — request deletion of your data
Right to restriction — request that we limit how we use your data
Right to data portability — request your data in a machine-readable format
Right to object — object to processing based on legitimate interests

To exercise any of these rights, please contact us at the email address in Section 1. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data lawfully.

8. Children's Privacy

Rate'em is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

9. Local Storage

Rate'em uses your browser's local storage (not cookies) to store:

Your theme preference (light or dark mode)
Your guest session ID (for ratings without an account)
Your sidebar layout preference

These are stored locally on your device and are not transmitted to our servers except where necessary to provide the service (e.g., the guest session ID is sent when you submit a rating).

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will take reasonable steps to notify users. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions or to exercise your rights, please contact:

Email: yilanwan525@gmail.com

Rate'em — "Rate and judge, we don't care"