rm1x.club
Privacy policy
The short version: rm1x keeps what you put in, only to run the site. No ads, no tracking, and today we don't sell your data.
Who runs rm1x
rm1x is a small social site run by Brandon Dosch in Dalton, Georgia, USA. Questions, requests or problems: b@rm1x.club.
What we collect and why
Only what you give the site, plus what's needed to keep you signed in.
| What | Why / notes |
|---|---|
| Account: email address and password | To sign you in and send account emails (confirm your email, reset your password). Passwords are stored hashed by our sign-in provider, never in plain text. |
| Google sign-in details | If you use “Continue with Google”, Google shares your name, email address and profile picture link with our sign-in provider. We use the email to identify your account and may suggest your name as your handle. We don't show your Google picture on rm1x. |
| Profile | Unique name (@handle), display name, bio, favorite color, profile pictures, your settings, your member number and your role (member/admin). Shown on your profile. |
| Private profile items | Your private note and any profile pictures you mark private. Only you can see them. |
| Posts and photos | Titles, text and pictures you post (pictures are cropped and stored inside the post). Public or private, your choice. |
| Comments and pots | Comments you leave and posts you “pot” (save to your shelf). |
| Daily status | Your “what are you doing today?” emoji/text and the day it's for. |
| Steam “now playing” (optional) | If you turn on Steam "now playing" in Settings, we read only your public Steam "now playing" info (the game name and its Steam game number) every few minutes to show "🎮 playing <game>" as your status, with the game's picture loaded from Steam's servers; turning it off or unlinking stops it right away and deletes your Steam ID from rm1x. |
| Whispers (direct messages) | Messages you send and receive, and when you last read each conversation (for unread counts). |
| Bonds | Bond (friend) requests and who accepted, plus the “top bonds” you pick to show on your profile. |
| Queue invites | If you joined from someone's invite link, we record who invited you (so they get credit). The invite code is kept in your browser until you sign up. |
| Birthdate | Asked when you sign up (and once for members who joined earlier) to confirm you're 17 or older. Stored in a private area of the database that the app and other members can't read, and never shown on your profile. If you sign up with email, it's also saved with your sign-in details. It can't be changed in the app; email us to fix a mistake. |
| Reports and safety records | Reports you send (what you reported, why, and your optional note) and, for reports, a snapshot of the reported content so moderators can review it. See “Safety reports and preserved evidence” below. |
| Timestamps | When your account, posts, messages and other items were created. |
Our service providers (below) may also log technical details such as your IP address and browser type when you load the site or sign in, mainly for security and to keep things running.
Who can see what
Private posts are hidden from other members and from rm1x's admin screens, and you can switch a post between private and public from its ⋮ menu. They are still stored on our servers, so they can be accessed if the post is reported for a safety review, or when the law requires it (for example, a court order or subpoena). Private doesn't mean nobody could ever see it, so don't post anything you'd never want anyone else to see.
- Everyone, even signed-out visitors: profiles (handle, display name, bio, color, public profile picture, member number, daily status, top bonds, who invited you), public posts, and comments and pots on public posts.
- Only you: your email address, private posts, private note and private profile pictures.
- Only the two people involved: Whispers, and bond requests.
- Admins can change member roles, remove comments, and review items flagged by the automatic safety check (see below). The site doesn't give admins a way to read private posts or Whispers.
- The person running the site can technically access the database through our hosting provider's admin tools. I only do that when I need to run the site, fix a problem, or deal with abuse or legal requirements.
If you share a post or invite link (for example to X or with your phone's share sheet), that service's own privacy policy applies.
Marks and skins
We store your Marks balance, a record of how you earned and spent them, the skins you own and use, and any couple-skin link. Your active skin and couple link show to anyone who can view your profile. Anyone can turn off other members' skins on their own device. Either person can remove a couple link at any time, without notifying the other. Deleting your account erases all of it.
Profile stickers: we store each sticker on a profile, who placed it, where, and when, plus a short log of when you placed stickers (used to stop spam). Stickers show to anyone who can view that profile, along with the @name of the member who placed them. If you and the person who placed a sticker have blocked each other, you won't see it on other people's profiles. When the owner or the sender peels one off, it's deleted.
Automatic safety checks
rm1x has a no-porn rule. To help enforce it, public posts and their pictures, comments, profile text (display name, bio and status) and profile pictures (including ones you mark private) are automatically checked for safety by OpenAI's moderation service when you post or change them. Private posts and Whispers are not sent.
- OpenAI returns safety scores (for example, for sexual or violent content). We store those scores with the item so moderators can review it.
- If something looks clearly sexual or graphically violent, it's hidden from everyone except you and the site's moderators until a moderator reviews it. Other flags only send it for review, and it stays visible. Nothing is deleted automatically, and a moderator can put a hidden item back.
- Under OpenAI's API data policy, OpenAI does not use data sent to its API to train its models. For the moderation service, OpenAI also says it doesn't keep that data for abuse monitoring.
- If the check is unavailable, your post goes up as normal and is checked again later.
Services we use
- Supabase: database, sign-in and live updates. Data is stored on servers in the United States.
- Google: optional “Continue with Google” sign-in.
- Neocities: hosts the website files.
- Cloudflare: DNS for the rm1x.club domain.
- OpenAI: automatic safety check of public posts, comments, profile text and pictures (see Automatic safety checks). Not used to train OpenAI's models.
- Steam (Valve): only if you turn on Steam "now playing". Our server asks Steam what you're playing every few minutes, and the game's picture next to your status loads from Steam's image servers (so Steam/Cloudflare see the viewer's IP address, like any image). Nothing is sent to Steam for members who haven't turned it on.
- jsDelivr: delivers the Supabase code library the page loads.
- X (Twitter): when a post links to an X post, rm1x shows a “Show X post” button. X embeds load content and scripts from X only when a member taps to show them; until then, nothing is requested from X. Once loaded, X's privacy policy applies to that embed (we ask X not to personalize it).
Each of these has its own privacy policy. We don't share your data with anyone else, except if the law requires it.
No selling, no ads, no tracking
Today, we don't sell or rent your data. rm1x has no ads, no analytics, and no tracking pixels or third-party trackers. The one exception: if you tap "Show X post," X's own embed loads from X (with do-not-track on), and nothing from X loads before that tap.
Coming later: get paid for your data (opt-in)
This program isn't live yet. Nothing below happens today.
rm1x plans an optional program where members can choose to let their data be offered to buyers as part of a group (pooled) dataset.
- Off unless you opt in. If you do nothing, your data is never included.
- You get paid. Members who opt in receive the amount owed to them. rm1x keeps $0.99 of every $20 earned.
- rm1x doesn't read the contents of your data to run the program.
- Opt out any time.
Before the program starts, we'll update this policy with the details and notify members.
Cookies and browser storage
rm1x doesn't set cookies. It uses your browser's local storage for:
- keeping you signed in (your sign-in session);
- remembering a Queue invite code until you sign up (cleared after sign-up, or after 30 days);
- remembering if you chose “Later” when asked to pick your name.
Signing out ends your session. Clearing your browser's site data removes all of it.
How long we keep data
Your data stays until you delete it or delete your account. You can delete your own posts, comments (and comments on your posts), pots and bonds, and edit your profile, at any time. Whispers can't be deleted in the app yet; email us if you need one removed. Our hosting provider may keep backup copies for a limited time after deletion. The one exception is preserved safety evidence, which we must keep for a year (see below).
Safety reports and preserved evidence
When content is reported for child safety and we act on it, U.S. law (the REPORT Act) requires us to report it to the National Center for Missing & Exploited Children (NCMEC) and to preserve it. We then keep a locked copy of the content and basic details of the account that posted it (account ID, @handle, email address and account timestamps) for one year, or longer if law enforcement asks us to. Only the site operator can reach these records; no member can, and they can't be deleted before the year is up. Intimate images reported as shared without consent are removed within 48 hours (see the terms).
Deleting your account
You can delete your account yourself: open Profile → Delete my account, then type your @handle to confirm. You'll be signed out right away. You can also email b@rm1x.club from the address on your account.
Deleting your account permanently removes your sign-in, your profile and pictures, your post tag and picture stacks, your posts, comments, pots, bonds and Top 5, your blocks, your birthdate, and your Whisper conversations, including the other person's copy of those conversations.
When deletion waits: if something you posted is part of an open child-safety or intimate-image report, or is preserved evidence (see above), we disable and anonymise your account straight away, remove everything that isn't under review, and finish deleting it after the review. Preserved evidence is kept for the time the law requires, then deleted.
You can also email us to get a copy of your data or to correct something.
Children
rm1x is only for people 17 and older. Please don't sign up if you're under 17; signups with a birthdate under 17 are refused, and an existing account that gives a birthdate under 17 is disabled. If we find out someone under 17 has an account, we'll delete it. If you think that's happened, email b@rm1x.club.
Changes to this policy
If this policy changes, we'll update this page and the date at the top. For big changes, we'll also let members know on the site.
Contact
Brandon Dosch · Dalton, GA, USA · b@rm1x.club