Privacy and link measurement
Rabet helps businesses manage stable links, QR codes and aggregate reports. This notice explains the information used by the service and by its link reports.
Transfer notifications
When a link transfer is requested, accepted, declined, cancelled or recovered by support, both accounts receive an in-app notification. When email delivery is available, an automated email from no-reply@rabet.me is also sent. Such emails are sent through our email provider, Resend, to the account's verified address and contain only the event type and counts of links and pages, never destinations or QR codes. Rabet keeps its email delivery records for 14 days and in-app notifications for 90 days. Separately, Resend stores sent emails and their delivery logs in the United States for 30 days under its standard plan. Open and click tracking is disabled.
Your account and content
Google sign-in provides your account identifier, name and email. Your workspace contains the stores, destinations, pages and saved changes you create. Workspace management and analytics require a signed-in account; active links and published pages are public through their URLs. Draft pages remain private.
Account access and support history
Rabet records verified account sign-ins, explicit sign-out requests and their revocation result, last observed workspace use, and active days for account security and customer support. Authorized managers can inspect these records and retained resource changes. Account access events are displayed for up to 90 days and become eligible for deletion after that period; deletion and retained backups are not instantaneous. The first tracking date is shown; earlier events are not reconstructed, and recording can have gaps. Closing a tab is not recorded as signing out. These records do not contain session cookies, tokens, raw IP addresses or full browser headers. Last-use metadata remains with the account until authorized removal. This account history is separate from the aggregate public-link reports below.
Link analytics
Link reports use aggregate opens, day, hour and weekday, reported source, broad device, browser and operating system categories, and preferred browser language. When a usable network address is available, Rabet estimates its country using a local DB-IP database and discards the address; it does not send visitor addresses to a geolocation API. Country is approximate and can reflect a VPN or proxy. Historical or unavailable countries remain unknown. Sources and devices are also estimates. Opens are not unique people, purchases or precise locations. Rabet does not create individual visitor histories or store raw IP addresses, full user agents, full referrers, advertising click IDs or visitor identities in these reports. Visits to published pages are counted in the same aggregate way in separate page reports. A short link that opens a page counts one link open and one page visit; the two are never added together.
Your measurement choice
Rabet skips analytics when a request includes Do Not Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1). You can also add analytics=off to a link's query parameters to exclude that opening: use ?analytics=off, or &analytics=off when the link already contains a query. This choice applies to that request. When a short link opens a page, the choice also applies to that page visit. A page address accepts analytics=off in the same way. It does not stop the hosting provider's ordinary security and network processing.
Uploaded files
Where uploads are enabled, Rabet stores your images, logos, PDFs and short videos in Google Cloud Storage. Images are processed to remove embedded metadata. Unpublished files are visible only to their owner; a file becomes public when a published page uses it. Removing an item from a draft does not remove its published version or the library file. A file cannot be deleted while a saved draft or published page uses it. Any separately configured file recovery copies follow their own retention policy, independent of database backups. Contact support about removal from retained copies.
Paid subscriptions and billing
Paid subscriptions use Polar's hosted checkout and billing portal. Polar and its payment providers process payment information under their own notices. Rabet uses account and billing references, the selected plan, subscription status and billing-period information to manage access and resolve billing problems. Do not send payment-card details to Rabet support.
Payment records and requests
Payment and subscription records may need to be retained to handle purchases, disputes, security and applicable legal obligations. Account closure, cancellation and a refund are different requests. Contact support about access or deletion; the response will explain any verification or retention requirements that apply. Applicable statutory response deadlines still apply.
Cookies and service providers
A necessary HttpOnly sign-in cookie keeps your workspace session for up to five days. A language preference remembers your chosen interface language. Your time zone preference is saved locally in your browser. Public prices are shown in USD only. Rabet's aggregate analytics do not use a visitor cookie. Google Firebase provides hosting, authentication, database and infrastructure services. Application diagnostics use route templates, request IDs, status and duration; hosting and network providers can keep separate HTTP metadata.
Images and videos
Published pages can contain images and media hosted by another provider. Loading them contacts that provider, which receives ordinary network information such as your IP address. YouTube players load only after you choose to play, using YouTube's privacy-enhanced embed domain. That mode is not a promise of zero tracking. A merchant's external destination can have its own cookies, analytics and privacy policy.
Retention and access
Reports show up to 30 days of opens, while aggregate records can remain longer. Account content and change history remain until removed through an authorized process. Application logs are configured for 30-day retention. Database backup schedules retain daily copies for seven days and weekly copies for twelve weeks, so removal from the live database does not immediately remove retained backups. Each merchant can access only their own management data and reports.
Requests and questions
Contact support@rabet.me to ask about your information, correction, deletion or analytics objections. Include only the information needed to identify your request; do not send passwords or sign-in tokens. Merchants are responsible for the content and destinations they publish. Privacy obligations depend on the actual processing and applicable law; this service does not promise that every analytics configuration is exempt from consent everywhere.