Privacy Policy
Last updated: 2026-10-09
RoamBunny makes China travel guides and a free Starter Kit. This page explains, plainly, what we actually collect and why. We do not sell your personal data and we do not use it for advertising profiles.
What we collect
Only what the site actually needs: your email address when you create an account or ask for the free kit; your password when you create an account; an account identifier and, where the platform shares it, your email address when you sign in with a social platform; your session cookies; a hashed form of your IP address; and anonymous usage events (page views, language changes, clicks) with any campaign (UTM) parameters from the link you arrived through.
Your account and your password
When you create an account we store your email address, whether it is verified, and your password as a PBKDF2-SHA256 hash (300,000 iterations with a random per-account salt); we also record the time you gave consent. The plain password itself is never stored. Single-use tokens for email verification (24 hours) and password reset (1 hour) are stored only as hashes.
Signing in with Google, X, TikTok or Instagram
If you choose a social sign-in, the platform returns your account identifier and, depending on the platform, your email address (Google) and a display name or username (Google name; X username; TikTok display name; Instagram username). We store the account identifier together with your email address when the platform provides one. Display names and usernames are used only while completing the sign-in and are not stored.
Cookies
We set two first-party cookies. rb_session keeps you signed in for up to 30 days (it is refreshed while you stay active) and rb_oauth holds a short-lived (10 minute) sign-in handshake while you connect a social platform. Both are HttpOnly, Secure and SameSite=Lax. We use no advertising or tracking cookies.
IP address and abuse prevention
We do not store your raw IP address. It is combined with a secret salt and hashed (SHA-256); the salted hash is what we store, to prevent abuse and to rate-limit sign-in, sign-up and email requests. It cannot be reversed back to your IP address.
Site analytics and campaign links
We record simple events such as page views, language changes and clicks, together with the page path, any UTM parameters in the link you used and, when you submit the free-kit form, the referring site. These events carry no name and are not linked to your account.
The free kit and our email list
When you ask for the free Starter Kit we store the email address you enter, the time, the campaign source and the referring site, so we can send you the kit and occasional updates. You can ask us to delete it at any time.
Who processes data for us
We rely on a small set of providers: Cloudflare (hosting, CDN, our API worker and the database), Resend (sending verification and password-reset emails, once configured), the social platforms you choose to sign in with (Google, X, TikTok, Instagram) and the checkout platform (for example Gumroad) when you buy a guide. We do not sell personal data.
Deleting your data
You can ask us to delete your account and the personal data linked to it at any time. Email [email protected] from the address you used, with the subject Delete my data, and we will remove your account record, your linked sign-ins and your active sessions, together with any free-kit entry for that email. We will complete the deletion within 30 days of your request. Anonymous usage events are not tied to you and are kept only in aggregate. If this contact address changes, we will update it on this page.
Contact and changes
Questions about this policy, or a data request? Email [email protected]. If we change how we handle data we will update this page and its date. If the contact address changes, we will note it here.