Arbito Account Privacy Policy

Effective Date: July 30, 2026 · Last Updated: July 30, 2026

Your Arbito account is one sign-in that works across the apps made by Arbito LLC ("we," "us") — including Rufio Stats, Arbito Market, RepBase, Tado, and HatchHaven. The account is hosted at id.arbito.co. This policy covers the account itself: what we store to let you sign in, and what happens to it.

Each app also has its own privacy policy covering the data you create inside that app (your stats, tasks, listings, and so on). Those are listed at arbito.co/privacy.

1. What we collect for your account

Sign-in details: your email address, a display name, and either a password (stored only as a salted hash — we cannot read it) or the identifier returned by Google or Apple if you sign in with them.
Verification and security records: whether your email is verified, one-time codes we email you (for signing in, resetting a password, or confirming account deletion — these expire in minutes), and the session tokens that keep you signed in.
Age confirmation: a record that you confirmed you are at least 13 when you created the account. We do not collect your date of birth.
Sign in with Apple: if you use it, a token from Apple that lets us disconnect the link when you delete your account.
Optional profile: an avatar photo or short bio, if you add one.

We do not collect your location, contacts, or browsing history, and the account has no advertising or tracking identifiers.

2. How we use it

To sign you in to Arbito apps and keep those sessions secure.
To send account emails: verification links, one-time codes, password-reset links, and deletion confirmations. We do not send marketing email to your account address without asking separately.
To prevent abuse (rate limits, suspicious-sign-in protection).

3. Who sees it

Recipient	Why	What they get
The Arbito app you sign in to	So the app knows who you are	Your account ID, email, and display name (via a signed token)
Google / Apple	Only if you choose them for sign-in	The sign-in exchange you authorize
Resend	Delivers our account emails	Your email address and the message
Railway	Hosts our servers	Data processed to run the service

We do not sell your information, and we do not share it with advertisers.

4. Deleting your account

You can delete your Arbito account from inside apps that support it, or by emailing support@arbito.co from your account address. In Rufio Stats the deletion screen is reachable three ways — Settings → Account, the danger zone at the bottom of your profile, or Billing → Delete account — and it lets you choose between deleting just your Rufio Stats data (keeping the Arbito account) and deleting the whole Arbito account. Deletion is confirmed with a 6-digit code emailed to you, is permanent, and disconnects Sign in with Apple where a token is on file.

Deleting the account removes your sign-in identity. Data you created inside individual apps is handled under each app's own policy — Rufio Stats deletes its data as part of its in-app deletion flow; for other apps, tell us in your email and we will remove that data too.

5. Retention and security

We keep account data for as long as the account exists. One-time codes expire within minutes; sign-in sessions expire and are revoked when you change or reset your password. Data is encrypted in transit, and passwords are never stored in readable form.

6. Children

Arbito accounts are for people 13 and older, and sign-up asks you to confirm that. We do not knowingly let children under 13 create accounts; if you believe one exists, email us and we will remove it.

7. Changes and contact

If this policy changes in a meaningful way, we will note the new date at the top of this page. Questions or requests: support@arbito.co.

Operated by Arbito LLC. This page describes our current practices in plain language.