This notice explains how the operator of reportbin at https://reportbin.dev and of its reports domain reportbin.page handles data about visitors, account holders and report recipients. We do not sell personal data or use it for advertising. Reports uploaded by other people may contact external services, as explained below.
Data we handle
- Reports and settings. We store your reports and details such as their titles, owners, upload dates, sizes and sharing settings. We also keep account settings, storage limits and the status of uploads and deletions. The terms explain what you can upload and share.
- Account and sign-in information. Clerk handles authentication and account records, including names, email addresses, profile pictures and linked Google or GitHub identities. We use the account ID and verified email addresses to manage ownership and access. Authentication and security services also process technical information such as IP addresses, browser details and session information, including on pages visited before signing in.
- Recipient addresses. If an owner selects specific readers, we store the addresses they supply and compare them with verified account emails. These addresses may belong to people who have not registered. We do not send invitations or use them for marketing.
- Connected devices and upload keys. Clerk manages upload keys and records their names, creation dates and last use. The CLI saves its key on your device. Our server checks keys without saving the secrets permanently. We temporarily handle device names, approval details and verification data to connect devices and check access.
- Feedback. When you use
reportbin --hi, we save your message, account ID and the time it was sent. The message and account ID also appear in application logs. - Request and security logs. The server and hosting providers may record request times, URLs, IP addresses, browser information, errors and security events. Upload logs associate an account ID with a report ID. A report URL in a log can identify an unlisted report.
Why we use this data
We use account, report and sharing information to provide hosting, authenticate requests and enforce your access choices. We use technical records and feedback to prevent abuse, troubleshoot problems and respond to requests. We may also process records to meet legal obligations or handle legal claims.
Where data-protection law requires a lawful basis, we rely on performing our contract with you for the service you request; legitimate interests in security, support and controlled sharing for the related processing, including recipient addresses; and legal obligations where the law requires processing. These interests must be balanced against your rights. Agreement to the terms is not blanket consent to personal-data processing.
Account identification is needed to upload or read restricted reports. Recipient addresses are needed only for Selected people access. Sending feedback is optional.
Cookies and browser storage
Clerk uses cookies and related technical information for authentication and security. It loads on account and sign-in pages and pages that help you sign in to an inaccessible report. Security checks may use Clerk fraud protection or Cloudflare bot challenges.
The home page reads a sign-in cookie locally to choose between "Sign in" and "Account". The error page uses session storage to avoid repeated redirects when checking report access. When you open a restricted report while signed in, reportbin.page sets a cookie that lets your browser read it there for one minute. reportbin does not add advertising cookies. Blocking necessary cookies can prevent sign-in and access to restricted reports.
Who handles data
- Clerk provides authentication and upload keys. Its handling of customer data is described in its data processing addendum; its privacy policy covers its own processing.
- Google or GitHub handles the sign-in option you choose under that provider's policies.
- Hosting, network and security providers carry requests, store files and logs, and help protect the service.
- People allowed by a report's sharing settings can receive its contents. For Anyone with the link, this includes anyone who obtains the URL.
We may disclose relevant information to comply with legal requirements or, where lawfully justified, to investigate abuse, protect people's rights and safety or handle legal claims. Uploaded reports and links you follow may involve other providers as described below.
Providers may process information in countries other than yours. Transfer arrangements depend on the provider and applicable law. You can use the contact route to ask about the providers and safeguards relevant to your data.
When you open a report
Report authors can include external images, scripts, forms and other resources. Opening a report may send your IP address, browser information and other data to services chosen by the author. Scripts can also send report contents or information you enter to external services.
The report sandbox restricts scripts' access to reportbin's own account cookies and app. It does not block external requests or make the report confidential. Open reports only from sources you trust. Authors should keep reports self-contained and must follow our rules against deceptive or unlawful data collection.
Retention and deletion
- Reports: there is no automatic expiry. Reports remain until you delete them or they are otherwise removed. Delete them through your account page.
- Recipient addresses: they remain with the owner's report until the owner changes sharing settings or deletes the report or their account. Deleting a recipient's account does not remove their address from another owner's recipient list.
- Connections: you can revoke a connected device. Connection approval expires after ten minutes. Temporary request records remain until cleanup or server restart; cleanup can take longer if a credential needs to be revoked.
- Accounts: deletion blocks new uploads and access to owned reports, removes those reports and deletes the Clerk account and its upload keys. Interrupted cleanup is retried. We retain a local record with the account ID, deletion status and stored quota and default-access settings. This record has no automatic expiry and prevents stale credentials from restoring access.
- Feedback and logs: account deletion does not automatically remove these records. Feedback has no automatic expiry. Request logs follow the operator's and hosting providers' retention settings and are managed separately. Contact us about records you want removed.
- Copies and backups: deletion cannot recall copies already downloaded by others. Operational backups, where enabled, can retain removed records until replaced or deleted. Provider security or legally required records may also remain after account deletion.
Your choices and rights
Use your account page to manage access, revoke credentials or delete reports and your account. You can also contact us about personal data you supplied or that someone else supplied about you.
Depending on applicable law, you may have rights to access or receive a copy of your data, correct it, request erasure, restrict processing or obtain portable data. You may object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. These rights have conditions and exceptions.
We handle requests within the deadlines required by applicable law and may ask for enough information to verify your identity. Where the GDPR applies, the normal response period is one month, with extensions only as permitted by law. You may complain to the data-protection authority where you live or work, or where you believe an infringement occurred.
Security
The hosted service uses HTTPS, account checks for restricted reports and sandboxed report scripts. Anyone-with-the-link reports need no sign-in. Access controls do not encrypt content against the server operator, prevent authorised readers from copying it, or guarantee that data can never be lost or exposed.
Children
The service is not intended for people under 16, or a higher minimum age required where they live. We do not knowingly collect account information from children below that age. Contact us if you believe such information has been supplied.
Changes to this notice
We update the date when this notice changes. Where required by law, we will provide additional notice of material changes before they apply. A revised notice does not itself authorise a new use of personal data.
Contact
Email support@reportbin.dev for privacy questions or requests. You do not need a reportbin account. Include only the information needed to handle your request.
Account holders with a working upload credential can also use reportbin --hi "your message". Do not include passwords, upload keys or unnecessary personal information.