rawbase.io

Privacy Policy

Last updated: August 2026

Overview

rawbase.io is committed to handling your data responsibly. This policy explains what data we collect, how it is used, and what rights you have over your information.

Who Is Responsible For Your Data

rawbase.io is operated by Robert Rompf, an individual based in Slovakia. For the purposes of the GDPR, Robert Rompf is the data controller. See the Imprint page for full identification details.

Information We Collect

  • Account information — email address, username, and password when you register. Email and username are required; all other fields are optional.
  • Profile information — first name, last name, bio, avatar image, and social links, only if you choose to provide them. First and last name are stored even if you choose not to display them publicly, and remain visible to moderators reviewing account activity.
  • Uploaded content — preset files, preview images, titles, descriptions, and tags you upload to the platform.
  • Interaction data — votes, favorites, and reports you submit.
  • IP address — read from request headers to rate limit downloads, rate limit password-reset requests, and prevent inflated download counts. Kept only in short-lived, in-memory caches described under Data Retention below; never written to our database or included in exported logs.
  • Moderation records — if a preset you own is reported, or if a moderator takes action on your account, a record of that action is kept for platform-safety and audit purposes.

How Your Data Is Stored

  • Account and profile data, preset metadata, and interaction records are stored in a Supabase-managed PostgreSQL database.
  • Preset files and preview images are stored in Cloudflare R2 object storage.
  • Avatar images are stored in Supabase Storage.
  • Supabase and Cloudflare host infrastructure outside Slovakia, which can mean your data is processed in other countries, including outside the European Economic Area. Where that happens, our providers rely on standard contractual clauses or an equivalent safeguard recognised under the GDPR.

Third-Party Services

  • Vercel Analytics — we use Vercel Analytics to collect anonymised usage statistics such as page views and performance metrics. It does not use cookies. Like most analytics tools, Vercel derives a short-lived, non-identifying visitor count from technical signals such as your IP address and browser, but this is not used to identify you and is not shared with us in identifiable form.
  • Azure AI Content Safety — preview images and thumbnails you upload are sent to Microsoft's Azure Content Safety API for automated moderation before publishing. Avatar images are not sent. Images are not retained by Microsoft beyond the review request.
  • Resend — we use Resend to deliver account security and lifecycle emails, such as the notice we send when a deletion of your account is scheduled. Only your email address and the contents of that message are shared with Resend, and only when such a message is sent. Sign-in and password emails are sent separately by Supabase Auth.

Cookies and Local Storage

We only use cookies and browser storage that are strictly necessary for the platform to function, so no cookie consent banner is shown. Specifically:

  • An authentication session cookie, set by Supabase Auth when you sign in.
  • A short-lived cookie set only during password recovery, to confirm you followed a valid reset link.
  • A theme preference (light or dark mode), saved in your browser's local storage.

We do not use cookies or local storage for advertising or cross-site tracking.

Uploaded Images

Preview images and thumbnails are re-encoded on upload, which removes embedded metadata such as GPS location and camera information before the file is stored. Uploaded files, including preset files and images, are stored at publicly accessible addresses once a preset is published — this is how the platform serves previews and downloads to visitors, but it means anyone with the address can fetch the file directly, not only through the site.

Public vs. Private Data

Published presets, preset metadata, and your public profile (username, bio, social links, and display name if you choose to show it) are visible to anyone visiting the site. Your email address is never displayed publicly.

Your Rights

You can update your profile information at any time from the Settings page. If you are in the European Economic Area, the UK, or another jurisdiction with similar protections, you have the right to access, correct, export, or request erasure of your personal data, and to object to or restrict certain processing. You can exercise most of these rights yourself:

  • Access and correction — view and edit your account details from Settings.
  • Erasure — the “Delete Account” option in Settings schedules the permanent deletion of your account, profile, avatar, votes, favorites, and reports. When you request it you choose whether your published presets are deleted along with their files, or left on the site credited to “Deleted User” with no link back to you. Deletion is carried out no sooner than 30 days after you request it; signing in again during that period cancels it. Once carried out, it cannot be undone.
  • Export or other requests — for a copy of your data, or any request not covered above, contact us at contact@rawbase.io. We aim to respond within one month.

If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority. In Slovakia, this is the Úrad na ochranu osobných údajov Slovenskej republiky.

Data Retention

  • Account and profile data is kept for as long as your account remains active.
  • If you remove a preset, its listing and files are permanently deleted — removal is final, not a temporary unpublish.
  • If you delete your account, it is retained for at least 30 days so you can change your mind by signing back in, then your profile, avatar, votes, favorites, and reports are permanently deleted. Your presets are deleted at the same time unless you asked for them to be kept, in which case the published ones remain published without any link to you. Records of moderation actions may be kept for up to 12 months, and ban records for up to 24 months, to support platform safety; these records no longer identify you once your account is deleted.
  • The IP addresses described above are held only in short-lived caches — at most 6 hours — and are never written to persistent storage.

Contact

If you have questions about this privacy policy or your data, you can reach us at contact@rawbase.io.