Privacy Policy
What we collect, why, how long we keep it, and how to get it back or delete it.
These documents describe how rctuners actually works, but they have not yet been reviewed by a lawyer. They will be before the site opens.
The short version
We collect as little as we can get away with: a handle, an email address, a password we cannot read, and whatever you choose to publish.
We do not collect your real name, your precise location, your phone number or your payment details. The last of those is structural — rctuners never processes payments, so there is nothing to collect.
We do not sell your data. We do not target advertising using your messages.
What we hold, and why
Your account: handle, email, password hash, and whether you passed the age check. We need these to have an account at all, and to stop one person impersonating another.
What you publish: listings, fit reports, builds, reviews, group posts, messages. This is the site working as intended.
Consent records: which documents you accepted, which version, when, from what IP address and browser, and the exact wording you were shown. This is evidence that we asked properly, and the law requires us to be able to show it.
Security and operations: sign-in events, rate-limit counters, error logs, and an audit log of staff actions. Without these we cannot keep accounts safe or answer 'who changed this'.
What we deliberately do not hold
Your date of birth. We ask once, work out whether you are 16, store that answer, and discard the date.
Card or bank details. There is no checkout on this site.
Your exact location. Region is as precise as it gets, and you choose how precise.
The content of your messages for advertising purposes. Targeting uses declared interests, brands you follow, groups you are in and your region — never what you say to people.
Cookies and similar
Cookies that are strictly necessary — signing you in, keeping your session safe — are set without asking, because the site cannot work without them.
Everything else waits for your consent: remembering preferences, understanding what is broken, and measuring advertising. Refusing is as easy as accepting, and you can change your mind from the footer at any time.
If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a refusal and do not ask again.
Who else sees it
A small number of suppliers process data on our behalf — hosting, email delivery, media storage, error monitoring. Each is under contract, each is listed on our sub-processors page, and none of them may use your data for their own purposes.
We disclose data to authorities only where we are legally required to, and we tell you unless we are forbidden from doing so.
How long we keep it
Messages and posts: until you delete them or close your account.
Consent records: for the life of the account and six years after, because they are the evidence that we asked.
Moderation records: three years. Audit logs: twelve months. Server logs: ninety days.
Closed accounts: a tombstone with no personal data, kept so conversations other people were part of do not fall apart.
Your rights
Get a copy. Export everything we hold about you, as a machine-readable file, from your privacy settings.
Correct it. Most of it you can edit directly; write to us for the rest.
Delete it. Closing your account removes your media, anonymises your ratings so other people's histories survive, and tombstones your messages. It completes within 30 days, including backup rotation.
Object, or withdraw consent. Withdrawing is as easy as giving it, and takes effect immediately.
If you think we have got this wrong, you can complain to your data protection authority. We would rather you told us first: privacy@rctuners.com.
Where your data lives
Hosting region and international transfer arrangements are not settled yet and will be stated here, with the safeguards that apply, before launch.