RestFreeRestFreeBack

Privacy policy

Effective date: 24 October 2026

This page explains, in plain words, what RestFree keeps about you, why, and who else receives it. RestFree is run by its Owner, who answers privacy questions.

See pricing

Your account

  • Your username, display name and a one-way hash of your password (never the password itself). An account created with email or Google can have no password.
  • What you add to your profile: avatar, bio, signature, pronouns, location and website.
  • Account status (for example active, banned or deleted), your privacy and display choices, your AI preferences, and when you were last active.
  • We use this to run your account, show your profile to other members, keep the site safe and enforce its rules.

Signing in with email or Google

  • If you use an email code, we keep your verified email address and when it was verified. If you link Google, we keep Google's stable ID for your account, the Google email address at the time you linked it, and when you linked it. These are used for signing in, account security, abuse limits and administration. They are not shown on your profile.
  • Codes are emailed through Resend, an email delivery service. Resend receives your email address and the message containing your one-time code. The message has no links or tracking images.
  • Google sign-in asks Google only for your basic identity (openid, email and profile). We keep only Google's ID for you and your verified email address. We do not store Google access or refresh tokens and cannot read your Gmail, contacts, Drive or other Google data. Your Google name and photo are not copied to your profile.
  • Codes expire after 10 minutes, allow 5 tries and are stored only as a hash. Unfinished sign-in steps expire within minutes; their records are kept for at least a day after they expire (to block replays) and then cleared. Sign-ins, links and unlinks with email or Google are recorded in the security log by method only, without the email address, code or token.
  • To prevent duplicate accounts, we also keep a normalised form of your email address (for example, a Gmail address without dots or +tags). Temporary (disposable) email addresses can't be used to register.

What you post

  • Messages you send in direct and group chats, including earlier versions of messages you edit.
  • Community posts, comments, wiki pages, submissions and polls.
  • Files you upload (images, videos and other files) with their original name, type and size. Files are stored with the site at its cloud hosting provider. When you upload a PNG, JPEG, GIF or WebP image, its embedded metadata, including location, is removed before it is stored. Other image formats sent as files (such as HEIC) are stored unchanged, and so are images inside other files such as documents or archives. Images uploaded before this policy took effect are not changed.
  • Who can see it: files in a chat, the people in that chat (and moderators, if a message is reported); avatars, any signed-in member. Posts, comments and other content in public communities, with your display name, can be read by anyone, including people who are not signed in; content in unlisted communities by anyone with the link.
  • Videos: when the site processes videos, location and other metadata are also removed from the original file you uploaded. When video processing is turned off, videos are stored as uploaded, so turn off location in your camera if you don't want to share it.

Why we use this data

  • To give you the service you asked for: your account, chats, communities and the features you use.
  • To keep accounts safe and stop abuse, for example with sign-in checks, rate limits and the security log.
  • Only when you choose to: optional features such as the AI tools (and ads, if they are turned on later). You can stop at any time.

AI features

  • You decide when you use AI features: AI chat, the assistant, chat tools (summaries, rewriting, reply suggestions, translation — including automatic translation if you turn it on), image and file inspection, and the community site designer.
  • When you use one, the text, images or files involved are sent to the AI provider the Owner has configured for that feature. Depending on that setting this can be DeepSeek, OpenAI, Anthropic, Google Gemini, OpenRouter, xAI, Mistral, Groq, Microsoft Azure OpenAI, a self-hosted model, or another compatible service the Owner connects. If you turn on web search, your search query can also go to a search provider (Brave, Bing, Tavily or SerpAPI). Each provider handles data under its own terms.
  • When you ask the assistant to read a web page, the site's server fetches that page. The Owner may also ask you to agree before your first use of AI.
  • Your AI chat conversations are stored so you can return to them; deleting a conversation also deletes the files you attached to it. The floating assistant's conversation is kept only in your browser tab. Feedback you send to the Owner or to a community's owner (its title and text) may be summarised with an AI provider.
  • Other members of a chat can use AI tools (summaries, translation, reply suggestions, image and file inspection) on the messages and files in that chat, including yours. Those are then sent to the AI provider in the same way.
  • We keep a ledger of your AI charges (which feature, its estimated cost and when) and your AI balance, so every charge can be checked.

Payments

  • Top-ups of the AI balance are paid through Stripe. You enter your card or other payment details on Stripe's checkout page; Stripe processes them under its own privacy policy, and RestFree never receives your card number.
  • For each top-up RestFree keeps the account, amount, currency, status (for example paid, refunded or disputed), the Stripe payment identifiers and the times. We use this to add the balance, handle refunds and disputes, and keep accounts. We do not store the email address or payment details you give Stripe.
  • Payment records are kept for as long as accounting and tax rules require, also after you delete your account, so that payments, refunds and disputes can still be checked.

Who else can see or receive data

  • Other members see your display name, avatar and profile. They also see whether you are online and when you were last active, unless you hide that in Settings → Privacy. Read receipts in direct chats still work when you hide it.
  • A community's owner can have the community send event notices to a web address they choose; notices about a member joining or publishing a post include that member's account ID (and the post's title).
  • MiniApps (small apps inside RestFree) can use a feature only after you allow it, for example your display name and avatar. Each app gets its own ID for you. You can withdraw these permissions in Settings → Privacy.
  • The site, its database and uploaded files are hosted by a third-party cloud provider. RestFree sends data to the other services named on this page (Resend, Google, Stripe and the configured AI and search providers) only for the purposes described here.
  • RestFree does not sell your personal data. The only advertising is the optional rewarded ads in MiniApps, described in the next section.

Rewarded ads in MiniApps

  • When you choose to watch a rewarded ad, RestFree shows Google AdSense H5 Games Ads on its own page. Google and its partners may use cookies, local storage and device and network information to show and measure ads and to prevent invalid traffic. Where required, we offer choices through a Google-certified consent management platform.
  • You can refuse or change consent and skip ads. Normal chat does not depend on ads.
  • RestFree keeps the ad session time, account and app identifiers, the reward result and abuse flags, to grant each reward once, apply limits and keep an audit record. Chat messages and passwords are never given to the ad script. Your browser reports when an ad finishes; web ads have no server-side verification from Google.
  • Happy Leaves from ads can only be used in games on RestFree. They cannot be bought or exchanged for cash or anything outside RestFree, and cannot be transferred directly between users.
  • Ad sessions and their reward and abuse records are kept for 90 days; the points ledger is kept like the rest of the ledger. For privacy questions, see Contact below.

What the Owner and moderators can see

  • Messages that someone reports, and the files in them.
  • All communities, including private ones.
  • Who has chatted with whom and how often, but not what was said.
  • The security log: sign-ins, linking and unlinking, and administrator actions.

Where data is processed

  • The site's hosting, email delivery, Google sign-in and the AI providers may handle your data outside your country or region.

Cookies and browser storage

  • session — keeps you signed in. It ends after 30 days, or after 14 days without use.
  • __Host-restfree-device — remembers for 14 days that this browser signed in successfully, so it can still sign in while someone else is trying to break into your account.
  • restfree-auth-oauth, restfree-auth-proof, restfree-auth-reauth — hold one step of an email or Google sign-in for at most 5 minutes. restfree-account-restore — holds a sign-in to a deleted account, for at most 5 minutes, while you decide whether to restore it. restfree-auth-requester — for 30 days, ties an email code to the browser that asked for it.
  • rf-locale, rf-theme and rf-site-locale-… — remember your language, theme and a community's language for a year.
  • RestFree itself sets no advertising or analytics cookies. If you choose to watch a rewarded ad, Google may set its own cookies (see Rewarded ads in MiniApps). Your browser also keeps some screen state, such as where you placed the assistant.

IP addresses and security

  • Your IP address is used to limit abuse, for example repeated sign-in attempts. These counters are kept in a separate database and are cleared regularly once their time window has passed. IP addresses are not stored with your account, your sessions or the security log.
  • Security-relevant actions, such as sign-ins with email or Google, linking or unlinking, and administrator actions, are recorded in a security log.
  • When you ask for an email code, a Cloudflare Turnstile check may run to tell people apart from automated sign-ups. Cloudflare receives your IP address and basic browser and device signals for this check.

How long data is kept

  • Sessions end after 30 days, or after 14 days without use. You can sign out your other devices in Settings → Account & profile.
  • A message you recall, or a post or comment you delete, is hidden from others but its record stays in the database. Files you share in chats and communities stay stored, including after you delete your account (see below).
  • A linked email or Google account stays until you unlink it in Settings → Account & profile, or until it is erased after you delete your account (see below). When an administrator deletes an account, sign-in stops, but the record is kept and can be restored.
  • The security log is kept; it is not deleted automatically. Community viewing history is kept for 180 days. The Owner keeps backup copies of the database, so data erased from the site can remain in backups until they are replaced.

Deleting your account

  • You can delete your account in Settings → Account & profile. You confirm it's you, then type your username.
  • Your account is deactivated at once, all your devices are signed out, and your name shows as a deleted user.
  • For 30 days, you can restore it by signing in again: you are asked whether to restore it before anything changes.
  • After 30 days, your profile details (avatar, bio, signature, pronouns, location and website), your linked email and Google sign-in, and your private AI conversations and their attachments are erased, and the account can no longer be restored. Messages, posts, comments and files you shared in chats and communities stay, shown as from a deleted user.
  • Your username is then released and may later be taken by someone else. Erased data can remain in database backups until they are replaced.
  • The site Owner's account, and accounts that own a community or have published a MiniApp, can't be deleted this way. Settings → Account & profile shows what needs to be sorted out first.

What you can do

  • Change your name, avatar, bio and other profile details any time in Settings → Account & profile.
  • Manage how you sign in, see your devices and sign out the others, or delete your account in Settings → Account & profile.
  • Choose who can message you, hide your online status, see blocked accounts and manage MiniApp permissions in Settings → Privacy.
  • You decide when you use AI features. The switches in Settings → AI (the floating assistant and automatic translation) control only your own use.
  • If you want a copy of your data, tell us through Settings → Bugs and suggestions.

Age

  • RestFree is meant for people aged 16 and over, and MiniApps that simulate gambling are meant for people aged 18 and over. We do not verify ages.

Contact

  • Reach the Owner through Settings → Bugs and suggestions (you need to be signed in).
Open Bugs and suggestions

Changes

  • The effective date is shown at the top of this page. We announce big changes in the site.