Rabbit is made by Smitten, which is the data controller for the personal data described here. This explains what we collect when you use Rabbit, on the website or in the app for iOS and Android, why, on what legal grounds, and what say you have over it. We try to only collect what the product actually needs. For anything data-related, write to hello@tryrabbit.co.
When you sign in with Google, we get your name, email address and profile photo. When you sign in with a code that we send by email, we get only your email address.
During onboarding we ask for your name and your birthday, and for a photo if your account has none. Rabbit makes your username from your name, and you can change it. You can also write a short bio in Edit profile.
We store what you do on Rabbit: the Bits you post (uploaded HTML files or links) and their posters, the comments you write, the Bits you like, repost, save and share, the profiles you share, the people you follow and block, and the reports and feedback you send.
When you make a Bit with Rabbit AI, we keep a draft so you can come back to it: what you asked for, the conversation with Rabbit AI, and the document it wrote. A picture you attach to an ask is not part of that. It goes to the model as direction, and we never store it. Drafts are yours alone. Nobody else sees one unless you post it as a Bit.
When you open a Bit, we keep that you opened it and how much time you spent in it. We also keep how you found it: for example the feed, a profile, search, or a link that someone sent you. For a link, we keep who sent it. For a repost in your feed, we keep who reposted it. When another website sent you, we keep the name of that website, such as linkedin.com, and not the rest of its address.
Before 5 October 2026, we did not keep whose link you opened. For a Bit you opened while signed out between 15 September and 5 October 2026, we use our analytics once to find whose link you opened. The creator sees these opens only as numbers, and never who opened the link.
When you visit a profile, we keep the visit, one for each profile each day, and how you came to it in the same way.
In the app, when you open the card about a creator on a Bit, we keep it as a visit to their profile. We never show your name for it.
When you search, we keep which creators your results showed, once a day for each creator. We keep you only as a key that changes every day. The key does not hold your name or your account. We keep the day of the search, not the time. Within a day after that day ends, we delete the secret that made the key. We delete these records after 90 days.
When you are signed in and open a link that someone sent you, we keep that you opened it. We keep who sent it, where they sent it (for example WhatsApp or email) when the link says so, and the website you opened it from. We keep only the first time you open each link.
When you open a Bit or a profile without an account, we count you with a random key that lasts one day. See Cookies and sessions.
Before you have an account, the website remembers the last Bits you opened in that browser. When you make an account, it sends them to us once, so we can suggest their creators to you, and then it forgets them.
We keep which Bits the feed showed you, so it can show you Bits you have not seen. The website also remembers the Bits it showed you before you made an account, and sends them to us when you sign in, for the same reason.
When you make an account after you open someone's link, we keep who brought you. We can tell that person, by name, that you joined, and they see you in their list of people who joined through their link.
We keep your time zone, from your phone or your browser. We use it so that our messages do not arrive at night. Each night we also work out the hour when you usually open Rabbit, from when you use it, and we send the daily message at that hour.
If you allow notifications in a browser, we keep that browser's push address against your account. The browser's own push service delivers our notifications to it.
We keep a record of the emails and notifications that we send you. When you tap a notification, or a link in one of our emails, we can keep that too.
Some Bits save things on your device, such as your progress. When you are signed in, we keep a copy in your account, so it follows you to your other devices.
When you ask to open a Private Bit, Rabbit keeps that you asked, which Bit, and when. The creator of the Bit sees your name, username, and photo with your ask. If the creator says yes, Rabbit keeps that until the creator removes you, or until the Bit or one of the two accounts is deleted. If the creator says no, Rabbit keeps the day for 7 days, so that it can tell you when you can ask again. Rabbit deletes it within a day after that.
Like most websites, our servers also keep short-lived technical logs (things like IP address, browser type, and the pages requested) that we use for security and keeping Rabbit running. The record of each sign-in also keeps the IP address and the browser it came from.
To run your account and show your profile, feed, and the Bits you've posted or reposted to other people. That's performance of our contract with you (GDPR Article 6(1)(b)).
Your birthday tells us you're old enough to use Rabbit, and technical logs help us prevent abuse and keep the platform secure. Those rest on our legitimate interests in running a safe, lawful service (Article 6(1)(f)), and on legal obligations where the law requires age safeguards or that we act on illegal content (Article 6(1)(c)).
We count who opens each Bit and who visits each profile, we show creators what their Bits reach, and we suggest people you may know. The sections below say how. This rests on our legitimate interest in showing creators who their work reaches, and in helping people find each other (Article 6(1)(f)).
To see how Rabbit is actually used and to fix what's broken, we measure what happens in it. Analytics on the website and in the app, along with operational diagnostics, rest on our legitimate interest in understanding and improving the product (Article 6(1)(f)). The section below says what that involves. We also use our analytics once to count how many people opened a creator's link before 5 October 2026.
We don't run ads, and we don't sell or share your personal data. We do keep an analytics profile of how you use Rabbit, described below, but we don't use it to make automated decisions about you that have legal or similarly significant effects.
Profiles are public, unless their owner makes them private. Anyone can see a public profile, signed in or not, and search engines can list it.
Your profile shows your name, username, photo and bio. It shows how many Bits you have, how many people follow you and how many people you follow. Anyone can see who follows you and who you follow. It also shows your Public Bits, the Bits you repost, your comments on Public Bits, and a leaderboard place when you earn one.
Likes, reposts and comments are public. Anyone can see who liked a Bit. When you like, comment on, repost or share a Bit, or follow someone, Rabbit can tell that person, by name. When you like or repost a Bit, Rabbit can also tell the people who follow you.
A comment on a Link only Bit shows only with that Bit. It never shows on your profile.
When you share a Bit or a profile from Rabbit, the link carries a code for you. A person who opens it can see that you sent it.
Some Bits keep a board of scores. When you save a score, the board shows your name and your score to everyone who opens that Bit. The Bit can also read the board, with the names on it.
Your saves are private. A creator sees how many people saved a Bit, never who.
Your email, birthday, time zone and technical logs are never shown publicly. The Bits you open and the profiles you visit are not public either. See What creators see.
You can make your profile private in Settings.
Then a person you did not accept sees only your name, username, photo, bio and how many people follow you. This is also true for a person without an account, and for a person you blocked.
Only followers you accept see your Bits, the Bits you repost and the comments on your profile.
They also see who follows you, who you follow and how many Bits you have.
A private profile is not on the leaderboards.
A private profile cannot hide some things. Search engines can still list your profile, with what everyone sees. Your comments on other people's Bits stay on those Bits. The list of who liked a Bit still shows your name. Your name still shows in the lists of who follows a public profile, and who a public profile follows. A Bit's board of scores still shows your name and score. The person who made a Bit you repost still sees that you reposted it.
When your profile turns private, the people who follow you stay followers.
If a profile is private, Follow sends a request. Rabbit keeps the request until that person answers it, or until you take it back. Rabbit does not tell you if they decline it.
The owner of that profile sees your name, username, photo and when you asked, on their Requests page. Rabbit also tells them your name by push or email. When they accept, Rabbit tells you.
When you make your profile public again, Rabbit accepts every request that waits, except a request from a person you blocked.
When you post a Bit, you choose who can open it: Public, Link only or Private.
If your profile is private, a Bit set to Public is for your followers only. Rabbit calls it Followers. Only followers you accept can find it and open it.
Anyone can open a Public Bit, with an account or without one. It is in the feed, in search and on your profile.
A Link only Bit stays out of the feed, out of search and off your profile. Search engines do not list it.
Link only is not a lock. Anyone who has the link can open the Bit, and they can send the link to other people. This is also true on a private profile.
A Bit that you add by URL stays on its own website. Rabbit only shows it in a frame. Anyone who finds that website can open it there, whatever level you choose on Rabbit.
A person who opens a Bit can keep a copy of what they see.
A creator can make a Bit Private. Then only the creator and the people they accept can open it, and see its comments and likes. Rabbit's admins can open it too, to keep Rabbit safe. Everybody else sees only its poster, its title, and its creator, with a lock.
When you are signed in, a creator sees your name when you open their Bits or visit their profile.
The creator sees your name in their lists of who opened their Bits and who visited their profile. Rabbit can also tell them in a push or an email. Nobody else sees who opened a creator's Bits or visited their profile.
These lists show only the last 90 days.
With your name, the creator sees the day, about how long you spent in a Bit, and how you came, for example from their link.
Their lists show the day, not the time.
If the creator knows you, Rabbit can tell them at once when you visit their profile.
Rabbit can also tell a creator soon after you first open one of their Bits.
On a Link only Bit, Rabbit can tell the creator by name when you first play it, save a new best score or comment. This is also true when you have no account and type a name to save a score or comment.
When you open a Bit from a repost in your feed, the creator can see whose repost it was. The creator sees this only while that person still reposts the Bit.
The creator's lists never say who else sent you a link. When a signed-in person shares a Bit, Rabbit can tell the creator who shared it.
When you share someone's profile with your code, and your link brings people to it, Rabbit can tell them your name. It never tells them who came.
The creator never sees that you opened a Bit from your saves.
Everyone else is a number: people without an account, and people who browse privately.
In these lists, a creator sees each of these numbers, never with a time or a length. A small number can let a creator guess who it was, for example when they sent their link to one person.
In these lists, a creator also sees how many people opened a link that the creator sent, and how many of them spent more than a minute in the Bit.
A creator never sees the name of a person they blocked.
A creator never sees the name of a person who blocked them.
A creator can also see how many searches showed their profile or their Bits in a week, and how many people visited their profile from search. A creator never sees who searched.
You can browse privately. Turn it on in Settings, on the website or in the app.
Then, when you open a creator's Bits or visit their profile, the creator sees you only as a number. This is also true for what you did before you turned it on.
Your likes, comments, reposts, shares and follows still show your name.
You then see the people who visit your profile and open your Bits as numbers too.
While you browse privately, opening a link that someone sent you does not count as knowing that person.
Rabbit still keeps who sent the link, as it does for every open. It never shows your name for it.
Rabbit keeps when you turned it on, and when you last turned it off.
When you turn it off, creators see your name only for what you do after that moment. You see names only for people who come after that moment.
Rabbit suggests people you may know, for example under People to follow.
To Rabbit, two people know each other when one of these is true:
A link counts only when it went by Messages, WhatsApp, Telegram or email, when fewer than 20 people opened it, and when the person did not open it from X or LinkedIn.
When you open a link that someone sent you, Rabbit can suggest people that person follows, and people who follow them.
The suggestion can show that person's name as the reason.
Rabbit does not suggest you to them because you opened it.
On a profile, Rabbit can show three people that the profile's followers also follow.
Rabbit uses only the follows of followers with a public profile. It does not show which followers follow them.
Rabbit never reads the contacts on your phone.
You can block a person on their profile. Rabbit does not tell them.
You then stop seeing their Bits and comments in your feed and in the comments on Bits.
Their likes, comments and follows stop reaching you. They do not show in your activity, and Rabbit sends you no push or email about them.
A block also ends your follow of them. They still count in your follower number, and they can still see your public profile and your Public Bits.
If your profile is private, a person you blocked sees only who you are, also if they follow you.
Rabbit uses PostHog for product analytics. In the browser it runs for every visitor, recording the pages you visit, the things you click, and the errors Rabbit hits, and it may also capture session replays: a reconstruction of a visit showing the pages you moved through and where you clicked.
The app measures the same kinds of things, minus the replay: the screens you open, when the app is launched or updated, some moments in the app, such as opening a Bit, opening a profile and sharing, and the errors the app hits. There is no session replay in the app and nothing recording your screen.
Our servers record the actions themselves (signing in, opening a Bit and how long you spent in it, searching, liking, saving, commenting, following) against your account. For website requests, these analytics events are sent for every request.
PostHog gives every website visitor an analytics profile, whether or not they're signed in, so we can see how people arrive and what they do before they make an account. When you sign in, that profile is joined to your account and tagged with your user id, email, name, username, when you signed up, and whether you've finished onboarding. This way the visits before and after you make your account read as one person rather than two.
It's ours alone: the data goes to PostHog's servers in the EU under a data processing agreement, and it never feeds ads or gets sold. To object to analytics, or to ask about data we already hold, write to hello@tryrabbit.co and we'll help with your request.
Google handles sign-in with Google and gives us the account details listed above. Vercel and the other cloud providers that host Rabbit store and serve data on our behalf, under data processing agreements, and none of them get to use your data beyond providing that service to us. Uploaded HTML Bits are served in a sandbox, kept isolated from the rest of the app.
PostHog runs the analytics above. Axiom keeps our server logs. Resend sends our email, sign-in codes too. Expo delivers the app's notifications and its updates.
When you ask Rabbit AI to draw a poster, Google's image model draws it. It gets pictures of your Bit and the directions for the poster.
Anthropic runs every other model on Rabbit, and it sees what that work needs. When you make a Bit with Rabbit AI, that's what you ask for, any picture you attach, the answers you give its questions, anything you talk through with it, and the document being written or revised. When you post a Bit, it's the Bit's title, description, and visible text, so Rabbit can tell which languages it reads in and suggest tags. When you ask for a title or a description, it's the Bit's own content and the ask you wrote. When Rabbit AI draws a poster, Anthropic checks the finished picture. While Rabbit AI works out what to ask you about, it may search the live web once for a term it doesn't know.
None of it trains a model: Anthropic's commercial terms rule that out. None of it is kept beyond answering the request and Anthropic's own checks for abuse.
We disclose personal data outside that circle only if the law requires it, for example a valid order from a court or authority.
Our providers may process data outside the European Economic Area, including in the United States. When they do, the transfer is covered by an EU adequacy decision such as the EU-US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses.
The app talks to the same servers as the website. If you allow notifications, it registers a push token for that phone and we store it against your account, so we know where to send word of a like, a comment, or a new follower. With the token, the app sends the name of the phone, its time zone and the version of the app. Notifications travel through Expo's push service and then Apple's or Google's to reach your phone. Signing out withdraws the token, and deleting your account removes it.
On launch the app also asks Expo whether a newer version of itself is available, which tells Expo the platform and version you're running.
When you open a Rabbit link in the app while you are signed out, the app keeps the code of the person who sent it on your phone. The next time you use the app signed in, the app sends the code to Rabbit and deletes it. The first time you open the app more than 30 days after the link, the app deletes the code. If you made your account in the 30 days after the link, Rabbit keeps who brought you, the same as on the website.
The app bundles PostHog for the measurement described above, including the errors the app hits, and no other crash reporter. In the app you can edit your profile, change your settings and delete your account, the same as on the website.
We keep your data while your account is active. You can edit your profile at any time, on the website at /profile/edit or in the app. You can delete your account in Settings, on the website or in the app. The steps are written out at /delete-account. Deleting your account removes your account, your Bits, your comments, your likes, reposts and saves, your follows, and your drafts. The Bits you opened stay in their creators' numbers, with no name. Feedback and reports you sent stay, with no name. So do the times you shared a Bit or a profile. Copies in backups and technical logs age out on a rolling schedule shortly after, and we may retain specific records longer where the law requires it, for example evidence tied to a report of illegal content.
Rabbit keeps your usernames for one year after you delete your account. In that time, nobody else can take them.
Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, and take it with you in a portable format. Write to hello@tryrabbit.co and we'll respond within a month. You also have the right to lodge a complaint with the data protection authority in the country where you live.
Rabbit accounts aren't for children under 13, or under the age in your country for consenting to data processing (up to 16 in parts of the EEA) without a parent or guardian's permission. If we learn an account belongs to a child below that age, we'll delete it and the data that came with it. Parents and guardians can reach us at the address above. Our Child Safety Standards say what is never allowed on Rabbit and how to report it.
We may update this policy as Rabbit changes. If a change is material, we'll let you know before it takes effect.
Questions about this policy or your data? Reach us at hello@tryrabbit.co.