Draft, pending legal review. This page isn't final and needs a solicitor's review before launch. Anything highlighted still has to be filled in or confirmed.

Privacy

Robin Hood Data helps you get a copy of your data from the companies that hold it and understand it on your own computer. This page says what we can and can't see, and what we keep.

Last updated: [LAST UPDATED DATE]. See also our terms of use.

Who runs this site

The data controller is [CONTROLLER NAME], [CONTROLLER ADDRESS]. To contact us about your data, email [CONTACT EMAIL].

Your exports

Exports are processed in your browser and never reach our server. The import tool's code is downloaded from our site, then it does all its work on your device. We don't receive your files, or anything made from them. Our web traffic can show that your browser loaded the tool. It doesn't show what you opened in it.

The tool only reads files it recognises. Files and folders whose names point to messages, contacts, followers, photos or videos are skipped without being opened. This goes by name, so a file with an unusual name could still be read. TikTok's export is a single file, so any direct messages in it pass through your browser's memory while it's read. They're dropped there and never stored.

The tool's database is kept in your browser's private storage and in any copy you choose to save. It holds your activity: times, services, actions, titles and amounts. Activity can include other people's details, such as a name in a title or a delivery on a shared account. We can't read the database or recover it. It isn't encrypted by the tool, so anyone who can use your browser profile, or who has a saved copy, may be able to read it.

Topic suggestions are optional. If you turn them on, your browser downloads a model from our site, and the titles are processed on your device and stay there.

Normal web traffic

The site still sees normal web traffic. Like any website, our server and our hosting provider receive your IP address, your browser type, the pages you ask for and when you ask for them. We use this to deliver pages and keep the site secure. That information is about your visit, not about your exports.

Our application doesn't keep its own log of each page request. The web server in front of it may. [ACCESS LOG DETAILS: what the hosting proxy records] Those logs are kept for [RETENTION PERIOD: SERVER LOGS]. Our legal basis is [LAWFUL BASIS: WEB TRAFFIC].

We use no analytics and no advertising trackers, and every script, style and font comes from our own site.

The waitlist

Joining is optional. If you join the waitlist, we store the email address you give us, your researcher or participant choice if you make one, and the date you joined. We use it to tell you when sharing or buying data becomes possible. We don't send anything when you join, and we don't check that the address is yours. If someone has added your address, tell us and we'll remove it.

Our legal basis is [LAWFUL BASIS: WAITLIST]. Entries aren't deleted automatically at the moment. We'll keep them for [RETENTION PERIOD: WAITLIST].

To remove your address, email [CONTACT EMAIL] from that address, and we'll delete the entry.

To stop abuse of the form, we keep a temporary count of attempts from each IP address, stored as a hash and not as the address itself. It lasts for about an hour. Our legal basis is [LAWFUL BASIS: ABUSE PREVENTION]. The picture check is generated on our own server and isn't linked to you.

Errors

When the site breaks on our server, an error report can go to our error-tracking service, Rollbar. A report holds the web address, the time, your browser details, the page you came from and a shortened IP address. It leaves out the email field of the waitlist form, and cookies. A page that can't be found isn't reported.

When this site's own code fails in your browser, including in the tool, your browser can send us a short report, and we pass it to Rollbar. It's sent at most five times per page, and only if you're online. It holds only these fields:

  • The type of error, from a fixed list, such as TypeError.
  • A fixed code for how it surfaced, such as page-error.
  • The name of our script file, and the line and column.
  • The area of the site, from a fixed list: home, wizard, tool, waitlist, about, privacy, terms or other.
  • Your browser family: Chrome, Edge, Firefox, Safari or other.

We reject anything else. It never holds the error's message, your titles, searches or records, the web address, your browser's full details or your IP address. Our server still sees the request as normal web traffic, keeps a temporary count of reports from each IP address, stored as a hash, for about a minute, and doesn't store the report. Errors from browser extensions and other sites' scripts aren't sent.

We use reports to find and fix faults. Our legal basis is [LAWFUL BASIS: ERROR REPORTS]. Reports are kept for [RETENTION PERIOD: ERROR REPORTS].

Who handles this data

We don't sell your data, and we don't share it with advertisers. These companies handle data for us:

  • Hosting, including the waitlist database: [HOSTING PROVIDER AND SERVER LOCATION].
  • Error reports: Rollbar.
  • Email: none today. Before we email the waitlist, we'll name the provider here: [EMAIL PROVIDER, IF ANY].

Backups of the waitlist database: [BACKUP LOCATION AND RETENTION PERIOD].

Transfers outside the UK

[INTERNATIONAL TRANSFERS: where the host and Rollbar process data, and the safeguard for any transfer outside the UK]

AI assistants

The wizard offers a prompt to copy into an AI assistant of your choice, and a guide server at /mcp/ that assistants can connect to. Both hold only our public instructions. Copying happens in your browser, and we don't see what you paste or what you say to an assistant.

If you use a cloud AI, its provider sees what you type and any pages you let it open, under its own privacy policy. Your export files stay on your computer unless you share them.

The /mcp/ address sees normal web traffic, as described above. If an assistant's provider connects on your behalf, we see the provider's address and not yours. It needs no account, and no personal data is stored. We don't keep or log what's sent to it, and error reports leave it out. To stop abuse, we keep a temporary count of requests from each IP address, stored as a hash and not as the address itself. It lasts for about a minute.

Your browser's storage and cookies

We use no tracking cookies. Most of what this site stores is kept in your browser and isn't sent to us. Here's all of it.

WhatWhereWhyHow long
Security token (__Secure-csrftoken) Cookie, set by the waitlist page only Protects the form against forged submissions One year
Confirmation message (messages) Cookie, only if your browser submits the form without JavaScript Shows that you've joined Until the next page
Admin sign-in (__Secure-sessionid) Cookie, for site administrators only Keeps an administrator signed in. Visitors don't get it Two weeks
Wizard progress (robinhood.wizard) Local storage Remembers the services you picked and which you've marked as requested or received Until you clear it
Accessibility settings (a11yPrefs) Local storage, once you change a setting Remembers your theme, contrast, text size and motion choices Until you clear it
Recall estimates (robinhood.recall.v1) Local storage Keeps the estimates you enter to compare with your record Until you use Delete everything or clear it
Hidden suggestions (robinhood.gaps.v1) Local storage Remembers which What's missing suggestions you've hidden Until you use Delete everything or clear it
Local database Browser private storage (OPFS) Holds the activity you import, any topic suggestions, and a search index built from your titles. What you type into search isn't saved Until you use Delete everything or clear it. Your browser may also clear it, so the tool asks it to keep the data
Topic model files Browser cache (transformers-cache), if you run topic suggestions Saves downloading the model again. It holds no data about you Until you clear it
Tool code (robinhood-tool-…) Browser cache (Cache Storage) and a service worker, once you open the tool Lets the tool open and run with no connection. It holds only the tool's own code, page and icons, and it doesn't see your data Replaced when the tool updates. Stays until you clear it

Delete everything in the tool removes the local database, your recall estimates and your hidden suggestions. It doesn't remove wizard progress, accessibility settings, the model files or any copy you've saved. Delete everything leaves the tool's cached code too, which holds no personal data. To remove those, clear this site's data in your browser settings and delete your saved copies.

If you clear this data, we can't bring it back. Only a copy you saved can restore the database.

Other websites

The wizard links to the companies that hold your data. What you do on their sites is covered by their privacy policies, not this one.

Your rights

Under UK data protection law you can ask us for a copy of the personal data we hold about you. You can also ask us to correct it, delete it, limit how we use it or give it to you in a reusable form, and you can object to how we use it. Where we rely on your consent, you can withdraw it at any time. Some of these rights depend on our legal basis and have exceptions.

To use any of these rights, email [CONTACT EMAIL]. We don't receive what's in the local tool, so we can't find, correct or delete that for you. You can do that yourself in your browser.

Complaints

If you're unhappy with how we've handled your data, please tell us first at [CONTACT EMAIL]. You can also complain to the UK regulator, the Information Commission, which took over from the Information Commissioner's Office on 30 September 2026: [REGULATOR COMPLAINT LINK].

Children

[MINIMUM AGE AND CHILDREN'S WORDING]

Future features

This page covers the site as it is today. Sharing, selling and donating data don't exist yet. If they're ever built, we'd need new privacy information first.