Arbito Account Privacy Policy

Effective Date: July 30, 2026 · Last Updated: October 19, 2026

Your Arbito account is one sign-in that works across the apps made by Arbito LLC ("we," "us") — including Rufio Stats, TaDo, Arbito Market, and Chapter & Verse: Merge Books. The account is hosted at id.arbito.co. This policy covers the account itself: what we store to let you sign in, and what happens to it.

Each app also has its own privacy policy covering the data you create inside that app (your stats, tasks, listings, and so on). Those are listed at arbito.co/privacy.

1. What we collect for your account

Sign-in details: your email address, a display name, and either a password (stored only as a salted hash — we cannot read it) or the identifier returned by Google or Apple if you sign in with them.
Verification and security records: whether your email is verified, one-time codes we email you (for signing in, resetting a password, or confirming account deletion — these expire in minutes), and the session tokens that keep you signed in.
Age confirmation: a record that you confirmed you are at least 13 when you created the account. We do not collect your date of birth.
Sign in with Apple: if you use it, a token from Apple that lets us disconnect the link when you delete your account.
Optional profile: an avatar photo or short bio, if you add one.

We do not collect your location, contacts, or browsing history, and the account has no advertising or tracking identifiers.

Optional shared profile pictures

Where picture settings are available, you can choose initials, a saved avatar design, or a photo you select. Arbito stores your picture choice, avatar design, uploaded picture derivatives, review status, and picture reports or blocks. The same selected picture is used by your connected Arbito apps; editing it does not make a private task list, workout, or profile public.

Uploaded photos are processed on Arbito's server to remove embedded metadata and make square versions. We do not keep the original upload. We use Cloudinary to store the processed shared profile pictures. When you choose a new shared photo, supported apps show it privately to you while other people keep seeing your previous public picture. It is available only to you and authorized reviewers until approval. Approval makes it public automatically if it is still your chosen photo; choosing another picture first cancels that switch. Older apps may require explicit selection after approval. If a photo is not approved, your previous picture remains public and returns in your own view; review status is available in picture settings. An approved public profile photo is accessible to anyone with its image link, even if another part of an app is private. Your saved avatar remains available when you choose a photo.

You can remove a photo or switch to initials in picture settings. Switching to an avatar or initials keeps a saved photo private for reuse; use Remove photo to delete it. Choosing another approved photo removes the previous retained photo; review decisions can also remove a picture. Account deletion schedules removal of stored picture files. Removal from active display happens before file cleanup; supported app and server caches normally revalidate within five minutes; offline or saved copies can remain longer, and copies another person saved may remain outside our control. Restricted recovery backups may retain removed data until their applicable retention period expires. Review and safety records are used to operate and protect the account service. Contact support@arbito.co to report a picture or ask about removal.

2. How we use it

To sign you in to Arbito apps and keep those sessions secure.
To send account emails: verification links, one-time codes, password-reset links, and deletion confirmations. We do not send marketing email to your account address without asking separately.
To prevent abuse (rate limits, suspicious-sign-in protection).

3. Who sees it

Recipient	Why	What they get
The Arbito app you sign in to	So the app knows who you are	Your account ID, email, and display name (via a signed token)
Google / Apple	Only if you choose them for sign-in	The sign-in exchange you authorize
Resend	Delivers our account emails	Your email address and the message
Railway	Hosts our servers	Data processed to run the service
Cloudinary	Hosts processed shared pictures and restricted recovery history	Picture derivatives and limited account/picture identifiers used for restore safety; no original photo, email address or report text is included in that history

We do not sell your information, and we do not share it with advertisers.

4. Deleting your account

You can delete your Arbito account at any time:

In the app: Settings → Delete account in TaDo, Arbito Market, or Chapter & Verse: Merge Books. In Rufio Stats it is under Settings → Account, where you can also choose to delete only your Rufio Stats data and keep the account.
On the web: follow the steps at arbito.co/account.
By email: write to support@arbito.co from your account address.

In the app, deletion is confirmed with a 6-digit code emailed to you (or your password). It is permanent, and it disconnects Sign in with Apple where a token is on file.

Deleting the account also deletes your data in the connected Arbito apps: Arbito Market's data is removed at once, and TaDo and Chapter & Verse: Merge Books are told to delete what they hold about you in the same step. Rufio Stats deletes its data through its own deletion flow (rufiostats.com/account-deletion); if you delete your account somewhere else and also used Rufio Stats, tell us and we will remove that data too.

5. Retention and security

We keep account data for as long as the account exists. One-time codes expire within minutes; sign-in sessions expire and are revoked when you change or reset your password. Data is encrypted in transit, and passwords are never stored in readable form.

Where shared profile picture settings are available, we keep a restricted recovery history of limited account identifiers and opaque picture identifiers, including a private Cloudinary archive, to prevent a recovery from bringing back a deleted account or removed picture. This history does not contain the photos, email addresses or report text. We retain it while it is needed to keep applicable backups from restoring removed data; authorized operators use it during recovery. Restricted backups may retain removed data until their applicable retention period expires.

6. Children

Arbito accounts are for people 13 and older, and sign-up asks you to confirm that. We do not knowingly let children under 13 create accounts; if you believe one exists, email us and we will remove it.

7. Changes and contact

If this policy changes in a meaningful way, we will note the new date at the top of this page. Questions or requests: support@arbito.co.

Operated by Arbito LLC. This page describes our current practices in plain language.