Privacy

Reading needs no account, and nothing tracks you while you read. If you make an account, this is everything we keep and how to make it go away.

Last updated 31 October 2026Covers arabbithole.org and the ARABBITHOLE Android app

No adsNone on the site, none in the app. The app removes the advertising ID permission.

No analyticsNo analytics, tracking pixels or tracking cookies, on the site or in the app.

Not soldWe do not sell, rent or share your data with anyone beyond the services named below.

Who runs it

ARABBITHOLE is run by Big Bad Agency, 1616 1 Street NE, Calgary, Alberta T2E 4A1, Canada. Questions about this page or your data: [email protected].

What we keep

The app is the same site, packed inside an Android shell, so everything below applies to both.

WhatWhere it livesWho can see itHow it goes away

Holes you explored, your guessesWhere it livesYour browser or the app’s storage onlyWho can see itOnly you. It is never sent to usHow it goes awayClear this site’s data, or uninstall the app

Your email address and account IDWhere it livesOur account database (Supabase)Who can see itYou, and usHow it goes awayDelete your account

Sign-in sessions: when you signed in, IP address and browserWhere it livesOur account database (Supabase), for securityWho can see itUsHow it goes awayDeleted with your account

Cases you followWhere it livesOur account databaseWho can see itOnly you (and us, through the database)How it goes awayUnfollow, or delete your account

Carrots you gave (one per case)Where it livesOur account databaseWho can see itOnly you. Everyone else sees a total per case, with no namesHow it goes awayTake it back, or delete your account

What you send for review: its type, headline, details and optional linkWhere it livesA private review queueWho can see itYou and our reviewers. Never published as you sent itHow it goes awayDelete your account

If something you send helps a case, the case cites the source it points to, never you. While you are signed in, your browser also keeps the sign-in session so you stay signed in; signing out removes it.

Who handles it for us

Supabase runs the account database and sign-in, on servers in the United States (us-east-1). It also keeps its own short-lived service logs.
Hostinger sends the 6-digit sign-in code to your email.
Cloudflare hosts the website. Like any web host it handles each request, including your IP address, to deliver the page.

What the pages load from elsewhere

To draw the pages, the site and the app fetch fonts from Google Fonts, the sign-in library from jsDelivr, and the drawing library for the case scenes from unpkg. As with any web request, those services see your IP address and browser details when they send the file. We receive nothing from them. Sources on a case open the source’s own website, which has its own policy.

Deleting your account

In the app or on the site:

Sign in and open Account.
Under Delete my account, type DELETE and confirm.

What is deleted: your sign-in (email address and account ID), your sign-in sessions, the cases you follow, the carrots you gave (case totals drop by yours) and everything you sent for review. It is removed from the database at once and cannot be undone.

Can’t sign in? Email [email protected] from the address you used and we will delete it within 30 days.

Deleting your account does not touch what your browser keeps for itself (holes explored, guesses). Clear this site’s data, or uninstall the app, to remove that too.

Children

ARABBITHOLE is not directed at children under 13. If you think a child has made an account, email [email protected] and we will delete it.

Changes

If what we keep or load changes, this page changes first, the date at the top moves, and the change is described here.

Big Bad Agency · 1616 1 Street NE · Calgary, AB T2E 4A1 · Canada · [email protected]