Privacy Policy

• Account data — your email and, depending on how you sign in, your name (Firebase Authentication, including via Google, Apple or Facebook sign-in). If you sign in with Facebook we also keep your Facebook user ID and the address of your Facebook profile picture. If you connect a social channel, the access tokens that channel issues to us (OAuth tokens for Facebook, Instagram, Threads, X, LinkedIn, and YouTube; a session token for Bluesky, where the app password you enter is exchanged for that session and not stored).
• Push notification token— if you use the Rebbel mobile app and allow notifications, a device push token (via Expo’s push notification service) so we can notify you when something needs your approval. You can disable this in your device’s notification settings at any time.
• Voice dictation— if you use voice dictation in the review chat, your phone’s own speech service turns what you say into text, which may process the audio on Apple’s or Google’s servers. We do not receive or store the audio; we receive the message only if you tap Send.
• App activity and error reports (mobile app)— the Rebbel app sends us its own error reports and a few records of what you did in it. An error report holds the type of error, a shortened message with personal details removed, a few lines of technical trace, which part of the app was open (for example sign-in, setup or the main tabs), and whether the app could carry on. Every request also tells us the app version, build number, update ID, phone operating system and version. We do not collect your device’s name, model or advertising ID. Activity records cover setup steps (for example that your first post was drafted), the plan screen (that it was opened, why, and what you tapped), how a purchase or restore went when it did not end in a plan, and problems loading plans. They are tied to your account and used to find and fix problems and to see where people get stuck. Error reports are deleted automatically after 30 days. No third-party crash or analytics service receives them.
• Brand data you provide — business name, website URL, descriptions of what you sell and who you sell to, and any images and videos you upload.
• Data we generate on your behalf — brand guides, marketing strategies, campaign copy, and AI-generated images/video, stored against your account.
• Usage/cost data— a record of each AI generation call (provider, model, and estimated cost) used to enforce your plan’s monthly generation budget.
• Connected-channel data— if you connect a Facebook Page, an Instagram professional account, a Threads profile, an X account, your LinkedIn profile, or a Bluesky account, we store the connection and use it to publish posts you’ve explicitly approved and scheduled, and to read metrics for those posts (and, where the channel provides them, basic account metrics such as follower counts) so we can show you results.
• Purchase status for subscriptions bought in the app (see Purchases in the app).

We do not collect payment card data directly — billing on the web is handled by Stripe, which has its own privacy policy.

If you subscribe in the Rebbel iPhone or Android app, the purchase is processed by Apple or Google Play, not by us. We use RevenueCat to manage those subscriptions. We receive and keep your purchase status: which store you bought from, your plan and any add-on, your billing period, whether it is in a trial, set to renew or in a payment-retry period, its renewal and expiry dates, whether it was a test purchase, and a record of purchase events such as renewals, cancellations and refunds. RevenueCat’s notices also include the price, currency and country of the purchase; we do not keep those. We never receive or store your card details.

If you connect a YouTube channel, Rebbel uses YouTube API Services to upload the video posts you approve to the channel you chose. Rebbel asks Google for permission to upload videos and to view your YouTube account, which it uses only when you connect, to see which channel you picked (its name, handle, and picture). It does not look at your existing videos, comments, playlists, or statistics, and it cannot edit or delete them.

What we keep. The encrypted authorization Google gives us, the ID, name, and handle of the channel you connected, the Google account email you connected with, and a record of which posts Rebbel uploaded, when, and the resulting video link. We do not store your channel’s other videos or its statistics. If you disconnect, we delete the stored authorization immediately.

Your control. Disconnect YouTube any time from your brand’s Connections page. You can also remove Rebbel’s access in your Google account at https://security.google.com/settings/security/permissions. To have us delete any data we hold about your Google account, email support@rebbel.io — we complete deletion within 30 days.

Rebbel’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. By using Rebbel’s YouTube features you agree to the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

• To generate your brand guide, strategy, and campaign assets.
• To publish approved, scheduled posts to your connected channels.
• To enforce per-account generation budgets (cost control) and, on paid plans, billing.
• To operate, secure, and improve the product.
• We learn from how posts and ads perform across businesses in your industry, as aggregate rates. Your words, images, customers and results are never shown to another business.

We do not sell your data.

Generating content and publishing posts necessarily sends some of your data to the providers that do that work:

• AI generation providers(subject to change) — OpenAI (text, image analysis, voiceover, and transcription), Ideogram and Recraft (images), and fal.ai (which provides the video and music models we use, currently Kling, Google Veo, and Stable Audio). Brand context and generation prompts are sent to these providers to produce copy, images, video, and music.
• AI assistants you connect— if you connect Rebbel to an AI assistant through the Rebbel MCP server (for example Claude from Anthropic, ChatGPT from OpenAI, Gemini CLI or Gemini Spark from Google, Microsoft Copilot, Perplexity, Cursor, or another assistant you choose), that assistant’s provider receives the Rebbel data you ask it to read or act on, under that provider’s own terms. We don’t send your data to an assistant you haven’t connected.
• Social platforms you connect— Meta (Facebook, Instagram, Threads), X, LinkedIn, Bluesky, and YouTube (Google). If you connect a channel, we use that platform’s API to publish posts you’ve approved and, where that channel supports it, to read post and account metrics on your behalf. For YouTube we only upload the videos you approve — see “Google and YouTube data” above.
• Email— Resend, for transactional email.
• Email/CRM— Klaviyo, which stores your account email and product-usage milestones (e.g. whether you’ve created a brand, approved a guide) for internal analytics and segmentation. We only send you product update emails through Klaviyo if you’ve explicitly opted in — see “Your choices” below.
• Infrastructure— Firebase/Google Cloud Platform (database, file storage, authentication, hosting), Vercel (application hosting), Expo (push notification delivery for the mobile app).
• Analytics— Google Analytics (GA4), to understand how rebbel.io and app.rebbel.io are used (page views, general usage patterns) — not your brand or campaign content.
• Fonts— Google Fonts. When we show you what we found on your website during brand setup, your browser requests the fonts your site uses from Google’s font service (fonts.googleapis.com), which sees your IP address and the font names, but not your brand or campaign content. We ask that no referrer be sent with the request.
• Website rendering— ScreenshotOne. When a web page we read for you (your website, when we set up and research your brand or look through it for your photos, or a link you give us to build a campaign from) doesn’t show its content until it runs in a browser, we ask ScreenshotOne to load it and send back the rendered page. ScreenshotOne receives the address of that public page, not your account details or your brand or campaign content.
• Local business search— the Google Places API. For a business that serves a local area, we search Google Places for similar businesses nearby to suggest as competitors. Google receives a search phrase made from your business category and the area you serve (for example, “bakery near Austin, TX”), not your account details or your brand or campaign content.
• Spam check on request forms— Cloudflare Turnstile. When you start filling in a request form on a page we host, Cloudflare sees your IP address and checks that a person is sending it (see “Request forms on pages we host” below).
• Billing on the web— Stripe.
• Purchases in the app— Apple, Google Play, and RevenueCat.

We do not share your account or brand data with third parties for their own marketing purposes. The Meta Pixel and Google Ads measurement for our own ads are described under “Advertising and attribution” below.

Rebbel advertises itself, and this section covers how we measure those ads. It is about visitors to rebbel.io and app.rebbel.io and people who sign up for Rebbel. It does not cover your brand’s customers or the content you make with Rebbel.

• Cookies we set— on your first visit to rebbel.io or app.rebbel.io we save a first-party cookie, rbl_ft, recording where that visit came from: the campaign tags in the link (UTM parameters), an ad click identifier the ad platform added to the link (Google’s gclid, gbraid or wbraid, Meta’s fbclid, Microsoft’s msclkid, LinkedIn’s li_fat_id or TikTok’s ttclid), the domain of the website that sent you, the page you landed on, and when that visit happened. When you arrive from a Google ad, a second cookie, rbl_gclk, records that ad’s click identifier and when you clicked. When you arrive from any ad, a third cookie, rbl_ptch, records the same kinds of details for the latest ad you clicked, replacing the previous one. These cookies last 90 days. They do not record full web addresses or the other pages you visit. If you sign up, we save these details with your account. A link we use to test our own ads can also set rbl_test, which lasts until you close your browser and marks that visit as our test so it is never counted as a real sign-up. rebbel.io runs Rebbel's own site code: it counts visits and which of our posts and ads brought them; it sets rbl_clk and rbl_src.
• Visitors from the EEA, the UK and Switzerland— if you visit from the European Economic Area, the UK or Switzerland, or from a country we can’t tell, we don’t load Meta or Google advertising and analytics tags, and we don’t set the attribution cookies above. To know that, our server sets one cookie, rbl_tags, which only says whether those tags may load (not where you are) and lasts until you close your browser.
• Meta Pixel— rebbel.io and app.rebbel.io load the Meta Pixel. It tells Meta when a page is viewed, when someone signs up and when someone creates a brand, so we can see whether our ads on Facebook and Instagram bring in signups. Our own servers decide which sign-ups and new brands are reported, so our own test accounts are not, and each one is reported once. The Pixel runs in your browser and sends Meta what it collects there under Meta’s own terms, such as Meta’s cookies and details about your browser. With Meta’s automatic matching turned on, the Pixel may also send Meta hashed (scrambled) contact details it finds on our pages, such as an email address typed into the sign-up form, so Meta can match visits to Meta accounts. Meta may also receive these website events through its own server-side connection (the Conversions API), in addition to your browser. Our own servers also send Meta, through its Conversions API, the same sign-up and new-brand events, when you approve your first post, and when you start a paid plan or pay for an upgrade or add-on, with the amount paid. With these we send a hashed (scrambled) copy of your email address and of your account reference, and the Meta cookies, IP address and browser details from the browser you signed up in, so Meta can match them; we do not send your name. Purchases made in our iOS or Android app are never sent. If you signed up from the European Economic Area, the UK or Switzerland, our servers send Meta none of these events. When you try a free preview of your first post, we tell Meta that a preview was shown, from your browser and from our servers. We use these visits to show our Facebook and Instagram ads to people who visited rebbel.io or tried a preview and haven’t signed up, and we leave out people who already have an account. We also tell Meta and Google Analytics, from your browser and from our servers, when someone spends about ten seconds on our home, preview, comparison or industry pages, scrolls through part of one, or starts typing a website address into the preview box (never the address itself). We use these to show our ads to people who visited and haven’t signed up. Google Analytics receives the same sign-up and brand events (see “Third parties” above).
• Google Ads conversions— if you came to Rebbel from one of our Google ads and then sign up, create your first brand, or start a paid plan or pay for an upgrade or add-on on our website, we tell Google Ads that this happened. We send the ad click identifier from the cookie, the time it happened, the amount paid for a plan, a reference number of ours so Google can drop duplicates, and, for a sign-up, a scrambled (hashed) copy of your email address so Google can match the sign-up to the ad click. Google can’t read your address from it. We don’t send your name or other personal details. Google uses it to report how our ads perform. We may also import the Google Analytics sign-up event into Google Ads as a conversion for the same purpose.
• Apple Ads in the Rebbel iOS app— if you installed the Rebbel iOS app after seeing one of our Apple Ads, Apple provides an attribution token that our subscription provider, RevenueCat, uses to tell us which Apple Ads campaign led to the install. It does not use your device’s advertising identifier, and it is not used to track you across other companies’ apps or websites.
• Google Play install referrer in the Rebbel Android app— the first time you sign in on the Android app, it reads the install referrer Google Play keeps for it (the campaign tags of the link that led to the install, such as whether it came from one of our Google ads) and sends it to us once. We save where the install came from with your account. It does not use your device’s advertising identifier.
• Your choices— you can block or delete cookies in your browser settings. Rebbel works without them; we just can’t tell which ad, if any, brought you. You can also manage ads in Google’s My Ad Center and in your Facebook ad preferences.

Rebbel hosts web pages for some businesses, and a page can have a form for sending that business a request. This section is for visitors who send one.

• What the form collects— what you type into it: your name, a phone number or email address, your message, and any other details the form asks for, such as a service address, a date, or how many people or guests. We send your request to the business you wrote to, in its Rebbel account. The owner may also get a phone notification that a request arrived, with no details about you or from your message.
• How long it is kept— form messages are kept for 12 months, then deleted.
• The spam check— to stop spam, the form uses Cloudflare Turnstile, which sees your IP address when you start filling in the form. Cloudflare handles that under its own privacy policy. Rebbel does not keep your IP address: it is not stored with your request, and to stop repeated sends a one-way key made from it counts requests for up to a day, then expires and is deleted. Like any website, the host keeps standard request logs (such as an IP address and browser type) to deliver the site and keep it secure.
• Ad measurement— where the page may measure visits (never in the European Economic Area, the UK or Switzerland, or where we can’t tell your country), we may tell the Meta or Google advertising account that runs that business’s ads that a request was sent, with the ad click identifier if you arrived from an ad. Meta also receives your IP address and browser type to match it. Neither receives what you typed into the form.
• Your choices— to get a copy of your request or have it deleted sooner, ask the business you wrote to.

Your brand, campaign, and account data is retained for as long as your account is active. Your conversations with Rebbel are kept for as long as your account is active, so Rebbel can pick up where you left off. Deleting your account deletes them. If you request deletion, we’ll delete your data within 30 days. Requests visitors send through a form on a page we host are kept for 12 months, then deleted.

Rebbel and its service providers process data in the United States. If you use Rebbel from another country, your data is transferred to, stored and processed in the United States.

• You control every publish — nothing goes to a connected channel without your explicit approval and scheduling action.
• You can disconnect a social channel at any time from the Rebbel dashboard.
• Product update emails are opt-in only — you’ll only receive them if you explicitly checked that box (at sign-up or when connecting an AI assistant), and every email includes an unsubscribe link.
• Deleting your account.In the Rebbel app, go to You → Delete account, or email support@rebbel.io from the address on your account and we will do it for you within 30 days. Deleting your account deletes your sign-in at once and stops anything scheduled from posting. It also deletes your brands and everything in them — brand guides, strategies, campaigns, posts, pictures and videos, results, research, competitor notes and chat — your connections to social accounts and the access we stored for them, your plan record, and your app activity and error reports. Most of this is gone within minutes and all of it within a day. If an ad you started through Rebbel is still running, we stop it before deleting that brand, which can take longer. A plan bought on the web is cancelled. A plan bought in the App Store or Google Play keeps renewing until you cancel it in your store account, and the app tells you so first. Posts already published on your social accounts stay there; delete them on each platform if you want them gone. A picture or video that another Rebbel account also uses (for example, the preview image made for a website two people both tried) stays for that account. We keep a record that an account was deleted (with no content, and your email address only until our email service accepts the deletion, and never more than 30 days after we stop trying), which store plan was still active if there was one (so we can help with a refund), and the payment records that Stripe, Apple, Google and RevenueCat keep as the law requires. If you added money to an ad balance, we also keep the record of those payments and refunds, as financial records the law requires us to keep. We also ask our email service to delete your address and everything it holds about you.
• If you signed in with Facebook or connected a Facebook, Instagram or Threads account, you can also remove Rebbel in that app’s settings (Apps and Websites) and ask it to delete your data. We delete the Facebook sign-in and the connected accounts and access tokens we find linked to that account, and you get a confirmation code with a link to a data deletion status page (rebbel.io/data-deletion). If you used Rebbel with a different sign-in, email us as above so we can find the rest.
• You can opt out of contributing to those industry rates by emailing support@rebbel.io; you still see them.

Rebbel is a business tool intended for users 18 and older. We do not knowingly collect data from children under 13, and if we learn we have, we’ll delete it.

We’ll post material changes to this page with a revised “Last updated” date above.

support@rebbel.io