TheyRave
Privacy
Last updated October 11, 2026
What TheyRave keeps about you, why, and for how long. Written to match what the site does.
1The short version
We keep what the site needs to work and nothing else. Visitors to a creator’s page get no cookie and are not tracked. A reviewer leaves what they type into the form and, for one day, a scrambled key made from their connection so one connection cannot flood a page. A reviewer who chooses Confirm with X also leaves a scrambled code made from their X account. A creator’s account holds an email address, a handle and a scrambled password, and their card details never reach us. We do not sell data and we show no ads.
2If you visit a page
Opening a creator’s page sets no cookie. We count that the page was opened, that the review form was opened, that a review was sent, that the embed widget loaded, or that a creator’s badge picture was drawn (a monthly total per page, kept as it is), and if you came from another website we keep the name of that site. The count holds nothing about you: no address, no browser, no device, no id. Those counts are deleted after 90 days. If you follow one of our own links to this site, such as the line at the foot of a creator’s page, we set one cookie for 30 days holding a single word for where that link was, such as footer. If you then sign up, that word is kept on your account so we can tell which links bring new creators. It holds nothing else.
We also count how many times the share picture page of one review was opened, and how many visits to the creator’s page came from the link on that picture. Each count is the review’s number and the time, nothing about you, and is deleted after 90 days.
Fonts on every page come from Google Fonts. Your browser fetches them from Google directly, so Google sees your IP address and which fonts were asked for, under Google’s own terms. Our hosting provider, Vercel, keeps ordinary server logs for a short time to run and protect the service, which include your IP address and the page you asked for.
3If you leave a review
A review holds what you typed: the words, your name and X handle if you chose to give them, your answer to whether you would buy again, and the time it was sent. If you came through a one time link, the review is marked as verified. We do not record your email address or anything about your device. When you send a review we make a scrambled key from your network address, the page and the day, and keep it until the next day, only so that one connection cannot send a page more than a few reviews in a day. The key is not your address and is never attached to your review. Somebody holding our secret could test whether a given address matches it, which is why it is deleted the next day.
If you choose Confirm with X, we ask X once for your account id, your username and the year the account was opened. We keep a scrambled code made from the id, so one X account can confirm one review per page and a creator cannot confirm a review of their own page. The same account makes the same code on every page, so we can tell when one X account has confirmed reviews on several pages, or is the X account a creator here signs in with. We keep the year, and the review shows it. Your username is kept only if you leave Show my X handle on the review ticked. Choosing this sets two cookies that last fifteen minutes while you finish the form. We never store a way to sign in as you, and we never post for you.
The creator reads it first, and once they approve it, it is public: on their page, in their embed widget if they use one, and in the spreadsheet they can download. Your name and handle are shown as plain text and never turned into a link. A review is stored until the creator deletes it or closes their account.
A Supporter page can open an Ask before you buy box. A question you type there is stored as you typed it, with no name and no email, and is seen only by the creator until they answer it and choose to show it on their page. You are given a private return address, a long random link that anybody holding it can open, and we cannot find it again if you lose it. To count questions we keep a one-way key made from your connection, as for reviews, and blank it after two days. The creator can delete a question at any time.
After you send a review you are shown a private receipt address, a long random link that anybody holding it can open. It shows your words, your name as you typed it, whether the creator has put the review on their page, their reply, and a private thank-you if a Supporter creator wrote one. It holds nothing else about you, we do not email it, and we cannot find it again if you lose it.
A Supporter can make a report link for a page, a long random address that opens that page’s counts and referring sites without a sign-in, for anybody who has it. It shows no email or account details, and no reviewer names. It stops opening after thirty days, and the creator can turn it off at any time.
To have a review removed, ask the creator, who can do it from their dashboard. If you cannot reach them, email hello@theyrave.com.
4If you have an account
Your account holds your email address, the name and tagline of each of your pages, your appearance settings, and your password as a scrypt hash, which is a scrambled form that cannot be turned back into the password. We never store or log the password itself. If you connect X, we keep the id and display name X gives us and nothing else; we cannot post as you and we never read your timeline.
Signing in sets one cookie on theyrave.com, a signed token that says who you are. It lasts 14 days, and signing out clears it. To protect the account, we count wrong passwords in a row and pause password sign-in for 15 minutes after five of them. The email link keeps working during that pause.
Your reviews, the verified links you have made, the tags you have set, any reply you have written, and the names you have given up are all stored on your account for as long as it is open.
A verified link you make from an earlier review remembers which review it came from. If the person writes again, your page shows the two together with the gap between them. You never see who they are, and the pair is hidden if either review is hidden or deleted.
Your goal, a number and a date, and the time you copied a follow-up message for a link are stored on your account. Only you see them.
Up to five saved replies and your protect list of words are kept on your account too. Only you can read them, they never appear on a public page, and a moderator you add sees a word marked in a review but never the list. A moderator's one-line note to you about a review, your answer to it, and the day you schedule a waiting review to go live are kept on your account and seen only by you and your moderator. The top of your dashboard shows one of your own approved reviews or praise lines, by first name only. Your browser keeps the id of the last one shown, in its own storage, so a different one comes up next time. That id never leaves your browser.
A note you send with the Feedback button keeps what you wrote, the kind of note you picked, the page you were on and any screenshot you add. Unless you switch them off under What gets sent with this, it also keeps the words on the last few buttons you pressed, never anything you typed elsewhere; your browser and its version, your graphics chip, and your screen and window size; the site's error log from your browser; and from the backdrop studio, your design and a picture of the canvas as you saw it. Your choice is kept on your account. The people who run TheyRave read it, with help from an AI assistant, to fix what went wrong, and any reply is shown to you.
5If you pay for Supporter
If you schedule a saved look, we keep its start and end days, the look it replaced, and a long random address for the skip link in the one email we send before it goes live. If you add a drop to your page, we keep its name, day and line. A visitor who presses Put it in my calendar gets a file made from what the page already shows. We set no cookie and keep nothing about them.
Payment goes through Stripe. Stripe asks for your card and an email address for receipts on its own page, and none of that reaches us. What we keep is Stripe’s id for you as a customer, the id of your subscription, the date you are paid up to, and whether the plan is set to renew then. Stripe keeps its own records under Stripe’s privacy policy, and the law requires it to keep some of them after you cancel.
6Email we send
We send sign-in links, one email when a review arrives on your page (never more than one an hour, however many arrive), and notices about your account, such as a payment that failed or a change to these pages. We do not send marketing email, and if we ever want to, we will ask first and you can say no.
Three more emails go to you alone, made from reviews and counts we already keep: a review's words and a link to its share picture on its three month, six month and one year anniversary, last month's counts and best reviews on the first of each month, and, three days before a Supporter renewal, the last thirty days' counts. The first two stop with Review emails in your settings. Which dashboard cards you have dismissed is kept in your own browser, not on our servers.
Email is sent through Resend from hello@theyrave.com. The subject line of an email from us never says what you sell.
7Who else handles your data
Five companies run parts of the site for us and see data in the course of doing so. Neon stores the database. Vercel hosts the site and serves every page. Resend sends email. Stripe takes payment. Google Fonts serves the fonts. If you sign in with X, X tells us who you are. Each one handles data under its own privacy policy, and none of them is given your data for any purpose except running the site.
Every review picture carries a short code that anybody can type into the check page to see that review as it stands on the page today. The code is worked out from the review’s number and stored nowhere, and the check page shows only what the review’s own share page shows.
We do not sell data, share it with advertisers, or hand it to anybody else, unless the law requires us to or it is needed to protect the site or somebody using it.
8How long things are kept
Sign-in links expire after 24 hours and are deleted once used or once expired. Page counts are deleted after 90 days. Your account keeps the times of your last two dashboard visits, so it can show what changed since you last looked. Everything on an account is kept while the account is open and deleted when the account is closed, along with every page, review, link and setting on it. The one exception is your handles: they stay parked for 60 days so nobody else can take one in that time, and they point at nothing once your account is gone.
9What you can ask for
You can see and change most of what we hold from your dashboard and your account settings. Supporters can download every review as a spreadsheet. Download everything, on your account settings, gives anybody a copy of everything we hold about them, and Delete my account deletes the account and everything on it at once. You can also ask for either, or for a mistake to be corrected: email hello@theyrave.com from the address on the account and we will do it within 30 days. We keep the date of your last download, to tell you how much has arrived since, and the number of reviews you say you had elsewhere; only you see either. The new address banner's notice and the address you write are shown on your page only while its switch is on. For a Supporter's own domain we keep when it was last found pointing at us and a renewal date you type, to email you; only you see either. A quarter book is built from your approved reviews when you open it, is not stored, and only you can open it.
A reviewer who wants their words removed should ask the creator first, then us. We will act on it without needing to know who you are.
10Under 18
Accounts are for people aged 18 and over. We do not knowingly keep an account for anybody younger, and if we learn of one we will delete it.
11Rivals and watching
If you invite another creator to be friendly rivals and they accept, each of you sees the other’s public figures (reviews, verified reviews, replies and the age of the newest review) on your own dashboard and in the Monday email, and ending it deletes the pact. We send nothing to them. If you turn on Let other creators watch my page, a Supporter can add your page to a list of up to three they watch. They see only figures already public on your page, and you see only how many pages watch you, never which.
12Keeping it safe
Every page is served over HTTPS. Passwords are stored as scrypt hashes. Sign-in tokens are signed so they cannot be forged. Verified links work once. No system is beyond fault, and if a breach ever exposes data about you, we will email every affected account as soon as we know what happened.
13Changes to this page
The date at the top is the date of the current version. If we change what we collect or who we share it with, we will email every account before the change takes effect. Questions go to hello@theyrave.com, and the person who runs the site is the one who answers them. The site is run from Illinois, USA, and this page is governed by the same law as the terms of service.
Questions about either page go to hello@theyrave.com. A person reads that inbox.