This Privacy Policy explains how oDesk Software Co., LTD ("oDesk", "we", "us"), operator of hibug.me ("Hibug", "the Platform"), collects, uses, and protects your personal information.
1. Information We Collect
We collect the following categories of personal data:
- Account data: name, email address, password hash
- Profile data: bio, avatar, social links (provided voluntarily)
- Usage data: pages viewed, posts read, search queries, time on site, qualifying view events used to calculate author earnings
- Payment reference data: billing name, last 4 digits of card, transaction/subscription IDs from Airwallex or PayPal. We do not collect or store full card numbers, CVV codes, or bank account/routing numbers — see §7.
- Author payout data: for authors who set up a payout method — a PayPal email (stored encrypted) for donations, or an Airwallex beneficiary reference for bank/Airwallex-account payouts. Raw bank account numbers are never received or stored by Hibug — see §7.
- Author tax data: legal name, address, and tax ID, collected only from authors as required for PIT withholding and tax reporting compliance (see the Author Tax Information Guide)
- Technical data: IP address, browser type, operating system, referrer URL
2. How We Use Your Information
We use your data to:
- Provide and improve the Platform
- Process subscriptions, one-time purchases, donations, and author payouts
- Calculate author earnings and apply required tax withholding (VAT, PIT)
- Send transactional emails (receipts, password resets, post notifications, payout confirmations)
- Send marketing emails (only if you have opted in)
- Send one-time passcodes (OTP) for phone-based sign-in verification, via Firebase
- Detect and prevent fraud and abuse, including inflated-view and donation-abuse detection
- Comply with legal and tax reporting obligations
3. Data Sharing
We do not sell your personal data. We share data only with:
- Airwallex — payment processing for subscriptions/purchases and author payouts (bank account or Airwallex account)
- PayPal — donation processing and donation payouts only
- Firebase (Google) — phone number and verification state, solely to deliver OTP SMS codes for sign-in
- Resend — your email address, solely to deliver transactional and opted-in marketing emails
- Hosting and infrastructure providers (DigitalOcean — compute, database, object storage/CDN) under data processing agreements
- Law enforcement when required by applicable law
4. Cookies
We use essential cookies for authentication and security. We use analytics cookies to understand how the Platform is used. You may disable non-essential cookies in your browser settings or via our cookie preferences panel.
5. Data Retention
We retain your account data for as long as your account is active. Deleted accounts are purged within 30 days, except where retention is required by law (e.g., billing and tax-withholding records retained for 7 years).
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access, correct, or delete your personal data
- Object to or restrict processing
- Receive a portable copy of your data
- Withdraw consent at any time
Submit requests to privacy@hibug.me. We will respond within 30 days.
7. Payment & Financial Data Security
Hibug's own database never stores full card numbers, card security codes, or bank account/routing numbers. Card entry happens directly inside Airwallex's or PayPal's own hosted checkout — those numbers pass straight from your browser to the payment provider and never touch Hibug's servers. When an author sets up a bank payout, the bank details are submitted directly to Airwallex's beneficiary API; Hibug retains only the resulting non-sensitive beneficiary reference ID, never the raw account number. Financial figures we do store (transaction amounts, earnings, payout amounts) are encrypted at rest (AES-256). All data in transit is protected with TLS. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.
8. Children's Privacy
Hibug is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact privacy@hibug.me immediately.
9. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be notified by email or prominent notice on the Platform. Last updated: August 2026.
10. Contact
Data controller: oDesk Software Co., LTD, operator of hibug.me. For privacy inquiries: privacy@hibug.me.