1. Who handles your information
Flipnote World is operated by RexiMemo, which is responsible for the personal information processed for this site. Contact rekunote@gmail.com for privacy questions, access or deletion requests, or complaints.
This policy covers World accounts, documentation contributions, the forum, attachments, embedded players, project submissions and the integrated Git service. RexiMemo's own website and account services are covered by its separate Privacy Policy. You can use a standalone World account without linking RexiMemo.
2. Accounts, profiles and sign-in
- World accounts: we store a username, account identifier, account creation time, a salted password hash if you set a World password, profile-picture data and your font preference. Direct World registration does not ask for an email address or date of birth.
- Sessions: we store a hash of the sign-in token, its account association, expiry and information used to protect account actions. The browser receives the session cookie; the main World account database does not keep that token in readable form.
- RexiMemo linking: if you choose this option, we verify your RexiMemo session and associate its account identifier with your World account. Its username helps create a World username, its public profile picture can supply your default picture, and its staff status can determine World permissions. Your RexiMemo password is not copied into your World account.
You can upload your own profile picture or return to the default in Settings. Pictures are resized and re-encoded for display, and the selected picture is also used by the Git service. Unlinking RexiMemo removes the active account association; it does not remove pictures or other information already included in public contributions or Git history.
3. Posts, files and contributions
We store forum threads and replies, their authors and times, attachments, project suggestions, documentation submissions, review decisions and associated staff records. Uploaded files can include PPM animations, images and audio. We keep file data, media type, an identifying upload token, source filename where needed, uploader information and upload or moderation state.
Files can contain more than the information visible on screen. PPM files can include creator names, FSIDs and previous-author information; image, audio and other files may contain metadata. Git files can contain personal details anywhere in their contents. Check files before sharing them. Uploading an attachment is not a private storage feature: anyone who has its accessible media link may be able to retrieve it, even if you have not posted it in a forum message. Hiding a forum message does not automatically disable its attachment links.
We generate or serve previews and playback information needed to display content. Documentation and project suggestions remain in a staff review queue until approved; approval publishes the relevant submission and attribution.
4. Git accounts, repositories and imports
The integrated Git service keeps its own account and repository records linked to your World username. It handles repositories, commits, branches, tags, collaborators, organisations, issues, pull requests, reviews, wiki pages, releases, packages, notifications and related activity when you use those features. It may also store email addresses or other details you supply through Git features, public SSH keys, access-token records and service sessions.
Commit author and committer names, email addresses, timestamps and earlier file contents are part of Git history. They may identify you even when your World profile does not. A new commit deleting a file does not remove the old version. Use an appropriate no-reply address in your Git client if you do not want a personal email address included in future commits.
If you import a repository from GitHub, GitLab or another host, our server requests information from that host. Depending on the options, the copy can include commit metadata, issue authors and discussion, wiki pages, release files and other contributors' information. The source host receives our connection and repository request, and any credentials you supply for that operation. A continuing mirror may require the Git service to retain authentication details. Do not supply tokens you are not authorised to use.
Public repositories expose their public history and related activity to visitors. Private repositories are restricted to authorised users through normal site controls. Administrators can access non-public repository information when needed to operate, secure, investigate abuse or meet a legal obligation. Making a repository private does not remove copies that were already cloned or downloaded.
5. Research access and staff records
When you request restricted documentation, we store your account, request explanation, status, review times, reviewer and review notes. Access records include roles, grants and revocations. Single-use access codes are stored as hashes with the intended account, issuer, expiry and redemption or revocation information.
Staff may keep submission decisions, hidden-content state, moderation explanations and relevant correspondence or evidence. These records support consistent moderation, appeals, safety and access control. They are not intended for normal public pages. Automated role checks can apply linked staff status or an existing permission; staff review access applications. We do not use advertising profiles to make access decisions.
6. Connection information and logs
Connecting to the site exposes ordinary request information to the service and its infrastructure, including an IP address, time, browser or Git-client information, requested path and response status. Operational logs can record this information to diagnose failures, investigate abuse and protect the service. Search terms can appear in page addresses and request history. Do not put passwords, private tokens or sensitive evidence in URLs.
Information also comes from people whose work you import, other users who reply to or report content, and staff reviewing submissions. Information supplied by others may include public repository attribution or private evidence; it is handled according to its purpose and visibility.
8. Why we use information
- Provide the features you request: register and authenticate accounts, remember preferences, link RexiMemo, host repositories and media, display discussions, import projects and review contributions. Where applicable, the legal basis is performing our agreement with you or taking steps you request before it.
- Keep the service safe and usable: control permissions, prevent abuse, investigate faults, moderate content, review research access and preserve relevant evidence. Where applicable, we rely on legitimate interests in running a secure community service, balanced against your rights.
- Meet legal obligations: handle valid legal requirements and applicable data-protection requests where the law requires processing.
- Optional uses requiring consent: if we introduce a use that needs consent, we will explain it and ask separately. Reading this policy is not blanket consent for unrelated processing.
You can browse public pages without an account. A username and a sign-in method are needed for account features; publishing or importing content requires the data needed for that action. You do not have to link RexiMemo, submit research applications or upload a profile picture. Without information needed for a requested feature, we may be unable to provide it.
10. Retention, deletion and public copies
We keep account information while needed to provide the account. Content and repository history remain while hosted or otherwise needed for the relevant contribution, subject to removal requests and applicable rights. Sessions expire after their configured lifetime or are revoked. Unlinking removes the active RexiMemo link; it is not a request to delete your World account.
There is currently no automatic account-deletion countdown. To request account deletion, an export or removal of information you cannot manage through the available controls, email rekunote@gmail.com. We will verify account control and explain any information that must remain.
Retention is based on the feature's purpose, whether information is still needed, backup recovery cycles, unresolved reports or disputes, security risks, legal requirements and the rights of other contributors. Logs and review evidence are kept only while needed for those purposes.
Deletion from the live site does not immediately erase backups, caches, moderation evidence or other people's copies. Public Git clones, forks, quoted posts, screenshots and downloaded files can remain outside our control. Commit history can require separate work to remove personal details; rewriting a hosted history cannot change independent copies. We may preserve limited records for security, legal obligations or an unresolved dispute.
11. Your choices and rights
Settings lets you manage your picture, font, World password and RexiMemo connection. Git controls let you manage repository visibility, collaborators and supported repository features. You can log out and stop using the service at any time.
Depending on applicable law, you may have rights to access or correct personal information, request deletion, restrict its use, receive a portable copy of information you provided, or withdraw consent for a use based on consent. Exceptions may apply, including the rights of other people or a legal requirement to retain information.
Right to object: where we rely on legitimate interests, you can object to the processing of your personal information. Contact us with the processing you are concerned about and your circumstances so we can consider the request.
Send requests to rekunote@gmail.com. We may need proportionate information to verify that the account or data is yours; do not send identity documents unless we explain why they are needed. We will respond within the time required by applicable law. You can complain to your local data-protection authority; in the UK this is the Information Commissioner's Office.
12. Children and security
The site is for people aged 13 and over. We do not intentionally provide accounts to children under 13. If you believe a child under 13 has supplied personal information, contact us so we can investigate and take appropriate action. Do not publish your home address, school, precise location, passwords or other sensitive personal details.
Passwords are stored as salted hashes and normal account actions use session and permission checks. The Git service has its own access controls. No system can guarantee perfect security, and private repositories are not a substitute for a password manager or a secure secrets store.
The public site uses HTTPS. Keep passwords, private keys and access tokens out of repositories and public posts. If you believe information has been exposed, contact us promptly and revoke any affected credentials.
13. International services
World accounts, hosted repositories and attachments are stored on a RexiMemo-operated server using Oracle Cloud Infrastructure in London, United Kingdom. Oracle processes infrastructure information needed to provide that hosting. Our separate development preview uses test storage on the developer's computer.
Services you choose to use, such as GitHub, GitLab, a webhook destination or an email provider, may process information in other countries under their own policies. Where we arrange an international transfer that requires additional safeguards, we must use the safeguards required by applicable law. Contact us for information about a particular transfer or provider.
14. Changes and contact
We will keep this page dated and update it as the service changes. If we introduce a materially different use of personal information, we will explain it through an appropriate notice before or when that processing begins and ask for consent where required.
For privacy questions, account-data requests or complaints, email rekunote@gmail.com. The Terms of Use describe community rules and acceptable use.