Rubmp

Privacy policy

Last updated: August 11, 2026

This policy explains what personal information Rubmp (“we”, “us”) collects when you use this website, why we collect it, who we share it with, and the choices you have. Rubmp is a United States massage and spa directory with community reviews and optional appointment requests, intended for adults 18 years of age or older.

Information we collect

  • Account information — email address, display name, optional avatar, and a hashed form of your password. We never store passwords in plain text.
  • Content you submit — reviews, comments, photos, business claims, and appointment requests (including any address or note you attach to a request).
  • Transaction information — your credits balance and ledger, top-up orders, subscription history, Bitcoin payment addresses and transaction IDs, and gift card codes you submit for redemption. If you choose manual card checkout, the card details you provide are encrypted at rest and destroyed after one-time processing.
  • Communications — emails we exchange with you and phone numbers you provide for SMS verification codes.
  • Automatically collected data — IP address, device and browser information, pages viewed, referring pages, and an approximate, city-level location derived from your IP address or a location you explicitly share for distance search.
  • Business listing data — directory listings are compiled from user submissions and publicly available sources; they describe businesses, not consumers.

How we use it

  • Provide and operate the service: accounts, listings, reviews, search, appointments.
  • Authenticate you and secure the service, including rate limiting and fraud and abuse prevention.
  • Process credits, subscriptions, claims and payments, and keep auditable transaction records.
  • Send transactional messages: password resets, email verification, verification codes, and notices about your account or appointments.
  • Measure aggregate usage so we can improve the product. Our analytics is privacy-focused and aggregate; where an additional analytics provider (such as Google Analytics) is enabled for a deployment, it is disclosed in the cookies section below.
  • Monitor errors and service health (error reports may include IP address and request metadata).
  • Comply with law and enforce our Terms of use and Community content policy.

Cookies

We use essential cookies for a session that keeps you signed in, a short-lived access check used by our regional access control, and a versioned cookie that remembers your 18+ self-attestation for up to 180 days. The age declaration cookie contains no birth date, identity document or account identifier. When first-party product analytics is enabled, a seven-day first-touch cookie stores only a fixed source bucket, source platform and landing-page group. It contains no unique visitor/session identifier, raw referrer, query, URL, IP address or user-agent, and is attached to an account only after registration. If Google Analytics is enabled for this deployment, it sets its own cookies and processes data under Google’s terms; nothing on this site uses third-party advertising cookies.

When we share information

  • Service providers — companies that deliver email, send SMS verification codes, host infrastructure, and collect error reports for us, only to the extent needed to provide their service.
  • Public blockchains — Bitcoin payments are recorded on a public ledger by design; transaction IDs and addresses are public information we cannot alter or delete.
  • Public content — reviews and other content you publish are visible to other users along with your display name.
  • Legal — when required by law, subpoena, or to protect the rights, safety and property of users, the public, or Rubmp.
  • Business transfers — as part of a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal information and do not share it for cross-context behavioral advertising. California residents: see your California privacy rights.

Retention

We keep personal information for as long as your account exists. Financial records (credits ledger, orders) are kept as append-only records for auditing and legal compliance. If you ask us to delete your account, we delete or de-identify personal information unless we are required to keep it for fraud prevention, financial record-keeping, or other legal obligations.

Security

Passwords and account tokens are stored as one-way hashes; manually processed card data is encrypted at rest and destroyed after one-time use; access to administrative tools is role-restricted and sensitive actions are logged. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Your choices

  • Update your display name, avatar and password in Settings → Profile.
  • Request access, correction or deletion by contacting us (identity verification required).
  • Transactional emails (resets, verification, appointment notices) are sent only when triggered by you or your account.

Children

The service is intended for adults 18+. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it.

Where we operate

The service is operated from and directed to the United States. Access from some regions is restricted. If you use the service from elsewhere, you understand your information is processed in the United States.

Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced more prominently.

Contact

Privacy questions and requests: [email protected] or via Contact us.