Privacy in plain language

ByMi is in public preview. Account registration is closed while operator details and launch setup are completed. You can use the contact form for questions.

You decide what’s public

Your profile starts private. Publishing makes its name, address, bio, topics, languages, optional location, links, selected work, optional preview images, optional dated audience figures, contact page and collaboration preferences available on the web and through the public API. Unpublishing removes it from this service immediately. Search caches and external copies can remain.

What stays private

Your login email, password hash, recovery-code hash, tool-key hashes, saved creators, saved searches and conversations are private. Offer participants can read their conversation. Operators with server access can access stored data for maintenance and abuse review. Conversations are not end-to-end encrypted. Passwords and full access keys are never stored in readable form.

Hosting and service providers

Render hosts ByMi and its database in Frankfurt. Resend sends verification emails and optional notifications using the configured Ireland region. These providers process information needed to operate their services.

Cookies and links

We use an essential session cookie to keep you signed in for up to 30 days. Connecting another service uses additional short-lived essential cookies. No advertising trackers or third-party analytics are included. External links leave ByMi. Work preview images load from the creator's chosen image host, which receives your IP address.

Signing into another service

If you approve a registered service, ByMi shares your account identifier, name and verified email with that service for sign-in. Your login email never appears in public cards. This approval does not publish your card or grant access to your inbox or social accounts. Sign-in tokens expire within five minutes. The receiving service manages its own account, session and retention; signing out here does not sign you out there.

Contacting the team

The contact form stores your name, reply email and message privately for operator review. These are not published or added to creator discovery. Messages are removed after 90 days by an hourly cleanup while the service is running. A generic operator alert links to the private queue without forwarding your message contents. Contact us through the same form to request earlier removal.

Your controls

Export your data, unpublish, pause offers, block senders, revoke tool keys or delete your account from your workspace. Revocation stops future tool access; it cannot erase copies already made. Account deletion removes your conversations for both parties. Backups can retain older copies until they expire. Render also maintains disk snapshots; its current documentation says snapshots remain available for at least seven days. Recovery copies are used for service recovery, not public discovery.

Retention

Profiles and conversations remain until account deletion. Sessions expire after 30 days, and API keys after 90. Expired sessions and rate-limit counters are cleaned hourly while the app runs. Abuse reports remain until the associated account is deleted or the operator removes them. When email delivery is configured, you can verify your email and receive offer and reply notifications. The mail provider receives your email and a generic inbox link, without message contents. Verification links expire after 24 hours. Pending delivery retries are stored here; sent message contents are cleared. Notification event IDs remain until account deletion to prevent duplicates.