privacy policy

last updated: October 17, 2026

scrapmeback is a small, fan-made time capsule of the orkut era. It is not orkut and is not affiliated with orkut, Orkut Büyükkökten, Hello Network, Inc. or Google. This page explains, in plain words, what we collect and who can see it. Questions: hello@scrapmeback.com.

the short version

• Your profile, scraps, friends list, communities and photos are public, just like 2008. Anyone with the link can see them, including people who aren't signed in.
• Messages, your birthday and your crush list are private.
• We don't show ads and we don't sell your data.
• You can ask us to delete your account and everything in it at any time.

what we collect

• Account: your name and email. If you sign in with Google, we get the name, email and profile photo Google shares. Passwords are stored hashed by our auth provider; we never see them.
• What you add to your profile: photo, headline, about me, status, relationship, gender, location, country, your “era” badge and theme. These are public.
• Birthday: optional, and visible only to you.
• What you post: scraps, testimonials (shown once the recipient approves them), community posts, polls and votes, photos, albums and photo comments.
• Your connections: friend requests and friendships, communities you join, who you're a fan of.
• Ratings: the trustworthy / cool / sexy ratings you give friends. Profiles show only totals.
• Crushes: visible only to you, unless the crush is mutual, in which case you both see it.
• Messages: visible only to the sender and the recipient.
• Profile visits: when you open someone's profile while signed in, it can show up in their “recent visitors”, just like the original.
• Safety records: people you block, reports you file, and the rate-limit counters that stop spam.
• How you found us: when you sign up we save the campaign tags in the link you used (likeutm_source=whatsapp), the website that sent you, the first page you saw, and which friend's link you came from. Only our admins see this, as totals, to learn which invites work.

emails we send

• Activity emails when someone scraps you, sends a friend request or a message, accepts your request, or writes you a testimonial. At most one of each kind every few hours. We never put private message text in an email.
• A welcome email when you join, and a weekly digest of profile visits and things waiting for you.

Every email has an unsubscribe link, and you can turn each type off in settings. We keep a log of which emails we sent (type and time) so we don't send too many.

cookies, analytics and bot protection

• Session cookies keep you signed in.
• A referral cookie (smb_ref, 7 days) remembers whose profile link brought you here, so we can send them a friend request when you join.
• A source cookie (smb_src, 30 days) remembers the link and website you first arrived from, so we can save it if you sign up. It's deleted once used.
• Analytics: we use Vercel Web Analytics and Speed Insights (page views, browser, device type, country) and may use Google Analytics to understand which pages people use.
• Bot protection: sign-up and sign-in may use Cloudflare Turnstile to block fake accounts.

who processes your data

We use a few service providers to run the site: Supabase (database, sign-in and photo storage), Vercel (hosting and analytics), Google (sign-in with Google, and analytics if enabled) and Cloudflare (bot protection) and Resend (sending email). They may process data in the United States or other countries where they operate. We share data with them only so they can run the service.

moderation

When something is reported, our moderators can review it, including a reported private message or testimonial, so they can act on abuse. Moderation actions are logged. We may share information with law enforcement when the law requires it or to protect someone from serious harm, and we report child sexual abuse material to the authorities.

how long we keep it, and deleting it

We keep your data while your account exists. You can delete your own scraps and photos at any time. To delete your whole account, email hello@scrapmeback.com from the address you signed up with. We'll delete your account and its content within 30 days. Copies in backups expire on their own soon after.

your rights

Depending on where you live (for example the EU or UK under GDPR, Brazil under the LGPD, or India under the DPDP Act), you may have the right to access, correct, delete or export your data, and to withdraw consent. Email hello@scrapmeback.com and we'll respond within 30 days.

age

scrapmeback is for people 18 and older. If we learn an account belongs to someone younger, we delete it.

security

Access to every table is restricted by database row-level security, and traffic is encrypted. No system is perfect, though. Please don't post anything you'd hate to see public.

changes

If we change this policy in a meaningful way, we'll update the date above and tell you on the site. See also our terms.