Privacy Policy
1. Who is responsible for your data
Time Traveler (the “site”) is run by Zhan&Rushman LLC, doing business as MatrixBunny (“we”, “us”), 3901 Colwick Ct, Plano, TX 75023, USA. We are the controller of the personal data described here. You can reach us at support@zhanrushmanllc.com.
This Privacy Policy is version 1.0, dated 7 November 2026, and applies from that date. It explains what we collect, why, who receives it, how long we keep it and what you can ask us to do. The Terms of Use are a separate document.
2. What we collect, and where it comes from
What you give us when you create and set up an account: an email address; a password, which we store only as a hash; your username, display name, bio, profile picture and interests; your language; the time you confirmed that you are 18 or older; and the time and version of the Terms you accepted. If you sign in with Google, Apple or Reddit, we store the identifier that provider gives us for your account, the email address it shares (Reddit shares none, so you add one), and the link to your profile picture there if you choose to use it.
What you give us when you use the site: the text of each prediction as you typed it and the statement the AI wrote from it; comments; likes, watches and follows; appeal reasons and links; reports and the note you add; early-verdict and category-review requests; league names, invites and memberships; the address, links and contact line of a verified record page; your email-notification switch; and anything you write to us at the contact address.
What we receive when you pay: Stripe tells us its customer and subscription identifiers, the state of each subscription and invoice, and a fingerprint of the card used (a code that identifies a card without revealing its number). You type your card details and billing address on Stripe’s own page; we never see the card number.
What we collect automatically: the cookies and browser storage described below; your IP address, which we use for rate limits at registration and password reset and which our web server writes to its access log with the page requested; for each signed-in account, the days on which it was active (the date only); records of each AI and search call made for your content (the task, model, tokens, cost and result, but not the text); and the log of actions we take as administrators that concern your account.
What we do not collect: we have no analytics or tracking scripts, we do not profile your behaviour across other sites, and we do not buy data about you from anyone.
3. Why we use it, and our legal bases (EU and UK)
To run the service you asked for (performance of our contract with you, Article 6(1)(b) GDPR for readers in the EU and UK): creating and securing your account; rewriting, publishing, judging and scoring your predictions; showing your public profile, comments and records; running leagues; selling and managing subscriptions; sending account and notification emails; and letting you appeal, report and delete.
To keep the site safe and working (our legitimate interests, Article 6(1)(f)): rate limits and the human check against abuse; automated review of content against the rules, and our own review of reports; refusing duplicate subscriptions and handling chargebacks; keeping logs and backups; producing aggregate statistics about the site; and the pseudonymous data export described below. Where we rely on legitimate interests, you can object (see “Your rights”).
To comply with the law (Article 6(1)(c)): keeping payment and tax records, answering lawful requests, and handling copyright and other complaints.
With your consent (Article 6(1)(a)): loading an ad network and its cookies, only if you choose “Allow ads”. You can withdraw consent at any time under “Ad choices”.
We make automated decisions about your content: an AI model rewrites, estimates, judges and reviews predictions, and checks comments, names, bios, pictures, league names and verified-page text against the rules. These decisions affect your points and rank and whether content is shown, but they do not produce legal effects on you and are not used for anything beyond the site. The Terms explain how to appeal a verdict and how to ask us to look at a moderation decision.
4. What is public
Public to anyone, without an account, and open to search engines: your username, display name, bio, profile picture, points, accuracy, title and rank; every prediction you have logged, with its statement, criteria, deadline, AI estimate, verdict, points and logging date; your comments, with your name; the number of likes and watches on a prediction; and the share image the site makes for each prediction and each profile. A verified record page, with its links and contact line, is also public. Your email address, the original text you typed before the rewrite, your appeal reasons and links, your reports, your follows, and who liked or watched what are not public.
Visible to members of a league you are in: your public profile, league rank and score, join date, and the predictions you log after joining. League pages are kept out of search engines.
Your appeal reason and link are seen by us and sent to the AI provider for the review. The public ruling shows its grounds and the sources it cites, and a page you linked to may be one of those sources.
After you delete your account, your predictions stay public with their text, points and verdicts, and the author is shown as “Deleted user” with a default picture. Your username, display name, bio and picture no longer appear anywhere, your profile page no longer exists, and share images are regenerated without your name. A top-level comment that others replied to stays as an empty placeholder.
5. AI providers (OpenRouter and the model providers it uses)
The site’s AI work is done through OpenRouter, which forwards each request to a model provider. By default the site uses DeepSeek models (a lighter model for rewriting, estimating, judging and content review, and a heavier one for appeal reviews); a fallback model and an image-review model may be run by other providers. We send our requests with OpenRouter’s data-collection option set to “deny”, which asks OpenRouter to route only to providers that do not keep or train on the content; whether a provider honours that is governed by OpenRouter’s and the provider’s own terms.
What is sent to AI service providers today: the text and criteria of predictions, including the original text you typed; comments; bios; usernames and display names; league names; the address, links and contact line of a verified record page (the contact line can hold an email address or phone number if the person types one); appeal reasons and links; the text of the web pages that appeal links point to, which our server fetches and sends in part; and profile pictures, after the site reduces them to a small image for review. Each is sent when it is written or changed, for rewriting, estimating, judging, appeal review or content review. User ids, email addresses and IP addresses are not sent.
Judging and appeal reviews also search the web, through OpenRouter’s web search tool: the search queries, written by the AI from the prediction or the appeal, go to OpenRouter and to a search engine provider OpenRouter uses. The query can contain parts of the prediction or appeal text. These services see our server’s address, not yours.
What we keep from these calls: the AI’s outputs (the rewritten statement and criteria, the estimate, the verdict and its grounds, the appeal ruling, and the reason for a content-review refusal, which may quote the text) and a record of each call with the task, model, token counts, cost and result. We do not store copies of the prompts.
6. Other services, and transfers outside your country
Amazon Web Services (AWS), in the United States (us-east-1 region): our server and database run there; profile pictures, encrypted database backups and daily integrity digests are stored in private S3 buckets; email is sent through Amazon SES; and pages are delivered through Amazon CloudFront, which sees each request, including your IP address and cookies, in order to serve and cache pages.
Stripe: payments and subscriptions. When you buy, we send Stripe your email address and your user id, and you enter your card and billing address on Stripe’s page. Stripe handles your payment data under its own privacy policy, applies 3-D Secure, and calculates tax from the address you give. Invoices are available in the Stripe billing portal reached from Settings.
Cloudflare: the Turnstile human check on the registration and setup pages loads Cloudflare’s script in your browser, and our server sends Cloudflare the check token and your IP address to verify it. Cloudflare does not otherwise sit in front of the site.
Google, Apple and Reddit: if you sign in with one of them, that provider knows you signed in to the site and shares with us what is described under “What we collect”.
An ad network, only if ads are switched on for the site and you have allowed them; see “Cookies, ads and third-party providers”. Websites you link to in an appeal: our server fetches the page, identifying itself as “TimeTravelerLinkReader”, so that site sees our server, not you.
AWS processes our data in its us-east-1 region in the United States. Stripe, Cloudflare, Google, Apple, Reddit and OpenRouter are United States companies and process data under their own arrangements. Model providers behind OpenRouter may be outside the United States, including in China (DeepSeek is a Chinese company); we do not choose which one handles a request. If you are in the European Economic Area, the United Kingdom or another place that restricts transfers, your data is transferred to the United States when you use the site, and content sent to AI models may be processed in other countries as well. For the transfer to us, we rely on your contract with us (the transfer is necessary to provide the service you asked for). For our providers, we rely on the data-protection terms those providers offer. Write to us if you want more detail about a particular provider.
7. Cookies, ads and third-party providers
Cookies we set ourselves, all needed to run the site: “__Host-tt_session” keeps you signed in for up to 30 days and is removed when you sign out; “__Host-tt_oauth” and “__Host-tt_next” hold the state of a Google, Apple or Reddit sign-in for 10 minutes while it completes; and “NEXT_LOCALE” remembers your language choice for one year. The session and sign-in cookies cannot be read by scripts in the page. These do not track you, and we set no analytics or advertising cookies of our own.
Browser storage we use (in your browser only, never sent to us): your theme choice; your ad choice (“tt-ads-consent”, holding “allowed” or “declined” and nothing else); the text of a prediction you are writing, so that it survives a reload; and, for 30 minutes, the action you were about to take before signing in. You can clear all of this by clearing site data in your browser.
Ads are off unless you switch them on. If we have enabled ads for the site, some pages show ads from an ad network, and the network uses its own cookies and similar technologies, which can include identifiers used to measure and personalise ads across sites. Nothing from the network loads in your browser until you choose “Allow ads” in the banner. If you decline, or make no choice, you see the whole site without ads, and nothing changes for your account. Members never see ads. Before we switch ads on, we will name the network in this policy.
Withdrawing consent: choose “Ad choices” at the bottom of any page and select “Decline ads”. The page reloads without ads, and the network loads nothing further. Cookies the network already set stay in your browser until you clear them; we cannot remove them for you. Your choice is stored in your browser, so each browser and device has its own choice, and it is not linked to your account.
If you live in California and you allow ads, the ad network’s use of cookies may count as “sharing” personal information for cross-context behavioural advertising under California law. Declining ads, or withdrawing consent under “Ad choices”, is how you opt out. We do not sell your personal information, and we do not share it for advertising in any other way.
8. Email and unsubscribing
Account emails, sent to the address on your account, are needed to run it and cannot be turned off: the verification link when you add an address, the password-reset link when you ask for one, and a notice when someone tries to register with an address that already has an account.
Notification emails are optional and are on by default for accounts with a verified address. They tell you about a provisional and a final verdict on your predictions, a provisional verdict on a prediction you watch, the outcome of an appeal, and the start, end or dispute of a paid plan; members also receive emails when someone they follow logs a prediction or gets a result. Each of these emails contains an unsubscribe link and a one-click unsubscribe header for your mail program; you can also switch them off and on in Settings. Switching off stops every notification email, including plan emails. We do not send marketing or newsletter emails.
Every email we send shows who sent it and our postal address. Notification emails contain the prediction statement (shortened), the verdict, points and links; the author’s name appears only in emails about predictions you watch.
9. How long we keep it
Predictions, their statements, criteria, estimates, verdicts, point entries and appeal rulings are kept permanently; they are the public record the site exists to keep, and they survive account deletion. Your original (pre-rewrite) text is kept with the prediction. A draft that is never logged becomes unusable after 24 hours but is not deleted.
Fixed periods set in our systems: sign-in sessions last 30 days and are then removed; email-verification links last 24 hours and password-reset links one hour, and their records are removed a day later; sign-in cookies for Google, Apple or Reddit last 10 minutes; rate-limit records holding IP addresses and hashed email addresses are removed after 24 hours unless a lock is still in force; usage counters are kept for the longest rolling window they serve (up to 30 days) or since the start of the current month, whichever reaches further back, and a few lifetime counters for as long as the account exists; league invite links last 30 days; a verified record page’s address is held for 30 days after the subscription stops; a copy of each pseudonymous export file is kept for 7 days; encrypted database backups are kept for 30 days; whole-server snapshots are taken weekly and the latest four are kept; and server logs rotate by size, so they cover roughly the last week or less.
Kept for as long as you have an account, and deleted when you delete it: your email address, password hash, sign-in links, display name, bio, profile picture, interests, sessions, follows, likes, watches, notifications, queued emails and notification settings; your comments (except the empty placeholder for a top-level comment with replies); your verified record page; your memberships in other leagues; and your activity days.
Kept after you delete your account: your user id and username (so that the username is never reused), your language, and the times of your age confirmation, terms acceptance and account creation; your predictions and their original text; your appeal reasons and links; reports you made or that were made about you, and moderation decisions; records of AI calls made for your content; the administrator audit log, which cannot be deleted; and your payment records, which we keep for as long as tax and accounting law requires. Your email address at Stripe is cleared once nothing of yours remains open there. Deleted data can also remain in backups and snapshots for up to about 30 days after deletion.
10. Security
The site is served over HTTPS. Passwords are stored as argon2id hashes, and sign-in tokens, verification links and invite links are stored as hashes, so a copy of our database does not reveal them. Backups are encrypted before they are stored, storage buckets are private, administrators sign in with a second factor, and every administrator action concerning a user is logged. We never hold card numbers.
No system is completely secure. If we learn of a breach that affects your personal data, we will tell you and the authorities as the law requires.
11. Your rights
Everyone can: see most of their data in Settings and on their profile; change their display name, bio and profile picture in Settings; switch notification emails on and off; change their ad choice; cancel subscriptions; and delete their account in Settings, with the effects described above. Your username and your email address cannot be changed in Settings; write to us if your email address must change.
You can also write to us to ask for: a copy of the personal data we hold about you; correction of inaccurate data; deletion, where the Terms and the law allow it (logged predictions cannot be deleted, and we keep what the law requires); a copy of the data you gave us in a portable file; restriction of processing; and to object to processing based on our legitimate interests, including the pseudonymous export. You can withdraw consent to ads at any time under “Ad choices”. We reply from, and only to, the email address on your account, or ask you to confirm your identity in another reasonable way, and we answer within one month, or within the time your local law allows.
If you are in the EU or UK, you can also complain to a data-protection authority: in the EU, the authority of the country where you live, and in the UK, the Information Commissioner’s Office (ICO). We would appreciate the chance to answer your concern first.
If you are a California resident, you have the right to know what personal information we collect, use and disclose (this policy describes it, and you can ask for the specifics), to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell personal information. We share it for cross-context behavioural advertising only if ads are on and you have allowed them, and you can opt out as described under “Cookies, ads and third-party providers”. You may use an authorised agent to make a request; we will ask the agent for proof of authority and confirm the request with you. We answer within 45 days, extended once if the law allows.
12. The pseudonymous data export
We prepare a data export of decided predictions, as the Terms say, for aggregate analysis and possible licensing to others under a written contract. We have not licensed it to anyone as of this version. If we start, we will treat it as a material change to this policy and give the notice described under “Changes to this policy”.
What is in each row: the public statement and criteria in English, the category, the AI’s probability bucket, the number of days between logging and deadline, the verdict, the logging date and the date the verdict took effect, and a pseudonym. The pseudonym is a code derived from your user id with a secret that is generated afresh for every export and never stored, so rows from one export cannot be matched to another export by the pseudonym, and the file holds no user id, username, email address, IP address, original text or comment. Rows of deleted accounts carry no pseudonym at all. Only predictions with a final verdict from people with at least five decided predictions are included, and removed predictions are left out.
We call it pseudonymous, not anonymous, because the statement text is the same text as on the public prediction page, so a person who searches the site for that text can find the prediction and its author. Only administrators can run the export, every export is logged, and a copy of the file is kept for 7 days. There is no setting to leave the export out, because the statements are already public, but you can object by writing to us and we will consider it.
13. Under-18s
The site is for adults. We do not knowingly create accounts for, or collect personal data from, anyone under 18. Each account holder confirms during setup that they are 18 or older; we do not verify age beyond that. If you believe someone under 18 has an account, write to us and we will delete it and remove their predictions. The site also refuses predictions about children. Anyone, with or without an account, may write to us about content that concerns them.
14. Changes to this policy
We may change this policy. For a material change, such as a new kind of data collected, a new recipient, a new purpose, switching ads on or licensing the export, we will post a notice on the site and email every account with a verified email address at least 14 days before the change takes effect. Smaller changes, such as corrections and clarifications, take effect when posted. The version and date of the current policy are shown at the top of this page.
15. Contact
Zhan&Rushman LLC, doing business as MatrixBunny, 3901 Colwick Ct, Plano, TX 75023, USA. Email: support@zhanrushmanllc.com. Write to us in English or Chinese about this policy, your data or your rights.