Skip to content
collabro
Sign inJoin free

Legal

Privacy Policy

Draft - last updated October 2026.

Placeholder pending legal review. This page is a working draft that describes intended product behaviour. It is not legal advice and must be reviewed by qualified counsel before Collabro launches publicly.

In short

  • We collect only what's needed to connect creators: your account, the profile you write and your activity in the app.
  • Other creators see your public profile - never your email address.
  • We don't sell your data, don't show ads and don't use third-party analytics or tracking.
  • We never ask for your Instagram password and never scrape Instagram.
  • You can edit your profile any time and delete your account from Settings.

1. Who we are

Collabro (“we”, “us”) runs the Collabro website and app, which help content creators find each other and collaborate. We decide how and why your personal data is used for the service, so we are responsible for it. This policy explains what we collect, why, who can see it, how long we keep it and the choices you have. Our Terms of Service also apply.

2. What we collect

Information you give us

  • Account: your email address and password. We store the password only as a one-way hash (Argon2id), so nobody - including us - can read it.
  • Profile: display name, username, photo, bio, niche, city, country, languages, collaboration types and goals, your Instagram username and public profile link, and a follower count that you report yourself.
  • Messages: what you write to creators you have matched with.
  • Reports: the reason and details you give when you report someone.

Information created when you use Collabro

  • Your Pass and Interested decisions, matches, blocks, and when you last read each conversation.
  • Account status and dates: when you signed up, verified your email, were last active or asked to delete your account.
  • Sign-in sessions: a randomly generated session token (we store only a hash of it), when it expires and the browser/device description your browser sends, so sessions can be secured and signed out.
  • If you are reported or moderated: the report, its outcome and an internal log of moderation actions.

Technical information

  • Your IP address is used briefly, in memory, to limit repeated sign-in and sign-up attempts. We don't store it in our database. Our hosting provider keeps standard request logs (which include IP addresses) for security and operations.

What we never collect

We never ask for or store your Instagram password, cookies or session tokens, we don't connect to your Instagram account and we don't scrape Instagram. We don't collect your precise location, contacts, payment details or government ID. When you upload a photo we re-encode it, which removes hidden metadata such as GPS location and camera details.

3. Why we use it

  • To provide the service you asked for: creating your account, showing your profile in Discover, ranking creators by fit (niche, location, languages and collaboration types), matching, and delivering messages.
  • To keep Collabro safe: preventing spam and abuse, limiting repeated sign-in attempts, enforcing blocks, reviewing reports and acting on accounts that break our rules.
  • To contact you about your account: for example email verification and password resets, when email is turned on. We don't send marketing emails.
  • To meet legal obligations and respond to valid legal requests.

Ranking and matching are automated, but they only decide the order in which profiles are shown. They don't make decisions about you with legal or similarly significant effects; who you match and collaborate with is always up to you and the other creator.

4. What other creators can see

  • Your public profile: everything in your profile above, shown to signed-in creators in Discover and on your profile page. Your follower count is labelled self-reported.
  • Your messages: only the creator you matched with.
  • Never shown to other creators: your email address, password, account status, who you passed on, who you blocked, reports you made and any moderation information.

Anything you share with another creator - in messages or once you take a conversation elsewhere - is under their control. Share personal details carefully.

5. Who we share it with

We don't sell or rent your personal data, and we don't share it with advertisers. We share it only:

  • With service providers who run Collabro for us, under contract and only to provide their service: Vercel (hosting, request logs and photo storage), Neon (database, hosted on AWS in the United States), Google Fonts (serves the app's fonts, so it receives your IP address), and an email delivery provider once email is turned on.
  • With our admins, who can see account and profile details, reports, and who has matched with whom - including when and how many messages were exchanged - in order to moderate and keep creators safe. Admins cannot read the content of your private messages through Collabro.
  • When required by law or to protect the safety of people, Collabro or the public.
  • If Collabro is reorganised, merged or sold, in which case this policy continues to apply to your data.

6. Where your data is stored

Our database and servers are in the United States. If you use Collabro from another country, your data is transferred to and processed in the United States, with the protections described in this policy.

7. How we protect it

  • All traffic is encrypted with HTTPS.
  • Passwords are hashed with Argon2id; session, verification and reset tokens are stored only as hashes.
  • Sign-in uses short-lived access tokens (15 minutes) and a secure, HttpOnly cookie that JavaScript can't read.
  • Access to admin tools is limited to admin accounts, and moderation actions are logged.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify you and the relevant authorities where the law requires.

8. How long we keep it

  • While your account is open: we keep your account, profile, decisions, matches and messages so the service works.
  • When you delete your account: your profile disappears from Discover and you are signed out everywhere straight away. After 30 days we permanently remove your profile and photo, replace your email with an unusable placeholder, erase your password and sessions, and replace the text of your messages with “[deleted]” so the other person's conversation still makes sense.
  • Kept longer for safety: reports, blocks and moderation logs may be kept after deletion to prevent abuse and to protect other creators, for no longer than necessary.
  • Short-lived records: sessions expire after 7 days of inactivity, email verification links after 24 hours and password reset links after 30 minutes.

9. Cookies and storage on your device

We use only what's needed for the app to work - no advertising or analytics cookies.

  • Sign-in cookie (collabro_refresh): keeps you signed in for up to 7 days. Secure and HttpOnly. Removed when you log out.
  • Discover filters: remembered for the current browser tab only (session storage).
  • Install prompt: remembers that you dismissed “Install the app” (local storage).
  • Offline support: the installable app caches the app's own files, its fonts and profile photos you have already viewed, so it opens quickly. It never caches your account details, matches or messages.
  • Demo: the public demo keeps its fictional data only in your browser (local storage) and never sends it to us.

10. Your choices and rights

  • See and correct: view and edit your profile any time in the app.
  • Delete: delete your account from Settings (see section 8 for what happens).
  • Control contact: block anyone, and decline or ignore interest.
  • Ask us: depending on where you live, you may have the right to request a copy of your data, ask us to correct or erase it, object to or restrict how we use it, withdraw consent, or nominate someone to act for you. Contact us using the details below and we will respond within the time the law requires.
  • Complain: if you aren't happy with our answer, you can complain to the data protection authority where you live.

11. Children

Collabro is for adults. You must be at least 18 (or the age of majority where you live) to use it, and we don't knowingly collect data from anyone younger. If you believe a child has an account, report the profile or contact us and we will remove it.

12. Instagram and Meta

Collabro is not affiliated with, endorsed by or sponsored by Instagram or Meta. Your Instagram username and link are simply what you choose to show on your profile; opening that link takes you to Instagram, whose own privacy policy applies.

13. Changes to this policy

We may update this policy as Collabro changes. If a change is significant we will tell you in the app before it applies. The date at the top shows when it was last updated.

14. Contact and grievances

For privacy questions, requests or complaints, contact our privacy and grievance contact. Contact details will be published here before public launch.