Effective date: October 5, 2026
Last updated: October 5, 2026
This Privacy Policy explains how oDesk Software Co., Ltd ("oDesk", "Hibug", "we", "us") collects, uses, shares, and protects your personal information when you use hibug.me, our apps, emails, and APIs (the "Services"). oDesk is the data controller for the personal data described here.
We keep this simple: we collect what we need to run Hibug, we never sell your personal data, and you stay in control of your account.
1. Information We Collect
1.1 Information you give us
Category | Examples | When |
|---|---|---|
Account | name, username, email, password (stored hashed), phone number (if you use phone sign-in) | Sign up / sign in |
Profile | avatar, bio, location, website, social links | Optional, when you edit your profile |
Content | posts, comments, drafts, images, code, bookmarks | When you use the Services |
Communications | support requests, contact form messages, attachments, feedback | When you contact us |
Payment reference | billing name, country, last 4 digits of card, transaction, subscription and customer IDs from the payment provider | When you buy a membership, a post, or donate |
Billing for renewals | a reference to your saved payment method held by the payment provider (not the card itself) | When you start an auto-renewing membership |
Author payout | PayPal email (encrypted), Airwallex beneficiary reference | When an author sets up payouts |
Author tax | legal name, address, tax ID, tax documents | Authors only, before payouts (required by Vietnamese tax law) |
We never receive or store full card numbers, card security codes (CVV), or raw bank account/routing numbers. These are entered directly into the payment provider’s secure forms (currently Airwallex or PayPal), which store your payment method to charge automatic renewals until you cancel.
1.2 Information collected automatically
Usage data: pages and posts viewed, reading time, searches, clicks, referrer, and actions such as bookmarking or commenting.
View events used to calculate author earnings and detect fraud (e.g. view counts, session and abuse signals).
Device & technical data: IP address, browser type, operating system, language, approximate location derived from IP.
Cookies and similar technologies (see §5).
1.3 Information from third parties
Social sign-in (e.g. Google, GitHub): your name, email, and avatar as permitted by your settings with that provider.
Payment providers: payment status, fraud signals, and payout status.
Firebase (Google): phone verification status when you sign in with a one-time passcode.
2. How We Use Your Information
We use personal data to:
Provide the Services — create your account, publish and display content, personalise your feed, remember bookmarks and reading history.
Process payments — memberships and their automatic renewals, post purchases, donations, refunds, and author payouts.
Run the Partner Program — count qualifying views, calculate earnings, and apply required tax withholding (VAT, PIT).
Communicate with you — receipts, security alerts, password resets, notifications you choose to receive, and (only if you opt in) newsletters and product updates.
Keep Hibug safe — prevent spam, fraud, fake views, account takeover, and abuse; enforce our Terms.
Improve the Services — understand how features are used and fix problems.
Show ads to free-plan readers. Paid members do not see ads.
Comply with law — tax, accounting, and lawful requests from authorities.
Legal bases (where applicable, e.g. GDPR): performance of our contract with you (1–3), legitimate interests (4 for service messages, 5, 6, 7), consent (marketing emails, non-essential cookies), and legal obligation (8). You may withdraw consent at any time.
3. How We Share Information
We do not sell or rent your personal data. We share it only:
Publicly, by your choice: your profile, published posts, and comments are visible to others.
With service providers acting on our instructions:
Payment providers (currently Airwallex and PayPal) — memberships and renewals, post purchases, donations, refunds and author payouts. Which provider handles a payment depends on the methods offered at checkout or payout setup; each receives only the data needed for that payment.
DigitalOcean — hosting, database, file storage and CDN
Firebase (Google) — phone one-time passcodes
Resend — transactional and opted-in emails
Analytics and advertising partners — aggregated or pseudonymous usage data, subject to your cookie choices
With authors: authors see aggregated statistics about their posts (views, reads, earnings). They do not see your identity from views. If you donate, the author may see your display name and any message you include.
For legal reasons: to comply with law, respond to valid legal requests, protect rights, safety, and property, or enforce our Terms.
Business transfers: if oDesk is involved in a merger, acquisition, or asset sale, your data may transfer subject to this Policy.
4. International Transfers
oDesk is based in Vietnam, and our providers may process data in other countries (for example Singapore, the United States, and the EU). When we transfer data internationally, we rely on appropriate safeguards such as contractual commitments from our providers.
5. Cookies
Type | Purpose | Can you turn it off? |
|---|---|---|
Essential | sign-in session, security (CSRF), language preference | No — required for the site to work |
Analytics | understand usage and improve Hibug | Yes |
Advertising | show and measure ads to free-plan readers | Yes |
You can manage cookies in your browser settings. Blocking essential cookies may stop you from signing in.
6. Data Retention
Account and content: kept while your account is active.
Account deletion: after you request deletion there is a 14-day grace period; then your account, profile, and content are permanently deleted within 30 days, and backups roll off within 90 days.
Financial and tax records (payments, payouts, invoices, tax withholding): kept for 10 years as required by Vietnamese accounting law, even after account deletion.
Security and fraud logs: kept up to 12 months unless needed longer for an investigation.
Content you shared publicly may remain in third-party caches or archives we do not control.
7. Security
Passwords are hashed; sensitive fields (payout emails, tax IDs, financial figures) are encrypted at rest.
All traffic is encrypted in transit with TLS.
Card and bank details are handled only by PCI-DSS certified payment providers.
Access to personal data is limited to staff who need it.
No system is 100% secure. If you discover a security issue, please report it privately to info@odesk.me. If a breach affects your personal data, we will notify you and the authorities as required by law.
8. Your Rights & Choices
Depending on where you live, you may have the right to:
Access — download a copy of your data from Account → Your Data → Export.
Correct — edit your profile and account details anytime.
Delete — delete your account from Account → Your Data.
Object or restrict processing based on legitimate interests.
Portability — receive your data in a machine-readable format.
Withdraw consent — unsubscribe from marketing emails via the link in any email or your notification preferences.
Complain to your local data protection authority.
To exercise any right not available in your account settings, email info@odesk.me. We will verify your identity and reply within 30 days.
9. Children
Hibug is not intended for children under 13, and we do not knowingly collect their data. Users aged 13–17 may read and comment but may not purchase, donate, or join the Partner Program without a parent or guardian. If you believe a child under 13 has given us personal data, contact info@odesk.me and we will delete it.
10. Changes to This Policy
We may update this Policy. For material changes we will notify you by email or a notice on the Services before they take effect. The "Last updated" date shows the latest version.
11. Contact
oDesk Software Co., Ltd — data controller for hibug.me
Email: info@odesk.me