Privacy Policy

01What We Collect

Username, hashed password, profile content you provide (display name, bio, links, uploads), and appearance preferences (colors, fonts, card styles, animations, background media). IP addresses are processed transiently for the Profile Analytics feature described in Section 3 (resolved to a country code, then discarded — never stored).

When a report is submitted via our abuse or DMCA form, we log the submitter's IP address alongside the report. If you are signed in when submitting a report, your account ID is also recorded. This data is used solely for moderation purposes — to prevent abuse of the reporting system and to assist in investigations of policy violations.

02How We Use It

Solely to operate the Service — authenticate you and display your profile. We do not sell, rent, or share your data with third parties for advertising or any other purpose.

03Profile Analytics

Each profile owner has access to a private Stats panel inside their dashboard. To populate it, we record minimal, anonymous data about visits to their own profile page — never aggregated across users, never shared, never exposed publicly.

For each profile view we store:

• An hourly and daily view count — bucketed timestamps only, no per-visit records.
• A referrer category — the source domain (e.g. Discord, Twitter, Reddit, Direct) bucketed into a generic label. The full referring URL is not stored.
• A country code — derived in-memory from the visitor's IP address using the MaxMind GeoLite2 database, then immediately discarded. We do not store IP addresses, cities, coordinates, or any other geolocation data — only the two-letter ISO country code.

This data is stored in our MongoDB database (with Redis used only as a short-lived read cache) and is visible exclusively to the profile owner. Visitors are not tracked across profiles or sessions. There are no cookies set for analytics purposes, no fingerprinting, and no third-party analytics scripts (Google Analytics, Plausible, etc.) on the platform.

You can permanently delete all analytics data for your profile at any time using the Clear data button at the bottom of the Stats panel in your dashboard. Deleting your account also removes all associated analytics data immediately.

04Discover & Public API

Participation in the Discover page is strictly opt-in and controlled entirely by you. Unless you enable discovery in your dashboard, none of your profile data appears on the Discover page.

When you opt in, the following information is displayed publicly on Discover: your display name, username, bio, avatar, and profile view count. You can opt out at any time from your dashboard — your profile is removed from Discover immediately and no longer surfaced to visitors.

Opting in to Discover also enables access to your profile via the public API. Developers can retrieve your display name, username, bio, avatar URL, background URL, and links programmatically. Opting out immediately removes your profile from the API as well.

05Uploaded Files

Files are encrypted at rest (AES-256-CBC) and decrypted only when served to a visitor. They are never stored in a publicly accessible directory. You can permanently delete any file from your dashboard at any time.

06Third Parties

Google Fonts and Font Awesome are loaded from external CDNs and may log your IP per their own policies. We also use the MaxMind GeoLite2 database locally on our server for country-level geolocation — this is a self-hosted lookup file, not a third-party API call, so visitor IPs never leave our server in connection with analytics. No tracking, analytics, or advertising scripts run on this platform.

07Your Rights

You can access, correct, or permanently delete all your data at any time from your dashboard. Deleting your account removes everything immediately — there is no retention period.

Report records (including IP addresses and account IDs where applicable) are retained for up to 6 months for abuse prevention and legal compliance purposes. This data may not be erasable on request under the legitimate interests and legal obligation bases recognised by GDPR, CCPA, and equivalent frameworks. Reports involving illegal content or content subject to mandatory reporting obligations may be retained longer where required by applicable law.

08Contact

For privacy-related concerns, use the report form.