Privacy Notice
Last updated: August 3, 2026
Short version: we collect the minimum needed to run your page, we sell nothing, and you can export or erase everything yourself.
What we collect
- Account data — your email and password hash (managed by Supabase Auth), or your Google account identity if you sign in with Google.
- Profile content — the username, name, bio, photo, links, and socials you choose to publish. This is public by design.
- Analytics events — when someone views your page or clicks a link we record a timestamp, the referring site, and a country-level location derived from the request. We do not record IP addresses, and we set no tracking cookies on visitors.
What we never do
- Sell or rent your data to anyone
- Run third-party advertising or cross-site trackers
- Read analytics about your page — only you can see them
Where it lives
Data is stored in Supabase (PostgreSQL) protected by row-level security, and the site is served by Vercel. Both process data on our behalf under their own privacy commitments.
Cookies
We use only the session cookies required to keep you signed in. Visitors to public profiles get no cookies at all. Details in the Cookie Notice.
Your rights
- Export — download everything we store about you as JSON from Settings → Your data.
- Erase — delete your account from Settings; this permanently removes your profile, links, and analytics.
- Correct — edit any profile field at any time.
Contact
Privacy questions? Open a discussion on GitHub. For sensitive reports use private vulnerability reporting described in our security policy.