Privacy Notice
Last updated: August 3, 2026
Short version: we collect the minimum needed to run your page, we sell nothing, and you can export or erase everything yourself.
What we collect
- Account data — your email and password hash (managed by Supabase Auth), or your Google account identity if you sign in with Google.
- Profile content — the username, name, bio, photo, links, and socials you choose to publish. This is public by design.
- Analytics events (consent-based) — a page view or link click is recorded only after the visitor explicitly agreesvia the consent prompt. When they do, we store a timestamp, the referring site, a country-level location, and a coarse device type. We never record IP addresses, and if the visitor declines (or ignores the prompt), nothing is collected at all. This is our approach to consent under India's Digital Personal Data Protection Act, 2023.
What we never do
- Sell or rent your data to anyone
- Run third-party advertising or cross-site trackers
- Read analytics about your page — only you can see them
Where it lives
Data is stored in Supabase (PostgreSQL) protected by row-level security, and the site is served by Vercel. Both process data on our behalf under their own privacy commitments.
Cookies & consent
We use session cookies to keep you signed in, and — only if a visitor opts in — one cookie to remember their analytics consent. No tracking cookies, ever. You can review or withdraw analytics consent at any time on the Cookie Notice.
Your rights
- Export — download everything we store about you as JSON from Settings → Your data.
- Erase — delete your account from Settings; this permanently removes your profile, links, and analytics.
- Correct — edit any profile field at any time.
Contact
Privacy questions? Open a discussion on GitHub. For sensitive reports use private vulnerability reporting described in our security policy.