Privacy Policy

• Your account: your username, an email address if you add one, and your password as a salted scrypt hash. We never see or store the password itself. Recovery codes are stored as hashes too.
• Sign-in with Discord: if you use it, the account ID, name and email address that service shares with us, so we can recognise you next time.
• Your page: the settings you choose in the editor, and everything you add or upload: pictures, backgrounds, music and cover art, cursors, links and widgets.
• Sessions and devices: a random login token in a cookie. We keep only a hash of it, plus the browser and device description and when it was last used, so you can see your devices and sign them out. Sessions end after 30 days, or when the browser closes if you didn’t choose to stay signed in.
• Linked accounts: when you prove an account on another site is yours, we keep that site’s account ID, handle, display name and picture. For accounts linked by signing in there (TikTok, YouTube, Twitch), we also keep an encrypted token that lets us read your public numbers again, at most once a day. Those numbers are saved for up to a day so we don’t ask again on every view.
• Comments you leave on other pages, with your username and the time.
• Payments: if you buy Premium, Stripe takes the payment. We keep the Stripe checkout ID, the amount and the date. Your card details never reach us.

• A visitor cookie: a random ID, so someone who visits a page several times in a day counts as one view. It isn’t tied to who you are.
• Analytics for the page owner: for each counted view, the time, the website you came from (its domain only), a country code when our network provides one, and whether you used a phone, tablet or computer. For a click, the time and which link or social it was.
• We never store IP addresses and never build profiles of visitors across pages.

Your page is public by design: your name, picture, bio, links, widgets, music, guestbook, view count and anything else you put on it can be seen by anyone with the link, and the most-visited pages appear on the leaderboard. Links you hide are kept off your page. Please don’t add anything you want to keep private.

We use two cookies, both needed for the site to work: the login cookie, and the visitor cookie described above. There are no advertising or tracking cookies, so there is no cookie banner.

• Cloudflare carries all traffic to the site. It sees requests, including IP addresses, in order to deliver pages and stop attacks.
• Discord handles sign-in when you choose it. Discord’s public invite information powers the Discord widget.
• TikTok, YouTube, Twitch, GitHub, Bluesky, Roblox and Last.fm are asked for public profile numbers of accounts members have linked or added.
• Riot Games, HenrikDev, OverFast, OpenDota, FACEIT, fortnite-api.com and Lichess are asked for game ranks and stats of linked game accounts.
• Spotify is searched (by the site, not your browser) when you look for a song in the music editor.
• Spotify and YouTube players are loaded straight from those services in the visitor’s browser when a page includes them (YouTube in its privacy-enhanced mode).
• Stripe processes Premium payments.
• Fontshare serves some fonts to visitors’ browsers when a page uses them.

Each of these has its own privacy policy. We share with them only what’s needed for the feature you’re using.

We keep your account, page and analytics for as long as your account exists. Your dashboard shows 30 days of analytics (Premium: a year). Expired sessions are cleared automatically.

• Change or remove anything on your page from the dashboard at any time.
• Unlink other accounts and sign out devices in Settings.
• Delete your account in Settings. Your page, uploads, analytics, linked accounts, guestbook notes and sessions are removed straight away.

vanta is not for children under 13, and we don’t knowingly collect information from them. If you think a child has made an account, tell us and we’ll remove it.

If this policy changes, we’ll update this page and the date at the top. Questions or requests: open a ticket from Support in your dashboard.