Privacy Policy

Account information. Your email address, username and password. Passwords are stored hashed, never in plain text. If you sign in with Google, we receive your email address and basic profile from Google instead of a password.

Profile content. Everything you add to your profile: display name, bio, location, avatar, links, mood board images, music, fonts, videos, badges, widgets, theme settings and SEO settings (title, description, favicon).

Comments and likes. Comments you post on other profiles and the comments you like, linked to your account.

Connected accounts. When you add a widget, we store the identifier you provide (Discord ID, Steam, Roblox, Valorant, YouTube or Letterboxd username). If you connect Spotify, we store an access token limited to reading your currently and recently played tracks. You can remove a widget at any time.

Payments and payouts. Payments are processed by Stripe; we never see or store your card details. We keep your Stripe customer ID, purchase date and, for paid links, the buyer's email and amount. If you sell links or join the affiliate program, we store your Stripe Connect account ID and, optionally, the PayPal email you give us for payouts.

Profile analytics. When someone visits a profile, we count the view and link clicks, together with the visitor's country (derived from their IP address by our hosting provider) and device type. These are stored as daily totals: we do not store visitors' IP addresses for analytics.

Signup attribution. When you sign up, we record whether you arrived from the landing page or from a creator's profile, and the referring website, so creators can be credited for referrals.

Reports. If you report a profile, we store the reason, any details you write and your IP address, to handle the report and prevent abuse of the report system.

amon.lol is a public profile platform. Your username, profile content, badges, widgets, view count (if you show it) and the comments you post are visible to anyone, may appear on the public leaderboard and the landing page, and can be indexed by search engines.

Only add to your profile what you are comfortable making public. Your email address, password, payment details and analytics are never shown publicly.

• To run the Service: host your profile, save your customization and serve your media.
• To show profile owners their analytics (views, clicks, countries, devices).
• To display live widgets from the accounts you connect.
• To process Pro purchases, paid links, refunds, affiliate commissions and payouts, and to prevent fraud.
• To keep the community safe: review reports, moderate comments and enforce our Terms.
• To send essential emails, such as password resets and purchase receipts. We do not send marketing emails or sell your data.

• Contract: providing your account, profile, purchases and payouts.
• Legitimate interests: aggregated profile analytics, referral attribution, security, fraud prevention and moderation.
• Consent: connecting third-party accounts such as Spotify, which you can withdraw by removing the widget.
• Legal obligation: keeping payment records required by tax and accounting law.

We share data only with providers that help us run the Service, and only what they need:

• Vercel: hosting, custom domains and visitor country detection.
• Neon: database.
• Cloudflare R2: storage for uploaded images, audio, video and fonts.
• Stripe: payments, Stripe Connect payouts and refunds.
• Resend: transactional emails (password resets, receipts).
• Google: sign-in, if you choose it.
• Spotify, Discord (via Lanyard), Steam, Roblox, Riot Games, YouTube, Letterboxd and Deezer: queried to display the widgets and music you choose. These services receive the identifiers needed for the request.
• PayPal: affiliate payouts, only if you provide a PayPal email.

Some of these providers process data outside the European Economic Area. Where they do, they rely on safeguards such as the EU Standard Contractual Clauses. We may also disclose information when required by law.

We only use cookies needed to run the Service. We do not use advertising cookies or third-party trackers.

• Session cookies keep you signed in.
• A view cooldown cookie (15 minutes) stops the same visitor from being counted many times.
• Attribution and affiliate cookies (30 days) remember which creator or affiliate code referred you, so they get credit if you sign up or buy Pro.
• A Spotify security cookie protects the Spotify connection flow and expires right after it.

Your browser may also store small preferences locally, such as dismissed announcements. You can block cookies in your browser, but signing in will not work without them.

We keep your data while your account exists. You can delete your account at any time from your dashboard settings. Deletion is immediate and permanent: your profile, links, uploaded files, comments, likes, widgets, connected tokens, analytics and custom domain are removed.

Some records are kept after deletion when we must or have a legitimate reason to: payment and payout records required by law, reports and moderation logs needed to prevent abuse, and copies in encrypted backups until they expire.

Depending on where you live (including under the GDPR in the EU/EEA and UK), you have the right to:

• Access the personal data we hold about you and get a copy of it.
• Correct inaccurate data (most of it you can edit yourself in the dashboard).
• Delete your data, by deleting your account or asking us.
• Object to or restrict some processing, and withdraw consent at any time.
• Receive your data in a portable format.
• Complain to your local data protection authority (in France, the CNIL).

To exercise these rights, open a ticket on our Discord server. We answer within one month.

We use encryption in transit (HTTPS), hashed passwords, signed payment webhooks and restricted access to production systems. No system is perfectly secure, so please use a strong, unique password.

amon.lol is not intended for children under 13, and we do not knowingly collect their data. If you are under the age of digital consent in your country (15 in France), you need permission from a parent or guardian. If you believe a child has given us data, contact us and we will delete it.

We may update this policy as the Service evolves. We will change the date at the top of this page and, for significant changes, let you know through the dashboard or by email.

For any question about your privacy, open a ticket on our Discord server.