Privacy Policy

This policy explains what personal data the clutx team ("we", "us") collects when you use clutx.site, why we collect it, and what rights you have. We are the data controller. To contact us about privacy, email [email protected].

1. What we collect

Information you give us

• Account data: email address, username and, if you set one, a password, which is stored as a secure hash.
• If you sign in with Google or Discord, or connect them to your account: we receive your email address, name, profile picture and account ID from that service. We never see your Google or Discord password. When you sign up this way, we use your name and picture to fill in your profile, and you can change or remove them at any time. If you sign up with Discord, we also use your Discord user ID to add a live Discord status widget to your page. If you connect Discord later, we only add it when you click "Add your live Discord status". You can remove the widget from the dashboard, and connect or disconnect Google and Discord in Dashboard → Account → Connections. Logging in with or connecting Discord happens on clutx.site itself: our server receives your Discord user ID, username, display name, avatar, email address and whether Discord has verified that address, and keeps your Discord user ID and username with your account (so you can log in with Discord again, and so your page's Discord features know which Discord account is yours) until you disconnect Discord or delete your account. A new account gets your Discord email address, already confirmed because Discord verified it, and your Discord user ID, names, avatar and email in its account details. If an account here already has that address, and it is confirmed, Discord is connected to that account instead. An email sign-up with that address that was never confirmed or used, and is more than 10 minutes old, is deleted then (it would be within 3 days anyway). When you disconnect Discord, however it was connected, its details go from your account, and we keep only a note that your account disconnected that Discord user ID, so signing in with it doesn't connect it again by email. Connecting it again, or deleting your account, removes the note.
• If you connect Steam (Dashboard → Account → Connections): you sign in on Steam's own site (steamcommunity.com), and Steam tells us your SteamID64 (your Steam account's number) and nothing else. We never see your Steam password or email. We store that SteamID64 and when you connected it. The connection is shown only to you, in your dashboard, with that account's public Steam name and avatar, which our server looks up from Steam when you open it (they aren't stored with your account). Your Counter-Strike 2 widget only shows the stats of this connected account, and if you put your CS2 stats on the leaderboard, the board lists them for that Steam account, because it only lists connected accounts. We use it to fill in your Steam and Counter-Strike 2 widgets when you choose to, to check that the CS2 stats on a page and on the leaderboard belong to the page's owner, and for In game now and Rarest achievements if you turn them on (below). Connecting Steam doesn't let you log in with it. You can disconnect it in Dashboard → Account → Connections at any time.
• In game now (only if you turn it on in Dashboard → Page → Stats): while your page is open somewhere, our servers ask Steam's Web API about once a minute what the Steam account you connected is playing: the game's name and Steam's number for it, and once for each game its icon. This is public: while you play, your page shows "Playing now" with the game. Steam only says what you play while your Steam profile and game details are public, so nothing shows otherwise. The answer is kept in our servers' memory for about a minute and never stored in our database. When you open Dashboard → Page → Stats with In game now switched on, our servers also ask Steam for the games on that account (their names, icons and how long you have played each), to show your most played one in the example and tell you whether Steam hides your game details: that list is kept in our servers' memory for up to 6 hours and never stored.
• Rarest achievements (Premium, only if you pick games in Dashboard → Page → Stats): we save the Steam games you pick (up to 3) with your page. For each of them, our servers ask Steam's Web API which of its achievements the Steam account you connected has unlocked, and Steam's public figures for the game: how many of its players have each achievement, and each one's name and icon. We keep the game's name and the 3 rarest achievements you unlocked in it (each one's name, icon and share of players, never when you unlocked it), or that there are none to show, or that Steam hides your game details, for that Steam account, in our database (Supabase), where only our servers can read it. That way your page shows them without waiting for Steam; while your page is viewed, our servers ask Steam again about once a day. This is public on your page while it has Premium. What Steam says about your achievements in a game is also kept in our servers' memory for up to an hour, so your dashboard and your page share one answer. When you click "Add a game" in Dashboard → Page → Stats, or open it with games picked, our servers also ask Steam for the games on that account (their names, icons and how long you have played each), to list them for picking with the most played first, name the ones you picked and tell you whether Steam hides your game details: that list is kept in our servers' memory for up to 6 hours and never stored. We only ask Steam about the games you keep and the games on that list.
• If you connect a Riot account (Dashboard → Account → Connections, once this site offers it): you sign in on Riot Games' own site (Riot Sign On), and Riot tells our server which Riot account signed in. We never see your Riot password. We store that account's PUUID (Riot's ID for it, which only works with our site's API key), its Riot ID (name#tag) and Valorant region as of when you connected (updated when Riot later gives a different one with your stats), when you connected it, and the highest Valorant rank we have seen in your matches since then. Nothing else from the sign-in is kept: the access Riot gives our server is used once, right away, to learn which account it is, and then thrown away. Once this site gets its Valorant stats straight from Riot, your Valorant widget only shows this connected account (Riot only lets sites show the stats of players who connect), on your page, its stats page, your link preview, /profile and, if you turn the leaderboard on, the leaderboard and /top in our Discord server. Connecting makes your Valorant rank and match history public. Connecting a Riot account doesn't let you log in with it. You can disconnect it in Dashboard → Account → Connections at any time.
• If you connect GitHub (Dashboard → Page → Stats → GitHub, once this site offers it): you sign in on GitHub's own site (github.com), and GitHub tells our server which GitHub account signed in. We ask GitHub for no permissions at all, so the sign-in only shows us what your public GitHub profile already shows: we never see your GitHub password, private email, private repositories or code. We store your GitHub account's number (GitHub's ID for it, which never changes), its username as of when you connected, and when you connected it. Nothing else from the sign-in is kept: the access GitHub gives our server is used once, right away, to learn which account it is, and then revoked at GitHub, so it stops working at once. Your GitHub widget only shows this connected account, looked up by its number (so it follows a new username, and nobody else's account can show on your page), on your page and its stats page: your username, public name, avatar, and how many public repositories and followers you have. Connecting GitHub doesn't let you log in with it. You can disconnect it at any time in Dashboard → Account → Connections, or in the GitHub widget.
• Valorant match history (only if you connect a Riot account, once this site gets its Valorant stats straight from Riot): for each of your competitive matches our servers read from Riot, we save your own line from it: when it was played, the map, your agent, whether your team won, lost or drew, the round score, your kills, deaths, assists and combat score, your competitive rank in it, and the act (Valorant's season) it was played in. Never anything about the other players in the match. We keep it to show your match history and what it adds up to (matches, win rate, K/D, averages, most played agents and maps) on your Valorant stats page (clutx.site/username/valorant). This is public there, like the rest of your stats. It starts with the competitive matches Riot's match list still has when you connect, and each match is normally read from Riot once (the newest few may be read again after our server restarts). It is kept in our database (Supabase), where only our servers can read it, and deleted as soon as you disconnect your Riot account, connect a different one or delete your account.
• Our Discord server: when you log in with or connect Discord, Discord asks whether we may add you to servers for you (the "guilds.join" permission). We use it only to add you to our official Discord server, so that our bot can see your live status. You can leave the server at any time. Your Discord status then stops showing on your page. When you log in with or connect Discord on clutx.site, the access Discord gives our server is used right away, only to read who signed in and to add you to our server, and is then cancelled, so it can't be used again. It is never stored.
• Profile content: display name, bio, location, avatar, background, music (a song you upload, or links to songs on YouTube or Spotify with their titles and artists: one, or up to 5 with Premium), links, clips (the links and titles of up to 6 YouTube, Twitch, Medal or Streamable videos, or 12 with Premium), colours and settings, and with Premium a cursor image, link style, a picture for your link preview and a goal (a stat of one of your game widgets, the number it started from, your target, its title and the day you reached it), a tab title, which of your clips is pinned to the top of your page, up to 4 scheduled looks (their names and styles, the days or dates they're on and your time zone), a thank-you message visitors read after their GG (its words and an optional link) and the stats you pin as big numbers (which widget and which stat). When Premium ends, the extra widgets, links, clips, songs and discount codes stay stored (and editable in your dashboard) but only what fits the free limits is shown, and your goal, tab title, pinned clip, scheduled looks, thank-you message and big numbers stay stored but aren't shown, until you have Premium again or remove them. This is public. Anyone with your link can see it.
• Rich links (Premium, only for the links you turn them on for): our servers visit the page each of those links opens and read what it says about itself for link previews: its title, a short description and the picture it names. We store the link's address with that title and description, our own copy of the picture (made smaller and saved again as a new file, which leaves out anything hidden in the original, such as where or with what it was taken), when we read it and, if we couldn't, why, and the date the page says it stops being available, if it gives one. They are public on your page, under the link, while your page has Premium. A page that asks not to be listed (noindex) gets no rich link, nor does one past the date it gives; one that asks for no description or no picture gets none, and we don't keep a picture whose own server asks not to have it listed.
• Widget details: the game and account names you add to widgets, such as your Riot ID, BattleTag, Epic username, Apex Legends player name and platform, Discord user ID, the Steam account for Steam and Counter-Strike 2 (you can enter a Steam profile link, custom profile name or SteamID64; we save the SteamID64 it belongs to), osu!, Chess.com or Roblox username, and Brawl Stars or Clash Royale player tag (a GitHub widget shows the GitHub account you connect instead, above). These, and the stats we look up with them, are public on your profile and on each game's stats page (clutx.site/username/game). For Brawl Stars and Clash Royale, those stats include your name in the game and your club or clan's name. For Valorant, those stats include your last 5 competitive matches: the agent, map, kills, deaths, assists and round score of each (and, once they come from Riot, the day each was played and your account level; your rank is then the one from your newest competitive match, without RR, which Riot doesn't give out). For Steam, they are your Steam name and avatar, whether you are online, the game you are playing and your most played games of the past 2 weeks with their hours, from your public Steam profile. For Counter-Strike 2, they are your Steam name and your lifetime Counter-Strike stats from Steam (every mode, your CS:GO years included): K/D, headshot rate, matches played and won, and hours played. Steam only gives them out while your Steam game details are public.
• Saved stats: for each game widget on your page, we keep the last stats our servers got for it in our database (Supabase): the numbers, ranks and names the page shows (for Valorant also your last 5 matches; for Steam your Steam name, avatar and most played games of the past 2 weeks; for Counter-Strike 2 your lifetime stats from Steam), the counts behind them and the game's own ID for your account where it gives one (for the stats history, below), the widget's details, when the game's stats service last answered and when we last asked it. We never keep whether you are online on Steam or what you are playing. We keep them so that your page, each game's stats page, your link preview and /profile can still show your stats, with when they were last updated, while a game's stats service is down, slow or out of requests: for up to 14 days after it last answered. This is also how we store data we get from Steam (its Web API and Steam Community). They are also what /top ranks in our Discord server (below). Only our servers and, for /top, our Discord bot can read them.
• Stats history: for each Fortnite, Counter-Strike 2, Chess.com, Overwatch 2, Apex Legends and osu! widget your page shows, we keep one reading a day (a UTC day; the last one of the day counts) of the numbers our servers got for it: counts, ratings and ranks as the game gives them (such as wins, matches, kills and deaths, ratings and games per mode, ranks and ranked points, pp and play count, never worked-out figures like K/D), the game's season when it says, and which account they are, by the game's own ID for it (your Epic account ID, SteamID64, osu! user number or Apex Legends UID, or its name where there is none), so the history follows your account rather than what was typed. A reading is taken when your page, one of its stats pages or your dashboard looks your stats up; for pages with Premium, our servers may also look them up once a day to fill in days nobody visited. A new history starts with what we already have: your saved stats from an earlier day and, for osu!, the global rank osu! itself shows for each of your last 90 days. It is kept in our database (Supabase), where only our servers can read it, to show how your stats change over time. Pages without Premium are recorded too, so that getting Premium shows your past straight away. Once you turn trend lines on (Dashboard → Page → Stats → Trend lines; they're off until you do), a page with Premium shows it as small trend lines next to its stats, on the page and its stats pages (how each one moved in the last 30 days, such as “up 120 in 30 days”), public there like the rest of your stats until you turn them off. Once this site shows it, pages with Premium will also show it as charts and recap cards on their stats pages, public there like the rest of your stats unless you hide them, and your dashboard will show how many days are kept (Valorant's rank history comes from your match history, above, instead).
• Page history: each time you save your page, we keep a copy of how it is set up, as a version: your profile content and settings (above), your links, your widgets with the details you entered, your clips, music, loadout, setup, stream settings and looks and, with Premium, your goal. Never the stats we look up for your widgets, and never the settings you turn on to be listed (the leaderboard, Explore and the Top inviters board): restoring a version never turns one back on. A restore also leaves In game now, your trend lines and whether your stats history shows as you last set them, and never brings back a game you took off your Rarest achievements. At most one version for every 5 minutes of saving, and one each time you restore a version. A version keeps the address of each picture, video or song you uploaded, not the file itself: while your page has Premium, we keep the files your page's versions use (up to 10 files in all, the newest versions' first), so they can come back with an earlier version; otherwise a file is deleted when you replace or remove it (see How long we keep it), and then it can't come back. When we change your page to moderate it, its versions from before that can't be opened or restored any more. We keep them so that you can look back through your page's versions and restore one, which is part of Premium. Pages without Premium are recorded too, so that getting Premium shows your earlier versions straight away. Only you can see your page history, in your dashboard; it is never shown to anyone else. It is kept in our database (Supabase).
• Loadout and setup (only if you use Dashboard → Page → Loadout): the Valorant agents you main, your Valorant crosshair code, and the gear you list, with its category, name and the link you add, if any. These are public on your profile.
• Announcement, latest video and codes (only if you use them): the line you pin to the top of your page, its link and the last day it shows, with the time zone that day is on (your browser's when you pick it); your YouTube channel (its @handle or channel ID); and your discount codes, each with its brand, the code, and a short line and a link if you add them. These are public on your profile, and so is your channel's newest video (its title, picture, length and when it came out), which our servers look up on YouTube (see section 3).
• Stream settings (only if you use Dashboard → Page → Stream): your Twitch and Kick channel names, and your stream schedule: the days, start times and lengths you set, your time zone and the note you add. These are public on your profile, and so is whether you are live on those channels, with your stream title, game or category and viewer count. Once your page can offer it (the Beta lab: pages with Premium first, then every page), your schedule is also a calendar file anyone can download from your page or subscribe to, at an address of its own (clutx.site/api/calendar/feed/ followed by a random code we give your page, which stays the same when you change your username and never shows your account): it holds your display name, your schedule and its note, your time zone, your Twitch or Kick channel's address and a link to your page. Calendar apps that subscribe to it fetch it from us again now and then, and keep their own copy under their own policies.
• Link previews: when anyone shares a link to your profile, the app it is shared in (for example Discord, X, WhatsApp or iMessage) loads a preview image from us. It shows your display name, avatar, background picture (or, with Premium, the picture you picked for it), username, badges (and your milestone badges when there is room) and the stats of up to three games on your page (such as your Valorant rank, your Counter-Strike 2 lifetime K/D, headshot rate and share of matches won, or your Fortnite wins and K/D), or your view count if you show it. Those apps may keep their copy of the preview after you change or delete your profile.
• /profile in our Discord server: anyone in our official Discord server can use the /profile command to post a page's public details in a channel: display name, @username, avatar, the first 200 characters of the bio, badges (and milestone badges), one stat from your page (your Valorant rank, CS2 lifetime K/D and headshot rate, Fortnite wins and K/D, best Chess.com rating, or your view count if you show it) and the accent colour, with a link to the page. Anyone can ask for a page by its username. Someone can also pick a member of the server, but a page only comes up that way when its owner linked that Discord account and the page shows that account's Discord widget, so /profile never tells anyone which page is yours unless your page already shows your Discord. /profile on its own shows the page linked to the Discord account of the person using it. Banned pages never come up. To answer, our bot gets from Discord the user ID of the person using the command and of the member they pick. It keeps the first in its memory for 10 seconds (one lookup per person every 10 seconds) and a page's public details for a minute, and stores neither. A posted card stays in the channel as it was, even after you change or delete your page: Discord keeps it under its own policy until someone deletes it (ask a moderator of the server, or us).
• /top in our Discord server (only if you turn the leaderboard on): anyone in our official Discord server can use the /top command to post a list of the server's members ranked by one game's stats. A page is only listed while its "Show me on the leaderboard" setting (below) is on, its owner linked a Discord account that is in the server and the page shows that account's Discord widget, so /top never ranks anyone who didn't turn the leaderboard on, and never tells anyone which page is yours unless your page already shows your Discord. Banned pages never come up. For each of the top 10, the list shows the page's display name with a link to it and its stat in that game, with the details its line shows: Valorant rank, CS2 lifetime K/D and headshot rate, Fortnite wins and K/D, best Chess.com rating and whether it is rapid, blitz or bullet, Overwatch 2's best role rank and that role, Apex Legends rank and ranked points, osu! pp with your global rank and mode, or Brawl Stars or Clash Royale trophies. They come from the saved stats (above) of the widgets your page shows: Valorant only for the Riot account you connected with Riot sign-in, never for a game account another page holds on the leaderboard (in Overwatch 2, Apex Legends and osu!, which have no leaderboard, every page that shows an account is listed), and only stats the game gave our servers in the last 3 days (our servers ask again whenever your page or dashboard is opened). So a game account you make private or delete is off the list within 3 days. Turn the leaderboard setting off, or remove the Discord widget (or the game's widget), to stay off the list. Our bot keeps the list it reads for a game in its memory for a minute and the Discord user ID of the person using the command for 10 seconds (one list per person every 10 seconds), and stores neither. A posted list stays in the channel as it was, like a /profile card.
• Premium perks in our Discord server: while your page has Premium (bought, or from invites) and a Discord account is connected to it (you logged in with Discord or connected it in Dashboard → Account → Connections), our bot gives that account the Premium role in our official Discord server. Everyone in the server can see who has a role: it shows that you have Premium, not which page is yours. To keep it right, every 2 minutes and when someone joins the server, the bot asks our database which Discord user IDs are connected to a page with Premium and compares them with the server's members; it keeps that list in its memory only. Our bot takes the role away within a few minutes, while it is running, when Premium ends, when you disconnect Discord or when your page is banned. With Premium you can also use /card there: our bot posts your page's share card (the link-preview image above, without Brawl Stars or Clash Royale stats) in the channel, with a link to your page. It keeps your Discord user ID in its memory for 30 seconds (one card per person every 30 seconds) and stores nothing. A posted card stays in the channel as it was, like a /profile card.
• Discord pings (Premium, only if you turn them on): the "Message me on Discord" setting in Dashboard → Account → Settings is off unless you switch it on. While it is on, your page has Premium and a Discord account is connected to it, our bot sends that account direct messages on Discord: how many visitors pressed GG on your page (at most one message an hour), and when your page passes a view milestone (1K, 10K, 100K or 1M views). To know what is new, every 3 minutes it asks our database for your page's GG and view counts and your Discord user ID. While the setting is on, our database keeps the GG and view counts you were last told about, when the last GG message went, and whether Discord refused the bot's message (it then stops trying until you turn the setting off and on again). Turning the setting off deletes all of it. The messages stay in your Discord until you delete them.
• Weekly highlights in our Discord server (only for pages on Explore): every Monday our bot posts in a channel of our official Discord server the highlights of the week before, from the pages whose owners turned on "Show my page on Explore" in Dashboard → Share → Public lists, never banned ones. That setting puts your page in these posts as well as on Explore, and its description in the dashboard says so. A post names each page by its display name, with a link to it, next to a rank-up (the game, and its Valorant, Overwatch 2 or Apex Legends rank before and after the week, from the stats history above and the Valorant match history; never for a page that hides its stats history), how many GGs it got that week (the pages with the most), or the fact that it is a new page, made that week. To count each week's GGs we keep how many GGs each page on Explore got that week (never who gave them), and we keep which weeks the bot has posted, with the post's ID in Discord, so it never posts a week twice. Turn the setting off and save, and your page is left out of the next posts and its weekly GG counts are deleted that night. A post already made stays in the channel as it was, even after you turn the setting off or delete your page: Discord keeps it under its own policy until someone deletes it (ask a moderator of the server, or us).
• Leaderboard (only if you turn it on): the "Show me on the leaderboard" setting in Dashboard → Share → Public lists is off unless you switch it on. While it is on, our public leaderboard at clutx.site/leaderboard lists your display name, avatar, @username and badges, with a link to your page, next to the game account name and stats from each of your Valorant, Chess.com, Fortnite, Counter-Strike 2, Brawl Stars and Clash Royale widgets (Valorant rank, and RR while it comes from HenrikDev; once Valorant stats come from Riot, the board only lists the Riot account you connected with Riot sign-in; best Chess.com rating and whether it is rapid, blitz or bullet, Fortnite wins and K/D, CS2 lifetime K/D and headshot rate once you have played at least 1,000 rounds; for CS2 we keep your SteamID64 and the board shows your Steam name, and it only lists the Steam account you connected with Steam sign-in; Brawl Stars and Clash Royale trophies and your best, kept by your player tag, with your name in the game), your position and when those stats were last looked up. For this we store a copy of the account name and stats as the stats service returned them to our servers whenever your page or your dashboard looks your stats up. The numbers never come from anything you type. Turn the setting off and save, and your leaderboard entries are deleted straight away. The same setting also puts you on /top in our Discord server (above), while your page shows your Discord widget.
• Explore (only if you turn it on): the "Show my page on Explore" setting in Dashboard → Share → Public lists is off unless you switch it on. While it is on, our public list at clutx.site/explore shows your display name, avatar, @username and checkmark if your page is verified, with a link to your page, and your games, each with its rank or main number from the stats we keep for your page (Saved stats, above), so people can find you by game, rank or name. Pages are listed by when their owner last changed them, so while your page is on Explore we keep when you last changed it (a page moves up at most once an hour). That time is never shown or given to anyone; only the order shows which pages changed most recently. Turn the setting off and save, and your page leaves Explore straight away and that time is deleted (within two hours if you changed your page in the hour before, so a page can't come straight back to the top). The same setting also puts your page in the weekly highlights in our Discord server (above): a post with your display name, a link to your page and your rank-up (the rank before and after the week, from the stats history), the week's GG count or the fact it is new. Posts already made stay in Discord after you turn the setting off or delete your page.
• Invites: if you sign up with someone's invite link, we store who invited you (their account), when you signed up, and whether and when your invite counted. It counts once your email address is confirmed (or you signed up with Google or Discord) and your page has an avatar or a bio, plus a link or a widget other than the Discord status. The person who invited you then gets 7 days of Premium, for up to 4 invites a month, and we store how many days each invite gave them. To stop people inviting themselves, we compare the email addresses of the two accounts (ignoring capital letters, anything after a "+", and dots in Gmail addresses); we show them to nobody. So that each email address only counts once, an invite that counted keeps a one-way hash (a SHA-256 fingerprint) of your confirmed address, compared the same way, never the address itself; another account with the same address then doesn't count. The person who invited you only sees numbers (how many people signed up with their link, how many set up their page, the days they earned), never who. For your page's first 14 days, we also use the record of who invited you to offer you, in your dashboard, the look of their page (only its style settings, which anyone can see on that page, never its words or pictures), and we keep whether you used it or said no with your account, so we don't ask again. People who sign up from your page are offered your page's look the same way. Whether a page has Premium, and until when for Premium from invites, can be read by anyone, like the Premium badge.
• Top inviters board (only if you turn it on): the "Show me on the Top inviters board" setting in Dashboard → Share → Public lists is off unless you switch it on. While it is on, our public board at clutx.site/leaderboard/inviters ranks you among the pages whose invites counted the most in the current calendar month (UTC), with your display name, avatar, @username and how many of your invites counted that month, never who you invited. If you finish a month in the top 3 (from the month the board started), your page shows a badge saying so (the month, your place and that number), and we store it with your account; it only shows while the setting is on. Banned pages are never listed. Turn the setting off and save, and you leave the board, and your badges stop showing, straight away.
• Verified pages: if we check that a page belongs to the streamer or creator it names, the page shows our checkmark, and we keep when we verified it, which of our accounts did, and a private note on how we checked it, which only we can read.
• Founder badge: the first 100 pages on clutx.site show a founder badge with their number (for example "Founder #7"), on the page and on Explore, numbered in the order they qualify: once the page is made and its account is confirmed, whichever comes last (a page isn't counted while it's banned). We store which number your page got.
• Team pages (only if you create or join a team): a team's page, at clutx.site/team/ and the address its owner picked, is public. It shows the team's name, tag, game, bio and colour as its owner wrote them, and each of its players (up to 10): display name, avatar, @username, a link to their page and the top stat from it (the one their share card shows, from the stats we already keep for that page); the owner is marked as such. While its owner has Premium, it's drawn in the look of the owner's page (theme, font, background style, particles and screen overlay, never their pictures, video or music), which their page shows anyway. The pages of a team's players link to it. For this we store which team your page is in, whether you own it, your place in its list and when you joined. Each team's invite link holds a secret code that only its owner can see: anyone who has the link can join while the team has room, so it's for sharing with teammates. If you open a team's invite link, we remember it for up to 24 hours (see Cookies below). Signing up from a team's page or its invite link counts as an invite from the team's owner (see Invites above). You can leave a team, or as its owner hand it to another player or delete it, in Dashboard → Page → Team.
• Premium payments (only if you buy Premium): you pay on PayPal, which handles the payment; we never see your card or bank details. We store what you send us from your dashboard: PayPal's transaction ID and, if you give it, the PayPal email address you paid from, with your personal code, the price, when you sent it, and whether and when we activated or rejected it (and why). In our PayPal account we see what PayPal shows any seller about a payment, such as the payer's name, email address and note. We use all this only to find your payment and give you Premium, to handle refunds and chargebacks, and for our accounts. When you send a payment, our bot posts a short notice for us in a private channel of our Discord server: its code, your username and the price, never your email address or transaction ID.
• Refund requests: what you send on our refund page (the username or email address, PayPal transaction ID and message you enter), the request's code, and when it arrived and when we handled it. We link it to the payment with the same transaction ID, if there is one, and get the same kind of notice in Discord, with just the request's code. To keep the form from being flooded, our server keeps your IP address (for an IPv6 address, its first half) in its memory for about 10 minutes; it isn't stored.
• Messages: anything you send us, such as support requests or abuse reports.

Information collected automatically

• Profile view counts: to count unique daily views, we create a one-way, salted hash of the visitor's IP address and the date. We do not store raw IP addresses. These hashes are only used to prevent double-counting and are deleted after 30 days.
• Link clicks: we count how many times each link is clicked. We do not record who clicked.
• Page analytics: for each profile we keep daily counts: how many unique views it got each day, how many times each of its links was clicked, and, for those views, which kind of site the visitors came from (such as Discord, X, a search engine, another page on clutx.site, or none) and which country they were in. The kind of site is worked out from the address of the page the visitor came from, which their browser gives us; we keep only its kind, never the address. The country comes from Cloudflare, which carries connections to our server and tells it the country of the visitor's IP address. We do not store IP addresses or any record of individual visitors for this, only these totals, and only the profile's owner sees them, in their dashboard. If you are logged in, your login cookie is sent with a view or a link click, and we only use it so your visits to your own page and clicks on your own links don't count.
• GGs: visitors can tap GG on a profile once a day. To count each visitor only once, we create a one-way, salted hash of their IP address (for an IPv6 address, only its first half, the part one home or phone network shares), that profile and the date. We do not store raw IP addresses, and no cookie is set for it. These hashes are only used to refuse a second GG on the same day and are deleted after 2 days. When a GG is sent, our server also keeps that address (or its first half) in its memory for a short time, usually a minute or two, to limit how many GGs one connection can send. How many GGs a profile has is shown on it, unless its owner turns the GG button off. If you are logged in, your login cookie is sent with a GG and we only use it to stop you giving GGs to your own page. We do not record who gave a GG. For the weekly highlights in our Discord server (above), we also keep how many GGs each profile on Explore got each week, for 5 weeks.
• Milestone badges: your page shows a badge when it passes 1,000, 10,000, 100,000 or 1,000,000 views, or 100, 1,000 or 10,000 GGs. We work them out from those counts each time your page or its link preview is drawn, so nothing more is stored. View milestones only show while you show your view count, and GG milestones while your GG button is on.
• Live viewer count (pages with Premium that show it): while one of these pages is open and on screen, the visitor's browser tells our server about every 20 seconds that it's still there, with a random number it made up for that tab when the page loaded (not a cookie, and not kept on the device). Our server keeps that number, the page and when it last heard from it in its memory only, for about a minute, and counts how many tabs have the page open, which the page shows from 2 people ("3 people here right now"). When the tab is hidden or closed, it says so and stops counting. Nothing about the visitor is stored, and no cookie or login is used for it. With each of these messages our server reads the visitor's IP address only to make a one-way hash of it (for an IPv6 address, of its first half), with a key that changes whenever the server restarts, and never keeps the address itself. The hash stays in its memory for about a minute, next to that tab's number and the page, so that one connection can't count more than 5 tabs on a page or send more than 60 of these messages a minute. Crawlers and link previews are never counted.
• Live Discord status: if you connect your Discord account to your profile, add the Discord widget, and are in our official Discord server, our bot in that server stores your current Discord status: your Discord user ID, username, display name, avatar, whether you are online, idle, on do not disturb or offline, the game or app you are using, your custom status, and the Spotify song, artist and album cover you are listening to. It is updated as your status changes and is public on that profile, like the widget itself. We only store this for people who connected their own Discord account and show the widget, never for other people in the server, and nobody can show someone else's Discord status.
• Language: to show the site in English, Spanish or Portuguese, our server reads the language your browser asks for (its Accept-Language setting) with each page request. It isn't stored. If you pick a language in the menu at the bottom of the page, on the log-in and sign-up pages or in Dashboard → Account → Settings, a cookie remembers your choice on your device (see our Cookie Policy).
• Technical logs: our hosting and database providers may keep short-lived server logs (IP address, request time, URL) for security and debugging.
• Cookies: only the ones the site needs (including, while you connect Steam, Riot or GitHub, one that holds a one-time code for up to 10 minutes), one that remembers the language you pick (once you pick one), and, after you open someone's invite link, one that holds their username for up to 24 hours so we know who invited you if you sign up (and, after you open a team's invite link, one that holds the team's address and invite code for up to 24 hours, so you can join it once you've signed up or logged in). See our Cookie Policy.

2. Why we use it (legal bases)

We do not sell your personal data, sell or place ads, or use your data for advertising profiling. A clip's or song's player comes from its platform, not from us, and once a visitor presses play it may show that platform's own ads (see section 3).

3. Who we share it with

We share data only with service providers (processors) that help us run the Service:

• Supabase: database, authentication and file storage
• Hostinger: the host that runs the website (it sees visitors' IP addresses and the pages they request) and our email. It sends the emails that confirm your email address and reset your password (so it receives your email address and what the email says), and holds our mailbox, where the messages you send us arrive. These emails load no pictures or anything else from other sites, and don't tell us whether you opened them
• Valve (Steam): if you connect Steam, you sign in on Steam's site, and our server asks Steam to confirm that sign-in. For In game now and Rarest achievements, our servers ask Steam's Web API about that account by its SteamID64, and about the games you picked by Steam's numbers for them (section 1)
• Riot Games: if you connect a Riot account, you sign in on Riot's site, and our server asks Riot which account signed in and which Valorant region it plays on. Once Valorant stats come from Riot, our servers ask Riot's API for that account's match history by its PUUID, never with your email or other account details
• GitHub: if you connect GitHub, you sign in on GitHub's site, and our server asks GitHub once which account signed in, then revokes the access GitHub gave it. For your GitHub widget, our servers then ask GitHub's API for that account's public profile by its number, never with your email or other account details
• Google and Discord: to sign you in, or to connect them to your account, if you choose to use them. Discord also runs our Discord server, where our bot, which we run on our own computer, reads the live status for Discord widgets, answers /profile, /top and /card, gives the Premium role, sends Discord pings and posts the weekly highlights (Discord receives and shows the public page details, lists, highlights and share cards it posts and who has the role, delivers the direct messages it sends, and loads the page's avatar to show it), and where the website posts our notices of new payment and refund requests in a private channel, under the bot's name (section 1)
• Cloudflare: carries visitors' connections to the website (it sees your IP address and the page you request, and doesn't store page contents for us). Cloudflare also tells our server which country a connection comes from, which we count for page analytics (section 1)
• PayPal: if you buy Premium, you pay on PayPal's own site or app, under PayPal's own privacy policy (for the payment, PayPal decides what it collects, as a controller in its own right). We don't send PayPal anything about you

To show widget stats, our servers send the game or account name you entered to the matching stats service: HenrikDev API (Valorant, until this site gets Valorant stats straight from Riot), Riot Games (Valorant once it does, and then only for the Riot account you connected), OverFast API (Overwatch 2, which reads Blizzard's public career pages), Apex Legends Status (Apex Legends), osu!, Fortnite-API.com, Steam (Steam and Counter-Strike 2), Chess.com, Roblox, GitHub (for the GitHub account you connected, by its number) and Supercell (Brawl Stars and Clash Royale: your player tag goes to Supercell's official APIs to look up your public stats). We only send the name or tag you entered (and the region, platform or game mode you picked), never your email or other account details. For Steam and Counter-Strike 2 that is your SteamID64: if you enter a Steam profile link or custom name, our servers send it to Steam (steamcommunity.com) to find the SteamID64 behind it and show you whose account it is, so you don't have to look it up anywhere. For the Steam widget, our servers read your public Steam profile from Steam. For Counter-Strike 2, they read your public Counter-Strike stats page on Steam and ask Steam's Web API for your lifetime stats and hours played, only for the Steam account you connected; visitors' browsers load nothing from Steam for it unless they follow the link to your Steam profile. For In game now and Rarest achievements, they ask Steam's Web API too, only for the Steam account you connected (section 1). Steam avatars, game icons and achievement icons are downloaded by our servers and sent to visitors from our own address, so visitors' browsers load nothing from Steam either. For the LIVE banner, our servers send the Twitch or Kick channel name you entered to Twitch (the Twitch API) or Kick (the Kick Public API), about once a minute while your page is open somewhere and while you edit it in your dashboard, and show what they return: whether you are live, the stream title, game or category and viewer count. Visitors' browsers get this from us and load nothing from Twitch or Kick, unless they follow the banner's link. Your schedule is turned into each visitor's time zone in their own browser, and their time zone isn't sent to us. The Discord widget's live status comes from our own database: while someone views a page with a Discord widget, their browser keeps a connection open to Supabase to receive status changes, and it doesn't contact any third-party status service. For the clutx Discord row (on pages that add it, and on our home page), our servers ask Discord, with our bot, for our own Discord server's name, icon and how many of its members are online and in all, at most every 5 minutes; nothing about visitors is sent. Pictures, songs and videos are loaded through clutx.site. Valorant rank emblems and agent portraits are our own copies of Riot's artwork, kept on our server and sent from our address. The other pictures on profiles and their stats pages, the leaderboard and the dashboard (game pictures such as Overwatch, Apex Legends, osu!, Chess.com, Roblox and GitHub pictures, Discord avatars and Spotify album covers in the Discord status, our Discord server's icon, profile pictures from Google or Discord sign-in, and the thumbnail of the newest video in a Latest video row) are fetched by our servers from the service they come from, made the size they are shown at, and sent to visitors from our own address. So are the pictures, songs and videos people upload, which our servers pass on from our storage. Visitors' browsers load none of them from those services or from our storage provider, so those services don't see visitors' IP addresses; our servers only ask them for the picture or file itself. Links in a Setup list or a Codes list go straight to the site you chose, so when a visitor follows one, that site sees their IP address and that they came from clutx.site. An announcement's link goes straight to its site too, which sees the visitor's IP address, but the visitor's browser doesn't tell it they came from clutx.site. To list the agents you can pick in Dashboard → Page → Loadout, our servers download Valorant-API's public list of agents, which sends nothing about you. On pages without Premium, our servers make a still copy (the first frame) of an uploaded avatar from our storage, so an animated one doesn't move, and visitors load that copy from us. Premium pages show it too, to visitors whose device asks for less motion and while a visitor has paused the page's animations. To draw link-preview images, our servers download your avatar from where it is hosted. The fonts on link previews are our own copies, and names are drawn without emoji (a name in letters those fonts don't have shows as the username), so nothing else is downloaded for them. For rich links (Premium), our servers visit the pages of the links you turn them on for: when you save your dashboard, press Try again there or open it with a link not read yet, and in the background while your page is visited (each link about once a week, sooner when its last reading failed). They send that site only the page's address and our own name for the visit (clutxbot, in the user agent), never cookies, your details or anything about your visitors, and they never visit addresses inside private networks or our own servers. Visitors load our copy of the page's picture from us, never from that site. These requests come from our servers and include no visitor data. We may also disclose data if the law requires it, or to protect the rights and safety of our users.

Visitors' browsers only connect to other sites in these cases:

• Supabase, our database and login provider: when you log in, sign up or reset your password, while you use your dashboard (including when you upload a file), and while a page with a Discord widget is open, to receive that status as it changes.
• Clip and music players: a clip's player loads from YouTube, Twitch, Medal or Streamable, and a song's player from YouTube or Spotify, only after a visitor presses play (see below).
• Sites you choose to go to: a link you follow, PayPal when you open it to pay for Premium, and Google, Discord, Steam, Riot or GitHub when you sign in with them or connect them to your account.

Clips are shown as a play button and a title, drawn by our site. Nothing is loaded from YouTube, Twitch, Medal or Streamable until a visitor presses play. Then the visitor's browser loads that clip's player straight from the platform (for YouTube, its privacy-enhanced player at youtube-nocookie.com). From that moment the platform receives the visitor's IP address and browser details, knows which clip is playing and that it is shown on clutx.site, and may set cookies or use similar storage under its own privacy policy. See our Cookie Policy. We don't receive any data back from these players.

Music can be a song the page's owner uploads (it comes from our own address, see above) or a link to a song on YouTube or Spotify. A linked song is shown as a play button with its title and artist, drawn by our site, and nothing is loaded from YouTube or Spotify until a visitor presses play (the enter screen never starts one). Then the visitor's browser loads that platform's player straight from it (YouTube's privacy-enhanced player at youtube-nocookie.com, or Spotify's player at open.spotify.com). From that moment the platform receives the visitor's IP address and browser details, knows which song is playing and that it is shown on clutx.site, and may set cookies or use similar storage under its own privacy policy. Spotify sets a cookie as soon as its player loads, before anything plays (see our Cookie Policy). We don't receive any data back from these players. When an owner pastes a YouTube or Spotify link in Dashboard → Page → Music, our servers ask that platform's public oEmbed service for the song's title (and, from YouTube, its channel's name), and whether it can be played on other sites, sending only the link (for a spotify.link short link, our servers first ask spotify.link where it leads). We save the link, title and artist with the profile, and never the song itself or its cover.

Latest video: when a page has a YouTube channel in its Latest video row, our servers ask YouTube for that channel's newest video, through the YouTube Data API with our own key. They send the channel's @handle or ID, never anything else about the page's owner or its visitors, and get back the channel's name and the titles, lengths, dates and shapes (to tell Shorts apart) of its newest uploads. Our servers keep the answers in their memory for half an hour (which channel a handle is, for a day), so a page asks YouTube about once every 30 minutes, however many people open it and however often its owner saves it (and again after our servers restart, since their memory then starts empty). While you type a channel in Dashboard → Page → Clips → Latest video, our servers also ask YouTube about it, the same way, to show you what they found. Opening the dashboard does the same for your saved channel when it isn't in their memory. Nothing about the video is stored in our database. Visitors' browsers load nothing from YouTube for this row (its picture comes from our own address, see above) unless they follow its link to the video. This uses YouTube API Services, and Google's Privacy Policy applies to what YouTube receives.

4. International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers are protected by Standard Contractual Clauses or equivalent safeguards.

5. How long we keep it

• Account and profile data: until you delete your account.
• Uploaded files: deleted when you save your page after replacing or removing them, or when you delete your account. While your page has Premium, a file one of its versions in your page history still uses stays until no version you can restore uses it (up to 10 files in all, the newest versions' first). Files you uploaded but never saved are deleted the next time you save, once they are an hour old.
• View de-duplication hashes: 30 days.
• Page analytics (daily counts of views, link clicks, referring sites and countries): 90 days, then a nightly clean-up deletes them. A link's counts go when the link is deleted, and all of a page's when its account is deleted.
• GG de-duplication hashes: 2 days. The GG count itself stays on your profile until you delete your account.
• Email sign-ups that are never confirmed: deleted after 2 days, with their profile and username.
• Live Discord status: only while a profile shows a Discord widget with your ID and you are in our Discord server. Our bot deletes it within about a minute after no profile shows that ID any more (the widget is removed, the account is deleted or the profile is banned) or you leave the server.
• Leaderboard entries: only while the setting is on and the widget is on your page. They are deleted as soon as you turn the setting off, remove or change that widget, are banned or delete your account. Entries whose stats haven't been looked up for 30 days (because nobody opened your page or your dashboard, or the lookup kept failing) are hidden from the leaderboard and deleted by a nightly clean-up. A Counter-Strike 2 entry is also deleted the next time your stats are looked up after Steam stops showing them (for example because you made your game details private), and a Valorant entry from Riot as soon as you disconnect or change your Riot account. The leaderboard page itself is cached for up to a minute.
• Explore: your page is listed only while the setting is on and your page isn't banned; Explore's lists are cached for up to a minute. When you last changed your page while it was on Explore is kept, where only our servers can read it, while the setting is on: it's deleted when you turn the setting off (within two hours if you changed your page in the hour before) or delete your account.
• Top inviters badges: kept with your account until you delete it, and shown only while the Top inviters setting is on and your page isn't banned. We take a badge off if it was won by breaking our Terms (for example with fake sign-ups). The board itself is worked out from the invites above, which are kept as described there.
• Founder badge: your page's number is kept until you delete your account. The spot isn't given to anyone else then.
• Verification: kept until we take the checkmark off, you change your username or display name (the checkmark and its note go then) or you delete your account.
• Saved stats: deleted as soon as you remove or change that widget, you disconnect or change your Steam account (Counter-Strike 2 stats) or your Riot account (Valorant stats from Riot) or your GitHub account (GitHub stats), your page is banned, or you delete your account, and the next time your stats are looked up after the game says the account doesn't exist or is private (for example because you made your Steam game details private). Pages stop showing them 14 days after the game's stats service gave them, and a nightly clean-up deletes them once they haven't been refreshed for 60 days.
• Stats history: each day's reading for 90 days, or 400 days once your page has had Premium (also after it ends, or after a refund: for this we keep a note that your page has had Premium, until you delete your account); a nightly clean-up deletes older ones. When you remove or change the widget, or the game says the account doesn't exist or is private, that account's history is set aside and deleted 30 days later, unless the same account is back on your page by then; at most 12 set-aside histories are kept per page, and the oldest goes first. It is deleted at once when you delete it (in your dashboard, once it offers it, or by emailing us), disconnect or change your Steam account (Counter-Strike 2), your page is banned, or you delete your account. After you delete a game's history, a new one starts the next day if the widget is still on your page, and never again with the deleted days: we keep only the game and the day you deleted it (never the account or its numbers), for up to 400 days. Nothing is deleted when Premium ends.
• Live viewer count: each tab's random number, with the page and the one-way hash of its connection's IP address, in our server's memory for about a minute after it was last heard from (until the tab says it's hidden or closed, if that comes first), and the hashes that limit how many messages one connection sends, for a minute. Never stored: all of it is gone when the server restarts. Calendar files: written each time they are asked for, from your page as our server last read it (at most 5 minutes before), and not kept. Our Discord server's details for the Discord row: in our server's memory for 5 minutes (up to an hour while Discord doesn't answer).
• Page history: a page's newest 30 versions once it has had Premium (10 if it never had it), none older than 90 days, except the newest one (your page as it is now), which stays as long as your page is like that; a nightly clean-up deletes older ones. A version bigger than 64 KB isn't kept. Nothing is deleted when Premium ends. When we moderate a page, we may delete its versions from before that. All of it is deleted at once when you delete your account.
• Live status for the LIVE banner: kept in our server's memory for about a minute, then asked again. It is never stored in our database. Your channel names and schedule stay until you remove them in Dashboard → Page → Stream (then up to 90 days more in your page history) or delete your account.
• Loadout and setup: until you remove them in Dashboard → Page → Loadout (then up to 90 days more in your page history) or delete your account.
• Announcement, YouTube channel and codes: until you remove them in your dashboard (then up to 90 days more in your page history) or delete your account (an announcement stops showing after its last day, and stays saved until you change or remove it). YouTube's answers about your channel: in our servers' memory for half an hour (which channel a handle is: a day; the last video found, shown while YouTube can't be asked: up to a week), and all of it is forgotten when our servers restart.
• Connected Steam account: until you disconnect it in Dashboard → Account → Connections or delete your account. The Steam sign-in cookie: 10 minutes at most, deleted as soon as you come back from Steam. Steam pictures: kept by our servers for up to a day and by visitors' browsers for up to a week. Counter-Strike 2 stats: kept in our servers' memory for up to a week, and asked from Steam again after 30 minutes. Older ones only show while Steam's daily limit of requests for our site is used up or its Web API doesn't answer, and they are forgotten as soon as Steam shows your game details as private. The last ones shown are also kept as saved stats (above).
• In game now: what you are playing, in our servers' memory for about a minute, never in our database. The switch stays until you turn it off or delete your account.
• Rarest achievements: the games you pick stay until you remove them in Dashboard → Page → Stats or delete your account (also after Premium ends, when your page stops showing them). What we keep from Steam for them is replaced about once a day while your page is viewed, and deleted as soon as you remove that game, disconnect or change your Steam account, your page is banned or you delete your account; a nightly clean-up deletes it once Steam hasn't been asked about it for 30 days. What Steam says about your achievements in a game: in our servers' memory for up to an hour, and gone at once when you remove that game or disconnect or change your Steam account. The list of your Steam games (read when you open Dashboard → Page → Stats with In game now on or with games picked, or click "Add a game" there): in our servers' memory for up to 6 hours, and gone at once when you disconnect or change your Steam account.
• Connected Riot account: until you disconnect it in Dashboard → Account → Connections or delete your account. The Riot sign-in cookie: 10 minutes at most, deleted as soon as you come back from Riot. The access Riot gives our server at sign-in: used once and never stored. What we read from your matches (the numbers the match strip shows, your rank and your level) is kept in our server's memory, so that Riot is only asked again for new matches; the last stats shown are also kept as saved stats (above). Your Valorant match history (your own line from each competitive match): until you disconnect your Riot account, connect a different one in its place or delete your account; all of it is deleted at once then.
• Connected GitHub account: until you disconnect it (Dashboard → Account → Connections, or the GitHub widget) or delete your account. The GitHub sign-in cookie: 10 minutes at most, deleted as soon as you come back from GitHub. The access GitHub gives our server at sign-in: used once, revoked at GitHub straight away and never stored. Your GitHub stats are asked from GitHub again after 10 minutes; the last ones shown are also kept as saved stats (above).
• Invites: while the account that invited you exists. If you delete your account before your invite earned them Premium days, the record of it is deleted with your account. Once it has earned days, the record stays with their account, so the monthly limit can't be dodged by deleting accounts, but it no longer points to you: only the one-way hash of your email address stays with it, so the same address can't count again. Whether you used or turned down the look of the page that invited you: with your account, until you delete it. The invite cookie: 24 hours at most.
• Teams: a team stays until its owner deletes it, or until nobody is left in it. Your place in a team goes as soon as you leave, the owner (or a moderator) takes you out, your page is banned or you delete your account. The owner can't leave (they make another player the owner first, or delete the team); if the owner's page is banned, a moderator takes them out or they delete their account, the team passes to the player who joined it first (with a new invite link), or is deleted if nobody else is in it. If the moderators took a team down, its address is kept after the team is deleted, so it can't be used again. The team invite cookie: 24 hours at most.
• /profile in Discord: the Discord user ID of whoever used it, 10 seconds in our bot's memory, and a page's public details, a minute; neither is stored. Cards already posted stay in Discord until someone deletes them.
• /top in Discord: the list of pages and stats our bot reads for a game, a minute in its memory, and the Discord user ID of whoever used it, 10 seconds; neither is stored. Lists already posted stay in Discord until someone deletes them.
• The Premium role and /card in Discord: the list of Discord user IDs connected to a page with Premium, only in our bot's memory, read again every 2 minutes; for /card, the Discord user ID of whoever used it, 30 seconds. Our bot takes the role off your Discord account within a few minutes, while it is running, once your page no longer has Premium or your Discord is no longer connected to it. Cards already posted stay in Discord until someone deletes them.
• Discord pings: the counts you were last told about, when the last GG message went and whether Discord refused a message, in our database while the setting is on; turning it off (or deleting your account) deletes them. Messages already sent stay in your Discord until you delete them.
• Weekly highlights in Discord: each page's GG count for a week, 5 weeks, or until the night after the page leaves Explore, then a nightly clean-up deletes it (and all of a page's with its account); which weeks were posted, with the post's ID, 90 days. Posts already made stay in Discord until someone deletes them, also after a page leaves Explore or is deleted.
• The language cookie: on your device, for a year after you last picked a language, or until you delete it.
• Link-preview images: our servers and hosting provider cache each one for about 10 minutes, then draw it again from your current profile. Apps where your link was shared keep their own copies under their own policies.
• Rich links: each one is read again about once a week while your page is visited (sooner when its last reading failed, and on the date the page says it stops being available, after which it isn't shown), and the new reading replaces the old one, picture included. A rich link's title, description and picture are deleted right after you turn it off and save, remove the link or change its address (if that save's request doesn't reach our servers, the next time you open or save your dashboard), and when you delete your account. When your page no longer has Premium they stop showing once your page has been drawn again, which happens when it's visited more than a minute after it was last drawn (that visit still gets the earlier copy), and everything we stored for them, pictures included, is deleted the next time you open or save your dashboard, or within a day if you don't (your settings stay, and the pages are read again when Premium comes back).
• Still copies of avatars: kept by our servers and visitors' browsers for up to a day, then made again from the avatar your page shows.
• Copies of pictures from other services and of uploaded pictures, made the size pages show them at: kept in our server's memory (64 MB in all: when it's full the least used are removed first, and all of them when the server restarts) and in visitors' browsers. A copy is used for at least 4 hours, or longer if the service it comes from allows it, and then fetched again the next time someone views it. Most services give a changed picture a new address, so it shows straight away. Uploaded songs, videos and cursor images passed on from our storage: visitors' browsers may keep them for an hour.
• Premium payments: an activated payment is kept as the record of the sale for 10 years (tax and accounting), also after you delete your account, when it no longer points to it. A rejected one is deleted 90 days after we reject it, and a pending or rejected one also when you delete your account. PayPal keeps its own records under its own policy.
• Refund requests: 2 years, then a nightly clean-up deletes them.
• Backups: up to 30 days after deletion.

6. Your rights

Depending on where you live (for example, under GDPR, UK GDPR or CCPA/CPRA), you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data (you can edit most of it yourself in the dashboard);
• delete your data. Use Dashboard → Account → Settings → Delete my account, or email us;
• object to or restrict certain processing;
• receive your data in a portable format;
• complain to your local data-protection authority.

To use any of these rights, email [email protected]. We will reply within 30 days. We do not discriminate against you for using your rights.

7. Children

The Service is not for children under 13. We do not knowingly collect data from them. If you believe a child under 13 has created an account, email us and we will delete it.

8. Security

We use HTTPS, hashed passwords, row-level database security and restricted access to production systems. No system is 100% secure, so please use a unique password.

9. Changes

We will post any changes on this page and update the date at the top. If we make material changes, we will notify you by email.