This is a starting-point policy written for the Glowzy codebase. The operator of a deployed site must replace the bracketed details and have the text reviewed by a qualified lawyer for their jurisdiction (for example GDPR).
Who we are
[Operator name and address] runs this Glowzy site and is the controller of your personal data. Contact: see the contact page.
Data we collect from account holders
Email address, username, a salted hash of your password, the profile content you publish (display name, bio, links, images, audio you upload) and your plan (Free or Premium).
If you connect Discord, we store your Discord user ID and the tokens needed to keep the connection active. Tokens stay on our servers and are never sent to your browser.
Data we collect from profile visitors
Profile views and link clicks are counted for the profile owner's analytics. We store the time, a coarse device category (desktop, mobile or tablet) and the referring website's hostname.
We do not store IP addresses or full user agents. To estimate unique visitors we use a one-way hash that changes every day and cannot be reversed.
Payments
Payments are processed by Stripe. We never see or store your card number. We keep a record of the purchases you make and the gifts you send or receive (who gave Premium to whom, and the optional message) so we can show your plan and your gifts.
Cookies
We use a single, HTTP-only session cookie to keep you signed in. We do not use advertising cookies.
Your rights
You can edit your data in the dashboard, delete your account from account settings, and contact us to request a copy of your data or raise a complaint. Deleting your account removes your profile, links, media records and analytics.
Retention
Analytics events are kept for at most 12 months. Account data is kept until you delete your account.