This policy explains what isnt.lol ("isnt", "we", "us") collects, why, and what you can do about it.
What we collect
- Account data: username, email address and your password, stored only as a salted one-way hash (we never see or store the password itself). If you sign in with Google or Discord, we also receive that account's ID and email address.
- Security data: whether your email is confirmed, your two-factor login settings, and a hash of your recovery key if you created one.
- Profile content: whatever you add to your page, such as your name, bio, links, images, video and music.
- Sessions: a login cookie (
somai_session) with a random token. We store only a hash of it, plus your browser's user-agent so you can recognise your sessions. - Analytics: when someone visits a profile we store the day, the referring website (domain only), the device type, and an anonymous visitor ID. That ID is a keyed hash of IP address, user-agent and date. It resets every day, and raw IP addresses are never stored.
- Link clicks: a daily count per link. No visitor information.
What we don't do
- We don't sell or rent your data.
- We don't use advertising trackers or third-party analytics on profiles.
- We don't show your email on your page.
Why we use it
We use your data to run your account and page (our contract with you), to keep isnt secure and stop abuse (our legitimate interest), and to send the emails the service needs, such as email confirmation and password resets. We only send other emails, like product updates, if you opted in.
Service providers
These companies process data for us, only to run isnt:
- Cloudflare: hosts the site, database and uploads, protects sign-up and login from bots (Turnstile), and forwards mail sent to our @isnt.lol addresses.
- Resend: sends our emails (email confirmation and password resets) from its EU region.
- Google and Discord: only if you choose to sign in with them.
- Lanyard (api.lanyard.rest): if you add a Discord user ID, visitors' browsers fetch your public Discord presence from Lanyard.
- Embedded media (YouTube, Spotify, SoundCloud, Twitch, Kick, TikTok, Instagram, Apple Music): if someone adds one of these to their page, visitors' browsers load it from that service, which may see their IP address and set its own cookies under its own privacy policy.
- Font and icon CDNs (Google Fonts, cdnjs, jsDelivr): pages load fonts, icons and scripts from these providers, which may see visitors' IP addresses.
- Payment providers (PayPal, Stripe, NOWPayments): when purchases are available, they handle payments. We never see your full card details.
Some of these providers are based outside the EU. Where that applies, data is transferred under the safeguards the law requires, such as the EU–US Data Privacy Framework or standard contractual clauses.
Cookies
We use one essential cookie (somai_session) to keep you logged in. No consent banner is needed for it, because it is strictly necessary.
How long we keep data
Account and profile data stay until you delete your account. Sessions expire after 30 days. Email confirmation links expire after 30 minutes and password reset links after 1 hour. Analytics stay until your account is deleted. Unused uploads are deleted automatically after about a day. Our email provider keeps delivery logs for up to 30 days.
Your rights
You can view and edit your data in the dashboard, and delete your account (and all its data) in Settings. You can also ask us for a copy of your data, to correct or delete it, or object to how we use it: email legal@isnt.lol and we'll reply within 30 days. If you're in the EU/UK, you can also complain to your data protection authority.
Who is responsible
isnt.lol is responsible for your data under this policy. Contact: legal@isnt.lol.
Changes
If we change this policy in a meaningful way, we'll let you know on the site or by email before the changes take effect.