Privacy Policy

1. Who controls your data

The service provider identified separately in the Provider Notice controls the personal data processed to provide choppa.lol.

Privacy requests must be sent through the legal contact published in that notice. The community Discord is intended for product support and is not a substitute for a legal contact.

2. Account and profile data

We process your email address, username, password hash, role and account status, profile settings, biography, links, aliases, SEO fields, badge choices, and customization values.

When you register, we store the policy version, accepted documents, acceptance time, and acceptance method so the account agreement can be documented.

Uploaded media is stored using generated object keys together with its media type and the settings needed to display it.

3. Connected accounts

If you connect Discord or Google, we receive the account identifier and available profile details such as display name, username, avatar, and email. OAuth access tokens are used during the connection flow and are not stored in the user profile.

Public Discord presence is requested only when that feature is enabled and the linked account can provide it.

4. Sessions, security, and technical data

Our encrypted, HTTP-only session cookie contains account identifiers and session timestamps together with security context such as IP address, user agent, and a device fingerprint. Sessions can last up to 30 days and expire after 7 days of inactivity.

We process IP addresses, user agents, request timing, rate-limit data, and security events to authenticate requests, prevent abuse, investigate errors, and protect the Service. Security logs may store hashed network and browser identifiers; hosting infrastructure may also create operational logs.

5. Analytics

Profile views use a salted hash of the visitor IP, scoped to the profile and day, to reduce repeat-counting without storing the raw IP in the view-event table.

Link-click analytics record the destination link, timestamp, user agent, and a salted one-way visitor hash for abuse prevention and repeat-counting. Raw visitor IP addresses are not stored for new click events. Profile owners receive aggregated activity, not another visitor's account credentials.

6. Payments

Stripe processes checkout and payment details. We receive transaction-related identifiers and product, price, checkout, and subscription status information. We do not receive or store full payment-card numbers.

7. Local browser storage

We use essential cookies for authentication. The dashboard may use local storage for interface preferences such as the selected template tab, and session storage may temporarily cache Discord avatar references.

We do not currently use third-party advertising cookies or sell personal information for targeted advertising.

8. Why we process data

We use data to perform the Service you request, maintain account security, prevent fraud and abuse, provide purchases, comply with legal duties, and pursue legitimate interests in reliable platform operation. Where consent is legally required, you may withdraw it for future processing.

9. Service providers and transfers

Data may be processed by infrastructure and integration providers including Cloudflare services such as D1, R2, and CDN delivery, our hosting provider, Discord, Google, and Stripe. Each provider processes data under its own terms and applicable safeguards.

Because these providers may operate internationally, data can be processed outside your country with safeguards required by applicable law.

10. Retention

We retain account and profile data while the account is active and afterward only as needed for security, disputes, legal compliance, backups, and enforcing agreements. Analytics and operational records may follow different retention periods.

A universal automated retention schedule is not currently exposed in the Service. Contact us for a request applicable to your account.

11. Your choices and rights

You can edit many profile fields and disconnect supported accounts in the dashboard. Depending on your location, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent through the legal contact in the Provider Notice.

We may need to verify your identity. You may also complain to your competent data-protection authority.

12. Children, security, and changes

The Service is not intended for children under 13. We use access controls, encryption, upload validation, rate limits, and other safeguards, but no system can guarantee absolute security.

External links are controlled by their operators. We may update this policy and will publish a revised effective date and reasonable notice for material changes.