Privacy Policy

This policy explains how the operator of ykwim.xyz ("ykwim", "we", "us") handles personal information when you use the site, create an account, publish a profile, upload files, or pay for a feature. The operator of ykwim.xyz is the data controller for the information described here. We operate under the trading name ykwim.xyz; our legal name and business address are available on request.

Contact: support@ykwim.xyz.

1. What we collect

• Account information: your email address, display name, password hash, and authentication provider details. We never store your plain password. If you sign in with Google, Google shares your email address, name, profile picture, and a Google account identifier with us; we use them to create and secure your account and we do not receive your Google password.
• Profile information: your username, bio, social links, links, colors, layout, badge settings, and other customization you choose.
• Content: avatars, backgrounds, animated images and video, audio, custom cursors, custom badge names and artwork, and other files you upload, including file names, types, sizes, and public URLs.
• Usage information: daily profile view counts. These are aggregated by username and day; we do not store visitor IP addresses for view counts.
• Billing information: Stripe customer, subscription, invoice, and payment identifiers, plan status, and purchase history. Stripe handles card details and, for Managed Payments transactions, acts as merchant of record and handles indirect tax. We do not receive or store full card numbers.
• Technical information: IP address, user agent, and session data used for authentication, security, and abuse prevention. Cloudflare may process request metadata to deliver and protect the site.
• Legal acceptance: the date you accepted these policies and whether you confirmed you are 13 or older.
• Support correspondence: the contents of messages you send to support, including your email address and any attachments you include.

2. How we use it

• create and secure your account, sign you in, and verify your email;
• publish and serve your profile, links, and uploaded files;
• provide paid features, process payments, manage subscriptions, and show invoices;
• detect abuse, enforce limits, prevent fraud, and keep the service secure;
• respond to support requests, legal requests, and copyright reports;
• comply with tax, accounting, and other legal obligations;
• understand aggregate usage so we can keep the service working.

We do not sell your personal information, and we do not use it for cross-context behavioural advertising.

3. Legal bases (UK and EEA)

Where UK GDPR or EU GDPR applies, we rely on:

• Contract: to provide the account, profile, hosting, and paid features you request;
• Legitimate interests: to secure the service, prevent abuse, and improve reliability, balanced against your rights;
• Legal obligation: to keep billing and tax records and respond to lawful requests;
• Consent: where we ask for it, such as optional Google sign-in or Turnstile. You can withdraw consent at any time.

4. Cookies and local storage

We use a small number of essential cookies and local storage to keep you signed in, protect forms, and remember your view counter. Cloudflare may set security cookies. If you use Stripe Checkout or the Stripe billing portal, Stripe sets cookies on its own pages. If Turnstile or Google sign-in is enabled, those services may set cookies when you use them. We do not use advertising or analytics trackers.

Because we use only essential and security cookies, we do not show a cookie consent banner. You can block cookies in your browser, but sign-in and checkout may stop working.

5. Who we share with

• Cloudflare for hosting, D1 database, R2 storage, email delivery, and security;
• Stripe for payments, subscriptions, invoices, billing management, and merchant-of-record services for Managed Payments;
• Google if you choose Google sign-in;
• Cloudflare Turnstile if abuse protection is enabled;
• professional advisers, authorities, or courts where required by law or needed to protect rights and safety;
• a successor if the service is transferred, subject to this policy.

These providers process information under their own terms and data protection agreements. We do not authorise them to use your information for their own advertising.

6. International transfers

Cloudflare, Stripe, Google, and their infrastructure may process information in the United States and other countries. Where UK or EEA law requires it, we rely on adequacy regulations or standard contractual clauses and the providers' transfer safeguards.

7. How long we keep it

Account, profile, and uploaded content are kept while your account exists. When you delete your account, we remove the live account, profile, files, and related records, and cancel an active subscription. Billing records and invoices may be kept by Stripe and by us for as long as tax, accounting, fraud-prevention, or other legal obligations require. Backups and security logs may persist for a limited period before they rotate. View counts are stored per username and day and are deleted with the profile they belong to.

8. Security

We use encryption in transit, hashed passwords, access controls, and reputable infrastructure providers. No service is completely secure. Use a strong, unique password, keep your email secure, and do not upload sensitive information to a public profile.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing, receive a portable copy, or withdraw consent. UK and EEA residents can also complain to their local supervisory authority; in the UK that is the Information Commissioner's Office.

California residents may have the right to know what personal information we collect, request deletion or correction, and opt out of sale or sharing. We do not sell or share personal information for cross-context behavioural advertising. We will not discriminate against you for exercising a privacy right.

To make a request, use the account deletion control in settings or email support@ykwim.xyz. We may need to verify your identity. We will respond within the time required by applicable law.

10. Children

ykwim is not for children under 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has created an account, we will delete it. If you believe a child under 13 is using ykwim, contact us.

11. Public content

Your profile and uploaded image-host files are public by design. Profile view totals and your position on the public leaderboard are also visible. Search engines and other users may copy or index public content. Do not upload private or sensitive information. Deleting content removes it from the live service, but copies may remain in caches or on third-party sites.

12. Changes

We may update this policy. The date at the top shows the current version. If a change is material, we will give reasonable notice. If you continue using the service after the change, the updated policy applies.

13. Contact

Privacy questions or requests: support@ykwim.xyz.