Privacy Policy

Starlight Solutions, Inc. operates dreaded.lol. This explains what we collect, why, and what you can do about it. We do not sell personal data and we do not run advertising or third-party tracking scripts on profile pages.

What we collect

Account data

• Username, display name, and email address.
• A password hash (scrypt). We never store your password itself.
• If you link Discord: your Discord user ID, username, avatar and verified email.
• Two-factor secrets and hashed backup codes, if you enable them.

Content you create

• Everything on your profile: bio, links, colours, widgets, audio and uploaded files.

Session data

• An opaque session token (stored hashed), the IP address and user agent that created it, and its last-seen time. This is what powers the "signed-in devices" list.

Analytics for page owners

When someone visits a profile, we record a timestamp, a coarse country and city from the CDN edge, the referring hostname, and a device/browser/OS bucket. To count unique visitors without identifying anyone, we store a salted, truncated SHA-256 hash of the visitor's IP and user agent. That hash is not reversible, is not linked to an account, and is only used to avoid double-counting the same visitor within 12 hours. Full IP addresses of visitors are not written to our database.

Payments

Stripe processes payments. We receive a payment identifier, the amount, and the status. We never see or store card numbers. Stripe's own privacy policy applies to what they collect.

Why we can process it

• Contract — to give you the account and page you signed up for.
• Legitimate interests — to keep the service secure, prevent abuse, and give page owners basic audience statistics.
• Legal obligation — to respond to lawful requests and keep payment records.

Who we share it with

We use a small number of processors, and only for the purpose listed:

• Vercel — hosting and CDN.
• Neon — the Postgres database.
• Stripe — payments.
• Discord — only if you choose to link your account.
• Object storage provider — for uploaded files, where configured.

If you add a Discord presence widget, your browser connects directly to a third-party presence relay. That relay sees the request; we do not proxy or store it.

Cookies

We set two cookies, both strictly necessary: d_session (an HttpOnly session token) and d_csrf (a token used to block cross-site request forgery). There are no advertising or analytics cookies, so there is no consent banner to click through.

How long we keep it

• Account and profile data: until you delete your account.
• Sessions: 30 days, or until revoked.
• Visit records: 400 days, then deleted.
• Security audit log: 12 months.
• Payment records: as long as tax and accounting law requires.

Your rights

You can access, correct, export or delete your data. Export and delete are both self-service on your account page. If you are in the EEA, UK, Switzerland, California or another region with equivalent rules, you also have the right to object to processing, to restrict it, and to complain to your data protection authority. We do not discriminate against you for exercising any of these rights.

For anything not covered by the self-service tools, email legal@dreaded.lol. We respond within 30 days.

Security

Passwords are hashed with scrypt. Sessions are opaque server-side tokens, stored hashed, and revocable per device. Every state-changing request is CSRF-protected and rate-limited. All database access is parameterised. Uploads are verified against their real file signature and served with a no-sniff policy; SVG uploads are refused because they can carry scripts. Pages are served with a strict Content Security Policy. No system is perfect — if you find a hole, please tell us.

Children

The service is not for anyone under 13. If we learn that an account belongs to a child under 13 we delete it.

International transfers

We are based in the United States and our processors may store data in the United States and the European Union. Where required, transfers rely on Standard Contractual Clauses.

Changes

If we change this policy in a way that materially affects you, we will give notice at least 14 days before it takes effect.

Contact

Starlight Solutions, Inc. — legal@dreaded.lol