Privacy Policy

We collect what we need to run your account and profile, nothing more. We don't sell personal data and we don't use advertising trackers. Profile analytics are cookieless and never store visitor IP addresses.

Account data: email address, username, password (stored only as an Argon2id hash), and optional two-factor secrets (encrypted at rest).

Profile content you choose to publish: display name, bio, links, images, music, widgets and settings. Everything you publish on a public profile is visible to anyone with the link.

Support messages, reports and purchase details (handled by our payment processors — we never see or store full card numbers).

If you sign in with Google or Discord we receive your account ID, email address and whether it's verified, and your display name and avatar. With Discord, your user ID can power the Discord presence widget. You can disconnect providers in Settings.

When someone views your profile we record: the time, an anonymous visitor hash (a salted SHA-256 of IP address, browser and date that rotates every day and cannot be reversed), country (from your hosting provider's request headers), device type, browser, operating system and referring website.

We honor Do Not Track and Global Privacy Control: those visits are counted without any per-visitor details. We don't set analytics cookies. Profile owners can disable analytics entirely.

We use strictly necessary cookies only: your session cookie, short-lived security cookies during sign-in and two-factor setup, a cookie that remembers unlocked password-protected pastes, and your theme preference. No advertising or cross-site tracking cookies.

To provide and secure the Service, prevent abuse and fraud, process payments, respond to support requests, send transactional emails (verification, security alerts, receipts) and comply with law. We don't send marketing email without your consent.

Service providers that process data on our behalf: hosting and database, object storage/CDN, email delivery, payment processors (Stripe, Razorpay) and, if enabled, malware scanning. We disclose data when required by law or to protect users' safety.

Account data is kept while your account is active. When you delete your account we erase your profile, uploads, pastes, links and personal data; purchase records are retained in anonymized form as required for accounting. Analytics events are retained per your plan's history window. Audit logs of security-sensitive actions are kept for security purposes.

Depending on where you live (e.g. GDPR, UK GDPR, CCPA, India's DPDP Act) you can access, correct, export or delete your data and object to certain processing. Most of this is self-service in Settings; for anything else, contact us.

Passwords are hashed with Argon2id, sessions use secure HTTP-only cookies, uploads use signed URLs and content-based type verification, and sensitive admin actions are written to an immutable audit log. No system is perfect — please report vulnerabilities through the Contact page.

The Service isn't directed to children under 13 (or the age of digital consent in your country), and we don't knowingly collect their data.

We'll post updates here and notify you of material changes. Operators deploying Yapped should review this policy with counsel and update it for their jurisdiction and data processors.