01Who is responsible

The controller of your data is [Company name], [Registered address]. Contact: [email protected].

02Data we collect

• Your account: email address, profile name, display name, password (kept only as a hash), the dates you accepted the terms and chose about news, your role and badges.
• Your profile: everything you put on it (texts, links, widgets and the account names they show, music, images and other files you upload, styling).
• Discord, if you link it: your Discord ID and username, to sign in and for the Discord card on your profile.
• Security: for each signed-in device, its IP address and browser (you see them on your account page), the date you were last active, and counters of recent requests per IP address to stop abuse.
• Activity on profiles: when you view another profile while signed in, that you did, once, with your device type and country (not your IP address), so its owner sees how many people visited. The likes you give.
• Support and invitations: your tickets, messages and attachments, and the code you signed up with.

We don't sell any data, show ads, or use tracking or analytics tools.

03Why we use it

• To provide the service you signed up for (contract): your account, your public page, sign-in, support.
• To protect the service and your account, and to show profile owners their visits (legitimate interest): sessions, IP addresses, request limits, moderation, the staff's activity log.
• To send you news, only if you said yes (consent). You can change your mind at any time on your account page. Account emails, like verification or a password reset, are always sent.

04Who receives it

Your profile is public: anyone can see what you put on it.

Our providers, who only process data on our instructions:

• FreshPerf: servers and database, in the European Union;
• Cloudflare: network, protection against attacks, file storage;
• Resend: sending account emails;
• Discord: only if you link your account.

Cloudflare and Resend are American companies: transfers rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

When someone views a profile, some widgets and players (Spotify, SoundCloud, Apple Music, YouTube) and some images are loaded from those services. They then receive the visitor's IP address and may set their own cookies, under their own privacy policies.

05How long we keep it

• Account and profile: until you delete your account. Its files are deleted with it.
• Sessions: until they expire (7 days without use) or you sign out.
• Email links: 1 to 24 hours. Request counters: one day at most.
• Notifications: 90 days once read, 180 days otherwise.
• Profile views and likes: as long as both accounts exist.
• Database backups: 30 days.
• The staff's activity log (who did what to an account): kept to protect the service and its users, even after an account is deleted.

06Cookies

need.gf only uses cookies the site needs to work, so it asks for no consent:

• your session: needgf.session_token and its cached data;
• your theme, accent color and language: needgf_theme, needgf_accent, needgf_locale;
• the dashboard's sidebar (sidebar_state) and the banners you closed (needgf_dismissed_banners);
• on the other profile domains, who is viewing, for one day: needgf_viewer, needgf_bridged.

The live preview also keeps its window settings in your browser (local storage).

07Your rights

• See and change most of your data in your dashboard.
• Download all of it from your account page (Download my data).
• Delete your account and everything on it, from the same page.

You can also ask to access, correct, erase or restrict your data, object to its use, or withdraw your consent: write to [email protected] from your account's address. We answer within a month.

If you think your rights aren't respected, you can complain to the CNIL (www.cnil.fr).

08Security

Connections are encrypted, passwords are hashed, files are checked before they are kept, the servers are only reachable through Cloudflare, and two-factor authentication is available on your account page.

09Children

need.gf is not for children: you must be at least 15 years old to create an account. If you think a younger child has one, tell us at [email protected].

10Changes to this policy

If this policy changes in an important way, you are told before it applies. The date at the top is its last update.