Privacy Policy

1. The short version

• We collect an email address so you can sign in, and whatever you choose to put on your public profile.
• We count profile views without ever storing a visitor’s IP address - only a salted, irreversible hash of it, deleted within about 48 hours.
• Profile media must be hosted by us, so loading a profile doesn’t hand your IP address to some third-party server the profile owner chose.
• We don’t sell personal data and we don’t run ads.

2. What we collect and why

Your email address. Used to sign you in via a magic link and to send you service messages (such as a code confirming an email change). We need it to provide the account you asked for.

Your profile content. Username, display name, bio, links, badges, widget settings, and any images, audio, or other media you upload. This is published on your public profile by design, and search engines may index it.

Your Discord account, if you connect one. We store your Discord user ID and when you linked it. Your Discord username, avatar, and presence are fetched live from Discord when your widget is shown, rather than kept by us. If you invite people to our community server we keep a count of those invites so badges can be awarded.

Profile view counts. When someone loads a profile we increment its public view total. To avoid counting the same visitor repeatedly we derive a salted SHA-256 hash of their IP address; the raw IP is never written to our database, the hash can’t be reversed back into an address, and the row holding it is deleted automatically once it’s about 48 hours old. Our legitimate interest is giving profile owners an accurate view count.

Analytics. We use PostHog for product analytics (which features get used, where signups drop off) and Vercel Analytics and Speed Insights for traffic and performance measurement. PostHog stores an identifier in your browser; once you’re signed in, events are associated with your account and email so we can support you and understand real usage.

Technical logs. Our hosting and backend providers keep standard request logs, which include IP addresses, for security, abuse prevention, and debugging.

3. What we never do

• Sell or rent your personal data.
• Serve advertising or embed advertising trackers.
• Allow profiles to load media from arbitrary third-party servers - uploads are served from our own storage precisely so visiting a profile doesn’t leak your IP address and browser details to whoever the profile owner points at.

4. Who processes data for us

We use a small number of providers, each acting on our instructions:

• Convex - database and backend, where accounts, profiles, and links are stored.
• Vercel - website hosting, plus traffic and performance analytics.
• Cloudflare R2 - storage for the files you upload.
• Resend - delivery of sign-in links and account emails.
• PostHog - product analytics.
• Discord - only if you choose to connect your account, and governed by Discord’s own privacy policy.

Some of these providers operate outside the European Economic Area. In that case transfers rely on the appropriate safeguards, such as the European Commission’s standard contractual clauses.

5. How long we keep it

• Account and profile data: for as long as your account exists, and deleted when you ask us to delete it.
• Hashed view-dedupe records: automatically pruned once they’re older than roughly 48 hours.
• Email verification codes: minutes - they expire and are then discarded.
• Aggregate view totals and analytics: retained in aggregate; these don’t identify individual visitors.

6. Your rights

If you’re in the EU, EEA, or UK, the GDPR gives you the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to certain processing, and to receive a copy in a portable format. You can also withdraw consent where processing relies on it, without affecting what happened before.

Email support@e.rich and we’ll respond within one month. If you think we’ve handled your data badly, you can complain to your local data protection supervisory authority.

7. Cookies and local storage

We use browser storage for two things: keeping you signed in (strictly necessary - without it the site can’t work) and an analytics identifier as described above. We don’t use advertising or cross-site tracking cookies. You can clear this storage in your browser at any time; clearing it signs you out.

8. Children

E.RICH isn’t for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, tell us and we’ll remove it.

9. Security

Sign-in is by emailed magic link, so there’s no password of yours for us to lose. Data is encrypted in transit, access to production systems is limited, and we rate-limit sensitive actions. No service can promise perfect security, but if a breach affects your data we’ll notify you and the relevant authority as the law requires.

10. Changes and contact

We’ll update this policy as the service changes; the date at the top always reflects the current version. Questions or requests: support@e.rich. The rules for using the service are in our Terms of Service.