Privacy

sect.lol stores only what it needs to run your page. This page describes exactly what that is.

What we store

• Account: your username, an optional email address, and your password as a salted scrypt hash — never the password itself.
• Your page: the settings you choose in the editor and the files you upload (avatar, banner, background, music, cover art, cursor).
• Sessions: a random login token in an httpOnly cookie. We keep only a hash of it, and it expires after 30 days.
• Views: a random visitor ID in a cookie, so repeat visits on the same day count once. It isn’t linked to anyone’s identity.
• Analytics for page owners: for each counted view we keep the time, the referring website’s domain (not the full address), a country code when our host provides one, and whether the device was a phone, tablet or computer. For clicks we keep the time and which link was clicked. We never store visitor IP addresses.
• Guestbook: comments you post, with your username and the time.
• Payments: if you buy Inner Disciple, Stripe processes the payment. We keep the Stripe session ID, amount and date — never your card details.

What’s public

Everything on your page is public by design: your name, bio, uploads, links, widgets, guestbook and view count. Don’t add anything you want to keep private.

Third parties

• Discord: our server asks Discord’s public invite API for a server’s name, icon and member counts.
• GitHub and Last.fm: our server fetches public profile stats.
• Spotify and YouTube: these widgets are the services’ own embedded players, loaded in your visitor’s browser (YouTube in privacy-enhanced mode).
• Stripe: handles checkout for Inner Disciple.

We don’t run ads or third-party analytics, and we don’t sell data.

Deleting your data

Delete your account any time from Settings. Your page, uploads, analytics, comments and sessions are removed immediately.