This policy explains what personal data the operators of unholy.bio (“we”, “us”) collect when you use unholy.bio, why we collect it, who can see it, and what control you have. We aim to collect only what we need to run the service and keep it safe.
1. What we collect
| Data | Details |
|---|---|
| Account data | Email address and, for email sign-ups, a salted password hash (we never see your password). Sign-in timestamps and method. |
| Discord data | If you sign in with or connect Discord: your Discord ID, username, display name, avatar, public profile flags (“badges”), Nitro status and email address (with its verified flag). We request the identify and email scopes only. |
| Profile content | Username, display name, bio, links, avatar link, appearance settings and anything else you enter. |
| Uploads | Background images/videos, profile audio and (premium) hosted images, plus file names, types and sizes. |
| Templates | Appearance settings and background you choose to publish as a template. |
| Onboarding answer | Where you heard about us (and an optional short note). |
| View counters | Each IP address can add one view per profile. We store a keyed hash of the address for as long as the profile exists to prevent duplicate views. Profile owners see the aggregate total, including in account downloads. |
| Security & activity logs | IP address, user-agent, referrer, pages visited (path only, without query strings), timestamp, and your account ID if you are signed in. We also log security-relevant actions such as logins, Discord sync, uploads, deletions, template actions, data exports and moderator actions. |
| Moderation records | Bans, suspensions, reasons, and who applied them. |
| Premium status | Whether premium is active, until when, your storage quota and image-host status. |
2. Why we use it
- To provide the service (account, profile pages, uploads, templates, leaderboard, premium features) — performance of our contract with you.
- To prevent abuse and keep the service secure — spam, ban evasion, fraud, harassment, illegal content and attacks. This is why we keep IP and activity logs. Our legitimate interest is protecting users and the service.
- To comply with the law and respond to valid legal requests and copyright notices.
- To understand growth (the onboarding answer, aggregate view totals).
We do not sell your personal data and we do not show advertising.
3. Access logs and retention
Activity logs (including IP addresses) are visible only to our administrators and are used solely for abuse prevention, security investigations and legal compliance. We automatically delete log entries after 30 days. If you delete your account, your logs are detached from your account immediately and then purged on the same schedule.
4. What is public
Your profile page and everything on it is public: display name, username, bio, links, avatar, background, music, appearance, template contents, and — if you leave them switched on — your view counter, leaderboard position, and your Discord username, avatar and badges. Images in the image host are accessible to anyone who has the link. Your email address, IP address, logs and onboarding answer are never public.
5. Who we share data with
- Supabase — database, authentication and file storage.
- Discord — only if you choose to sign in with it; Discord receives the OAuth request and its own privacy policy applies to your Discord account.
- Our hosting and network providers — they process traffic on our behalf.
- Google Fonts — pages load fonts from Google, which receives your IP address and browser string.
- Authorities and rights holders — when legally required or to protect rights and safety.
6. Cookies and local storage
We use browser storage only for essentials: your sign-in session and your dashboard theme preference. We do not use advertising or cross-site tracking cookies.
7. Your rights and choices
- Access / portability: download your account data from Account settings → Request my data. For additional access requests, contact us through our Discord server.
- Deletion: delete your account and data from the same page. Uploaded files, templates and hosted images are removed.
- Correction: edit your profile any time in the dashboard.
- Objection / other requests: if you are in the EEA, UK or California (or elsewhere with similar laws) you may also object to processing, restrict it, or lodge a complaint with your local authority. Contact us via a ticket in our Discord server.
We may retain limited data where needed to prevent ban evasion, resolve disputes or comply with law (for example, a ban record), and deleted data may persist in encrypted backups for a limited period.
8. Children
unholy.bio is not for children under 13 (or the minimum age in your country, if higher). If we learn that we hold data from someone under that age we will delete it.
9. Security and transfers
Data is transmitted over HTTPS and protected by access controls; administrative access is restricted and logged. No system is perfectly secure. Our providers may process data in countries other than yours; where required we rely on appropriate safeguards.
10. Changes and contact
We will update this page when our practices change and revise the date above. For privacy questions or requests, open a ticket in our Discord server.