Privacy Policy

What we collect

Account: Discord user id, Discord username, avatar URL, and email if Discord sends it, plus your suckmy.site username, display name, and account flags (for example role or ban state).

Profile: bio, location, links, widgets, uploaded media, theme, layout, and other settings you save. This is public if you publish a page.

Sessions: a login session cookie, and we may store IP address and user-agent on the session record.

Analytics (public profile visits, not the owner's own visits): country code from a local IP-to-country lookup (DB-IP Lite; we store the ISO country code, not the IP). CDN geo headers are used only when the visitor IP is not a public address. Device class from User-Agent (desktop, mobile, tablet, or bot), and referrer hostname. These are stored as counts per profile, not as a named visit history. We also set a short-lived httpOnly cookie so the same browser is not counted again for about 12 hours.

Security: IP address is used for rate limits (in server memory). Reports store IP, optional reason text, and reporter id if you were signed in.

Plans and moderation: invite-code redemptions, plan grants, Stripe customer and checkout ids, bans, and admin notes.

Why (legal bases)

Contract: creating and running your account and public page.

Legitimate interests: keeping the service up, stopping abuse, counting views, and moderating reports. You can object to processing based on legitimate interests; we will stop if we have no overriding grounds.

Legal obligation: storing or handing over data when the law requires it.

Consent: only where a third-party widget needs it (for example embedding Discord, Twitch, Spotify, or SoundCloud). Visitors who load those embeds are also subject to those providers' policies.

Cookies

Authentication cookies from our login library (needed to stay signed in).

sms_lang: remembers German or English (up to one year).

sm_pv_*: view-dedup cookies, httpOnly, about 12 hours, one per profile you visited.

The public profile also uses sessionStorage (key sm_pv_ plus the profile id) so the same browser tab does not send another view ping. These cookies and storage entries run the site; they are not used to sell ads. Blocking them may break login or recount views.

Who else sees data

Processors that host the app, the PostgreSQL database, and S3-compatible object storage (media may be served from a public storage URL).

Discord, for login and for the optional presence widget if you connect it.

Twitch, if a live-widget check runs against a channel you configured.

Stripe, to take payments, store a customer record, and run Checkout and the billing portal. Stripe processes payment details on its own pages. We store Stripe customer, checkout, and subscription ids, not full card numbers.

We do not sell personal data.

How long we keep it

Account and profile data: while the account exists, then residual backups for a limited time.

Session records: until the session expires or you sign out.

View and click counts: while we still show analytics for that profile.

Reports and ban records: as long as needed for safety and legal claims.

In-memory rate-limit data: minutes, then discarded.

Transfers

Discord and some other providers may process data in the United States or other countries. Where a transfer needs a safeguard, we rely on the provider's published mechanism (for example Standard Contractual Clauses or an adequacy decision). Storage location for our own database and files depends on the host we use.

Your rights

If GDPR or a similar law applies, you can ask to access, correct, delete, or restrict your data, to object, and to receive a copy (portability) where that right exists. You can complain to a supervisory authority (in Germany, your state data-protection commissioner or the BfDI).

You can edit or remove profile fields and media in the dashboard. Full account deletion is handled on request through the Imprint contact, because there is no in-app delete-account control yet.

We cannot fully erase public copies that other people already saved, or data we must keep for law or security.