Privacy Policy
Last updated: 08/19/2026
This Privacy Policy explains what information we collect, who processes it on our behalf, how we use it, and what rights you have as a user of thugg.lol.
1. Information we collect
- Account data: email address, password hash, username/display name, and internal user identifier.
- Profile data: avatar, background images, bio/description, links, selected themes, design settings, and third-party integrations.
- Technical data: IP address, user agent, request timestamps, approximate country/region, referrers, and device/browser information.
- Usage analytics: profile views, link clicks, and aggregated feature usage statistics.
- Payment information: transaction identifiers, payment status, plan type, and Premium activation/renewal events (we do not store full card details).
- Consent records: which version of these policies you accepted, when, and from which IP address and browser.
- Uploads: files you upload through the image host or the profile editor, plus their file names, sizes, and content hashes.
2. How we use information
- to create and maintain your account and profile;
- to authenticate users and protect access security;
- to display your profile and links to visitors;
- to prevent abuse, spam, malware, and attacks on our infrastructure;
- to improve the Service and develop new features;
- to handle support requests and communicate with you;
- to comply with legal obligations and lawful government requests.
3. Who processes your data
We run thugg.lol on third-party infrastructure. The providers below process data on our behalf, under their own terms, and only for the purposes listed here.
| Provider | What it does for us | What it receives |
|---|---|---|
| Supabase | Managed PostgreSQL, authentication, and transactional email (confirmation, password reset, security notices) | Account records, email address, profile and usage rows |
| Cloudflare | DNS, CDN, WAF, bot protection (Turnstile), object storage (R2), and privacy-friendly page analytics | Request metadata, IP address, uploaded media and avatars |
| Trybit | Payment processing for Premium and other paid features | Order id, amount, currency, status, payment method |
| Discord | Optional account linking, presence display, and community bots | Discord user id, handle, and the presence you choose to show |
These providers operate globally, so your data may be processed outside your country, including in the United States and the European Union. Passwords are stored only as cryptographic hashes — never in plain text.
4. Cookies and similar technologies
| Cookie | Purpose | Category |
|---|---|---|
| Supabase session cookies | Keeps you signed in and refreshes your session | Essential |
| thugg_csrf | Protects forms and API requests against cross-site request forgery | Essential |
| th_sess, th_sess_live, th_mfa, th_device | Session lifetime, two-factor state, and recognising a trusted device | Essential |
| th_consent | Remembers your cookie choice so we stop asking | Essential |
| th_ref, th_uname_hint | Carries a referral code or a suggested username through sign-up | Functional |
| Cloudflare Web Analytics | Aggregated page traffic — loaded only after you accept analytics | Analytics |
Essential and functional cookies are set because the Service cannot work without them. Analytics is off until you accept it in the cookie banner — you can at any time. Our analytics provider does not use cross-site identifiers or build advertising profiles.
We also store a few values in your browser’s local storage (for example, which banners you have dismissed). These never leave your device and are cleared with your browser data. We do not store your password or payment details in cookies.
5. Uploads
Files uploaded through the image host are stored in Cloudflare R2 and are served from our CDN domains. Anything you upload and share by link is public to whoever holds that link.
The image host takes images, video and audio only. Every upload is checked against the real leading bytes of the file, so anything that claims to be a picture and is not gets rejected before it is stored, and nothing we serve is handed to a visitor as a download. Photos in JPEG keep no EXIF: location and camera metadata are stripped server-side before the file is published.
6. Sharing with third parties
We do not sell your personal data and we do not share it for advertising.
Beyond the processors listed in section 3, we share data only:
- to comply with laws or lawful requests from authorities;
- to investigate abuse, fraud, attacks, or violations of our Terms;
- where you deliberately publish it yourself on your public profile;
- as part of a merger or acquisition, in which case we will say so in advance.
7. Data retention
Core account and profile data is retained while your account exists or as needed for the purposes described in this Policy.
Certain technical logs, security data, and records of operations (including payments) may be retained for a limited period (e.g., 30–180 days, or as required by law) to analyze incidents and meet legal obligations.
When you delete your account, profile data, uploads, and linked records are removed. We keep a one-way record of the deleted email address so the same address cannot be used to re-register, and payment records for as long as tax and accounting law requires.
8. Payments and Premium
When purchasing Premium or other paid features, we process a limited set of payment- related data: transaction ID, status, amount, currency, payment method, and plan details.
Full card details are handled by the payment provider and are not shared with us in plain form. We only receive the information necessary to confirm payment and manage Premium status.
9. Children
The Service is not intended for anyone under 16. We do not knowingly collect data from children below that age. If you believe a child has given us personal data, write to [email protected] and we will delete the account and its data.
10. Your rights and how to use them
Depending on applicable law, you may:
- update your profile information through your account settings;
- delete your account and its data from Settings → Account → Danger zone, at any time;
- request a copy of the data we hold about you and how it is processed;
- object to certain processing activities where permitted by law;
- withdraw consent where processing is based on consent (some features may stop working);
- complain to your local data protection authority.
To exercise a right that has no button in the interface, email [email protected] from the address on your account with “data request” in the subject. We answer within 30 days and may ask you to confirm your identity first.
11. Changes to this Policy
We may update this Privacy Policy from time to time. The current version will always be available on this page.
If changes are material, we may notify you via the account interface, email, or other reasonable methods. By continuing to use the Service after changes take effect, you agree to the updated Policy.
12. Contact
For questions about personal data processing, Premium, payments, or exercising your rights, contact us:
- Email and data requests: [email protected]
- Community and support chat: our Discord server