§1. Information We Collect
When you create an account on flexbio.link, we collect the following personal information:
- Account data — email address, username, display name, and password (stored only as a one-way hash)
- Profile data — biography text, links, uploaded images and audio files, customization preferences, badge configurations, and profile templates
- Discord data — Discord user ID, username, avatar, and access token (when you connect via OAuth)
- Usage data — profile views, link clicks, visitor approximate location (country), and device type — all derived from the visitor's IP address at the time of the visit.
- Two-factor authentication data — if you enable 2FA, we store your encrypted TOTP secret and hashed backup codes
- Session records — for each login we store the IP address, browser user agent, approximate country and login method, so you can review and revoke your active sessions
- Moderation records — notes about actions taken on your account, reports you submit, and the codes we email you for two-factor authentication and account recovery
§2. How We Use Your Data
We use the information we collect for the following purposes:
- To provide, operate, and maintain the Service
- To display your public profile page to visitors
- To provide analytics and insights on your profile performance
- To authenticate your identity and secure your account
- To communicate important updates, security alerts, and service announcements
- To detect and prevent fraud, abuse, and violations of our Terms
- To display your Discord presence and activity on your profile
- To improve the Service based on aggregated, anonymized usage patterns
§3. Data Storage & Security
We take the security of your data seriously and employ the following measures:
- Passwords are stored only as a one-way hash — we never keep them in plain text and cannot read them
- All connections are encrypted with HTTPS/TLS
- Access to user data is strictly restricted to authorized personnel
- Session tokens are securely generated and stored as HTTP-only cookies
- We implement rate limiting to protect against brute-force attacks
- TOTP secrets for two-factor authentication are stored encrypted and never exposed in plaintext
- A custom CSRF token is issued per session and validated on every state-changing request
While we take reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
§4. Third-Party Services
flexbio.link integrates with the following third-party services:
- Discord — for OAuth login, presence display, and profile widget functionality. When you connect Discord, we receive and store your Discord user ID, username, and avatar. Discord's own privacy policy governs how they handle your data.
- Spotify — if you add a song to your profile, the embed is loaded from Spotify's servers. No personal data is sent to Spotify from our side.
- SoundCloud — if you add a SoundCloud track or playlist, the embed is loaded from SoundCloud's servers when a visitor opens your profile.
- Iconify — icons chosen for links, badges and tags are served from api.iconify.design. A visitor's browser requests them directly from that service when your profile loads.
- Cloudflare R2 — images and audio you upload are stored on and delivered from Cloudflare R2 (r2.flexbio.link).
- Profile widgets — widgets you enable — such as YouTube, GitHub, Roblox, Steam or Telegram — load content from those providers. A widget is only contacted if you add it to your profile.
We do not sell, rent, or trade your personal data to any third parties. We do not use third-party advertising or tracking services.
§5. Payments & Billing Data
When you buy something in the shop, the card payment itself is handled by Stripe. flexbio.link never receives, sees or stores your card number, expiry date or security code - those go straight to Stripe, which acts as an independent controller for that data under its own privacy policy. What we keep is the record of the order:
- Order records — what was bought, the amount and currency, the time, and whether the order is pending, paid, delivered or flagged for refund.
- Who is involved — the account that paid and, when the purchase is a gift, the account that receives it - so the item can be delivered and claimed.
- Stripe references — the identifiers Stripe returns for the checkout session and the payment, so a purchase can be matched to a payment if you contact support.
- Your account email — passed to Stripe so it can send you the payment receipt. We do not ask for or store a separate billing address.
Every movement of Flexbio Credits is also written to a ledger tied to your account, so a balance can always be reconciled. Order and ledger records are kept after an account is deleted, with the link to the account removed, because we need them for accounting, tax and fraud-prevention purposes. To find out what Stripe itself stores about you, see Stripe's privacy policy.
§6. Cookies
We use essential cookies required for the Service to function, including session management and authentication. We do not use advertising or tracking cookies. For detailed information about our cookie usage, please refer to our Cookie Policy.
§7. Data Retention
We keep your personal data for as long as your account exists. You can delete the account yourself at any time from your account settings: it takes effect immediately, your uploaded files are removed from storage and your profile data is deleted with the account. Backups taken beforehand may hold a copy for a limited period until they are rotated out, and we keep anything the law requires us to keep. Aggregated statistics that no longer identify anyone may be retained indefinitely.
§8. Your Rights
You have the following rights regarding your personal data:
- Access — download a copy of the personal data we hold about you, directly from your account settings
- Correction — update or correct inaccurate personal data
- Deletion — request deletion of your account and associated data
- Export — export your data as a portable JSON file, at any time and without asking us
- Objection — opt out of analytics data collection
- Restriction — request that we limit how we process your data
To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.
§9. Children's Privacy
flexbio.link is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete their account and information.
§10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.
§11. Contact
If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at [email protected].