Privacy Policy

Last updated: October 6, 2026

This policy explains what information drifted.lol collects, why, and what you can do about it. We try to collect as little as possible.

1. Information we collect

Information you give us

Account details: your username and a password (stored only as a secure hash, never in plain text). If you choose to add an email address, we store it with your account (we don't send emails for now; to recover an account you log in with Discord if you connected it). Each account also gets a UID, a number assigned in order of sign-up. Your username and UID are public.
Page content: everything you add to your page, such as your display name, bio, links, socials, colors, and settings. Your page is public by design.
Pictures you upload: a profile picture, banner, background or cursor image, and the pictures you drop onto a Freeform page (including gallery pictures), are stored on our servers and shown on your page. Pictures, videos and music you add as links stay on the site that hosts them.
Discord connection (optional): if you connect Discord, we receive your Discord user ID, username, display name and avatar. We don't receive your email, and we don't keep any Discord access token. Once connected you can also use it to log in. If you choose to show your Discord on your page, our bot looks up your public Discord profile (badges, banner, avatar decoration and server tag) and shows only what you switched on.
Invites: if you join through a friend's invite link, we remember who invited you, so they can earn badges. Your browser also keeps the invite name until you sign up.
Reports: if you report a page, we keep the page, the reason and any details you write. We don't keep your name, and your network address is only used for a short time to stop report spam.
Discord activity (optional, off by default): if you turn on "Show my Discord activity", our bot, which sits in the drifted Discord server, reads your Discord presence (your status, and the song, game or custom status you're showing) and displays it on your public page. We only store it for people who turned it on. Turning it off, or disconnecting Discord, deletes what we stored.
Messages: anything you send us when you contact us.

Information collected automatically

Page views and clicks: simple counts, per day, of visits to each page and of clicks on each link, plus the visitor's country, the kind of device (phone, computer or tablet) and the website they came from, which we show to the owner of the page. These are only totals. We don't store who visited or build profiles of visitors.
Password safety check: when you create an account or change your password, we check it against a public list of leaked passwords (Have I Been Pwned). Only the first five characters of a one-way fingerprint of the password are sent, never the password itself.
Public rankings: the leaderboard shows the display name, picture, UID and the number of views or invites of pages that haven't opted out. You can opt out in your editor, under Extras.
Technical data: your IP address, browser type, and request details, which our hosting provider processes to deliver the site, prevent abuse, and keep it secure.

2. How we use it

To run the service: create accounts, show your page, and save your settings.
To keep drifted.lol safe: stop spam, fraud, and abuse.
To reach you about your account or answer your messages.
To understand, in aggregate, how the site is used so we can improve it.

We don't sell your personal information, and we don't show ads.

3. Who we share it with

Hosting and infrastructure: drifted.lol runs on Cloudflare, which processes the data needed to deliver the site, and stores our database and files.
Email: our contact mailbox is provided by an email hosting provider.
Discord: only if you choose to connect your account or turn on your activity. If you turn on your activity, it is shown publicly on your page, including songs and games.
Page cards: if a page owner adds a weather, GitHub, Roblox or Minecraft card, our servers ask Open-Meteo, GitHub, Roblox or Mojang for the public info of the city or username the owner typed. Nothing about visitors is sent.
Icons: if a page owner adds an icon, our servers download it from Iconify's public service and keep a copy, so visitors' browsers never contact Iconify. Nothing about visitors is sent.
Legal reasons: if the law requires it, or to protect the rights and safety of our users and the service.

Media from other sites. A page can show pictures, videos and music from links its owner added, players from YouTube, Spotify, SoundCloud, Vimeo, TikTok, Twitch, Apple Music, Deezer, Instagram or Google Maps, fonts from Google Fonts, and small cards for the weather, GitHub, Roblox or Minecraft. An owner can also add a box with their own HTML and CSS: it runs in an isolated frame without scripts, so it cannot read the rest of the page or any data about you, but it can load pictures or fonts from other sites. The cards are looked up by our servers, but the pictures in them (for example a GitHub or Roblox avatar) are loaded by your browser. When you open that page, your browser asks those sites for the files, so they can see your IP address, just as if you had opened them yourself.

Your public page and its content are visible to anyone who has the link. By default we ask search engines not to list pages, unless the owner turns on "Let Google list my page", and we can't guarantee they obey. Don't put anything on your page that you want to keep private.

4. Cookies

We use only what's needed to keep you logged in (a session cookie) and to remember basic preferences, such as who invited you or whether you already copied your link, which your browser keeps in its own storage. We don't use advertising or cross-site tracking cookies.

5. How long we keep it

We keep your account and page for as long as your account exists. If you delete your account, we delete your page, pictures, stats, badges and personal data right away, except what we must keep for security or legal reasons, and backups that are removed on their normal schedule.

6. Your choices and rights

You can edit your page at any time. From your dashboard (Security and your data) you can download everything we have about you as a file, change your password, log out other devices and delete your account yourself. You can also ask us to access, correct, export, or delete your personal data, or to disconnect Discord, by writing to contact@drifted.lol. Depending on where you live (for example, in the EU, UK, or California), you may have additional rights under local privacy laws, and we'll honor them.

7. Security

We protect your data with reasonable measures: encrypted connections (HTTPS), hashed passwords, and access limits. No system is perfectly secure, so please use a strong, unique password.

8. Children

drifted.lol is not meant for children under 13, and we don't knowingly collect their data. If you think a child has given us personal information, contact us and we'll delete it.

9. International transfers

Our providers operate around the world, so your information may be processed in countries other than your own.

10. Changes to this policy

We may update this policy. When we do, we'll change the date at the top, and for important changes we'll tell you on the site when possible.

11. Contact

Questions about privacy? Write to contact@drifted.lol.