This Privacy Policy explains what personal data isafemboy.gay processes, why, on what legal basis, how long we keep it, and what rights you have. We run this service without advertising, without analytics products and without data brokers, and we have written this policy to describe what actually happens rather than to reserve rights we do not use.
1. Introduction
isafemboy.gay ("we", "us", or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not access or use the Service.
Where the General Data Protection Regulation (EU) 2016/679 applies, consent is only one of several legal bases we rely on. The legal basis for each purpose is set out in the section on legal bases below.
2. Controller and Contact
The controller responsible for the processing described in this policy is the operator of isafemboy.gay. You can reach us through our official Discord server or via the contact details published on our contact page.
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Data protection enquiries are handled through the contact channels above.
3. Information We Collect
Information You Provide
We collect information that you voluntarily provide to us when you:
- Register for an account using Discord OAuth authentication
- Create or edit your bio page and profile information
- Use invitation codes or generate new codes for others
- Contact us through our support channels
- Participate in community activities or feedback surveys
The types of information we collect may include:
- Discord username, user ID, avatar, and email address (via Discord OAuth)
- Bio page content, including text, links, images, and customization preferences
- Subdomain choice and page metadata
- Communication data when you interact with us
- Account settings such as your chosen theme, language and display preferences
- Invitation records: which code you redeemed, and which codes you issued and to whom they were redeemed
Automatically Collected Information
When you access the Service, we automatically collect certain information about your device and usage, including:
- IP address and general location data
- Browser type, version, and language preferences
- Device identifiers and operating system information
- Access times and dates
- Referral sources
Concretely, we keep two kinds of record. Server access logs are generated by our infrastructure for every request and contain the IP address, the time, the requested resource and the user agent. Security and audit logs record account-relevant events such as sign-in, invite redemption, configuration changes and moderation actions, together with the IP address and user agent that performed them.
We do not run analytics or advertising. There is no third-party analytics product, no advertising network, no pixel tracker, no fingerprinting and no cross-site tracking on any page of this Service, including member pages. We do not build behavioural profiles and we do not measure clickstreams.
4. How We Use Your Information
We use the information we collect for the following purposes:
To provide and maintain the Service: Including account creation, authentication, and enabling you to create and manage your bio pages
To improve and optimize the Service: By diagnosing technical issues and developing new features
To ensure security and prevent abuse: By monitoring for fraudulent activity, enforcing our Terms of Service, and protecting against unauthorized access
To communicate with you: Including sending important notices, updates, security alerts, and responding to your inquiries
To manage the invitation system: By tracking invitation codes, redemptions, and member referrals
To moderate content and enforce community guidelines: By reviewing reported content and user behavior
To comply with legal obligations: Including responding to legal requests and preventing illegal activity
We do not use your personal data to train machine learning models, and we do not sell it, rent it or make it available to data brokers.
5. Legal Bases for Processing
Where the GDPR applies, we rely on the following legal bases:
Performance of a contract (Art. 6(1)(b) GDPR): Creating and maintaining your account, authenticating you, hosting and publishing your member page, operating the invitation system, and providing support.
Legitimate interests (Art. 6(1)(f) GDPR): Keeping the Service secure and available, preventing and investigating abuse, fraud and attacks, moderating content, maintaining audit records, and defending legal claims. Our legitimate interest is the safe and lawful operation of a community platform; we balance it against your interests and keep the data involved to a minimum.
Compliance with a legal obligation (Art. 6(1)(c) GDPR): Responding to lawful requests from authorities and retaining data where the law requires it.
Consent (Art. 6(1)(a) GDPR): Where we ask for it explicitly, for example for optional communications. You may withdraw consent at any time with effect for the future.
Vital interests (Art. 6(1)(d) GDPR): In rare cases, to protect the life or physical safety of a person, for example when responding to a credible threat.
Special categories of data
This Service is used by LGBTQ+ people, and information you publish on your own page may reveal data about your sexual orientation, gender identity or beliefs. We do not require, request or infer such information. Where you choose to publish it, you make it public yourself, and that processing rests on Art. 9(2)(e) GDPR, which covers personal data manifestly made public by the data subject. Please consider carefully what you publish; see the section on public content below.
7. Content You Publish Is Public
Your member page is published on the open internet at your subdomain. Anyone can view it without an account. Search engines may index it, third parties may archive or mirror it, and other people may copy, screenshot or republish it in ways we cannot control or undo.
Deleting content removes it from our Service, but it cannot remove copies already made by others, search engine caches or web archives. We have no ability to retrieve or delete such copies and we are not responsible for them.
Think before you publish. Do not publish information you would not want permanently public, including your legal name, address, workplace, school, phone number, or anything that could identify you offline against your wishes. This matters particularly if you are not out, or if you are at risk in your environment.
8. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.
When you delete your account, we will delete or anonymize your personal information within a reasonable timeframe. However, some information may be retained in our backups for a limited period or as required by law. Public content you created may remain visible until actively removed.
We periodically review and purge inactive accounts and associated data in accordance with our data retention policies.
Guideline periods
- Account data and page content: for as long as the account exists, then removed on deletion
- Server access logs: a short operational period, ordinarily no longer than a few weeks, then deleted
- Security and audit logs: retained longer where needed to investigate abuse or defend a claim, then deleted
- Backups: overwritten in the ordinary rotation cycle after account deletion
- Records connected to a moderation decision, a ban, or a legal claim: retained until the matter and any limitation period is resolved
Where we must keep a minimal record to enforce a ban or prevent a terminated member from re-registering, we keep only what is strictly necessary for that purpose.
9. Data Security
We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit using HTTPS/TLS
- Encryption of sensitive data at rest
- Regular security assessments and vulnerability testing
- Access controls and authentication mechanisms
- Delegated authentication, so that we never receive or store your Discord password
- Separation of member data so that one member cannot reach another member's data
- Employee training on data privacy and security
- Monitoring and logging of system access
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and notifying us immediately of any unauthorized access.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and inform affected members where the law requires it.
11. Third-Party Services
The Service uses Discord OAuth for authentication. When you authenticate through Discord, you are subject to Discord's privacy policy and terms of service. We receive limited information from Discord as permitted by your Discord privacy settings and OAuth authorization.
If you include links to third-party websites or services on your bio page, those third parties have their own privacy policies. We are not responsible for the privacy practices of third-party websites or services.
Where a member page embeds or links to external media, your browser may contact those providers directly and they may receive your IP address and set their own cookies. That contact happens between your browser and the provider, and is governed by the provider's own policy.
12. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your jurisdiction.
When we transfer your information internationally, we ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable law.
Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission where one exists, or otherwise on the European Commission's Standard Contractual Clauses together with any additional measures required. You may request information about the safeguards used.
13. Your Privacy Rights
Depending on your location, you may have certain rights regarding your personal information:
Access: You can request a copy of the personal information we hold about you
Correction: You can request that we correct inaccurate or incomplete information
Deletion: You can request that we delete your personal information
Portability: You can request a copy of your data in a structured, machine-readable format
Objection: You can object to certain processing of your personal information
Restriction: You can request that we restrict the processing of your information
Withdrawal of consent: Where processing is based on consent, you can withdraw it at any time with effect for the future, without affecting the lawfulness of processing before withdrawal
To exercise these rights, please contact us using the information provided in the contact section. We will respond to your request within a reasonable timeframe and as required by applicable law, ordinarily within one month.
Right to object (Art. 21 GDPR). You have the right to object at any time, on grounds relating to your particular situation, to processing that we base on our legitimate interests. If you object, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Complaints
If you are in the European Economic Area, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. We would appreciate the chance to address your concerns first.
Automated decision-making
We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR. Automated rules such as rate limiting and spam filtering may temporarily restrict a request, and a human reviews any account suspension or termination on request.
14. Children's Privacy
Our Service requires Discord authentication, which has a minimum age requirement of 13 years (or higher in some jurisdictions). We do not knowingly collect personal information from children under the minimum age.
If we become aware that we have collected personal information from a child under the minimum age without parental consent, we will take steps to delete that information promptly. If you believe we have collected information from a child under the minimum age, please contact us immediately.
In the European Economic Area, where processing is based on consent, that consent is only valid from the age of 16 unless the law of your country sets a lower age, and otherwise requires the authorisation of the holder of parental responsibility.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this policy.
For material changes, we will provide prominent notice through the Service or by email. Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.
We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your information.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through:
- Our official Discord server
- The contact form at /contact
We will respond to your inquiry as promptly as possible and work to address your concerns.
By using isafemboy.gay, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.