This privacy policy explains what information we collect and how we use it, on evilkitty.me and on its docs, status and image host addresses.
Data Controller
Evilkitty is operated by Lyniti Oy (Business ID 3658087-9), Lähdeniityntie 7b B, 00730 Helsinki, Finland. See the Lyniti imprint. For privacy-related matters, contact [email protected]
Information We Collect
- Your account: email address, a hashed password, your name and page address, your language and theme choice, and moderation records if your account is suspended. If you log in with Discord or Google, we keep that account's ID and the name or email it shares with us. If you turn on two-factor login, we keep its secret (encrypted) and your backup codes (hashed).
- Your page: everything you put on it, such as text, links, pictures, music, widgets, your Discord ID if you connect Discord or show your Discord card, and templates you publish. Comments and likes you leave on pages are kept with your account.
- Purchases: what you bought, when and for how much, discount and affiliate codes, gift codes you bought or redeemed, and your Stripe customer ID. Stripe processes card details; we never see them.
- Image host: the files you upload with their name, type and size, whether they are private, and how often they were viewed. We remove the metadata stored inside JPEG, PNG, WebP and MP4 files, such as location and camera details. If you add your own domain, we keep its name and the code that proves it is yours.
- Developer API keys: only a hash of each key (the key itself can't be read back), what it is allowed to do, and when it was last used.
- Page visits and link clicks: a scrambled form of the IP address (a keyed hash; the address itself is not kept), the browser's user agent, the name of the site or app that sent the visit (not the full link), a tag in the page link if there was one, and the country the visitor's network reports. These are used for view counts, duplicate prevention, security and creator analytics. Creators see totals only, never single visits.
- Security records: events such as sign-ups, page changes, reports, account deletions and moderator actions, with a scrambled IP address and the user agent. Ordinary logins are not recorded. To limit abuse, we briefly count requests per scrambled address.
- Reports: if you report a page or a file, what you write, the address you report, your account if you are logged in, and a scrambled IP address.
- Live updates: while a page is open, our live updates service knows which pages your browser follows (for new comments, Discord status and notification counts) and your connection address. It keeps nothing once you leave. Page owners see how many people are on their page, never who.
- Error reports: when something breaks, the error, the page address, your browser and operating system, and the steps the page took just before. Reports carry no cookies or console output, and the service is set not to store IP addresses.
- Optional Umami analytics, only if you allow it: the page address (without anything after a ?), the site you came from, screen size, language, page title and a session identifier. Umami uses your IP address to estimate your country.
If you haven't picked a language, we read the language your browser asks for to show the home, pricing, leaderboard, docs and status pages in Finnish or Russian. This is not stored.
How We Use Information
- To provide your account and page, the image host, your own domains, the developer API and live updates
- To process payments, gifts and affiliate credit through Stripe
- To send service emails: confirming your email address, password resets and email address changes
- To show notifications in your dashboard, for example when someone comments on your page or gives you a gift
- To count profile views and link clicks, prevent duplicates and abuse, and provide creator analytics
- To keep the service secure, limit abuse, moderate content and handle reports and copyright notices
- To find and fix errors
- With your choice to enable Umami analytics, to understand general site usage
Legal Basis (GDPR)
We use contract for accounts, pages, purchases, service emails, the image host, own domains, the developer API and live updates; legitimate interests for security, abuse prevention, moderation, profile views, link analytics, error reports and showing pages in your browser's language (balanced against your privacy); consent for optional Umami analytics; and legal obligation for records required by tax and accounting law. You may change your analytics choice on the Cookie Policy page.
What Others Can See
- Your page and everything on it is public, and search engines may list it
- Comments you leave show your name, picture and badge to everyone who can see that page
- The leaderboard and published templates show your page name; a gift you send straight to someone tells them it came from you
- Your Discord card, status and activity show only if you turn the card on, and only the parts you choose
- If you turn it on (Premium), visitors see how many people are on your page right now
- The image host shows a file's owner and views on its page, unless you turn them off
- A suspended page says that it is suspended and why
- Notices on the status page show the name of the team member who posted them
- In our Discord server, a role shows that you log in to evilkitty with Discord, and another one that you have Premium, if you're a member of that server
- Our Discord bot shows anyone your page as the site does. Looking you up by your Discord account finds your page only if your page shows that account, or if it's you asking
Third Parties
- Stripe: Payment processing. You pay on Stripe's checkout page; Stripe receives your email address and what you buy
- Cloudflare: The network in front of the site (it sees the IP address of every visit), file storage (R2), and certificates for image host domains (it receives the domain name)
- Discord: Logging in with Discord; our Discord bot, which shows Discord profiles and status for people who turn their card on and gives roles in our Discord server; and looking up server invites shown on pages
- Google: Logging in with Google
- Resend: Service email delivery
- Sentry: Error reports
- Umami (self-hosted): Optional website analytics
- Redis: Counting requests to limit abuse, by scrambled address or account only
- Hosting and database providers: Operating and securing the service
- Widget services: When a page shows a widget (for example weather, GitHub, Steam, Last.fm, Roblox, Old School RuneScape, a Minecraft server, MyAnimeList, lyrics or song covers), our server asks that service for the details the page owner chose. Your browser may load pictures from those services
- Embedded services: Spotify, SoundCloud, Instagram and Reddit content loads when a page shows it; YouTube and Twitch players load when you press play, though YouTube's preview picture loads straight away. These providers, Discord's picture servers, and sites that page owners link pictures from receive your IP address and other browser data, and may set their own cookies
Cookies
We use cookies for logging in and keeping sign-in secure; a login lasts up to 30 days. Your language and theme choice are saved in cookies when you pick them. Your analytics choice and a few display settings are saved in local storage. If enabled, Umami uses session storage for session continuity. See our Cookie Policy for the full list and to change your choice.
Data Retention
- Account and page data: Until you delete your account. You can do that yourself in Settings; it deletes your page, uploads, hosted files, comments, likes, purchase history on our side, API keys, own domains and notifications
- Payment records: Kept by Stripe and in our accounting for the period required by applicable accounting and tax law, also after you delete your account
- Profile views and link clicks: Deleted after 12 months by our scheduled cleanup; aggregate view counts may remain with the profile
- Security records: Deleted after 12 months. When you delete your account, records about it stay until then, no longer linked to the account
- Notifications: Deleted after 30 days
- Password reset and email confirmation links: Expire after 1 hour and 24 hours
- Hosted files: Until you delete them, they expire (pastes with an expiry time), your automatic deletion setting removes them, or your account is deleted. Files of a permanently suspended account are deleted 30 days after the suspension
- Request counts for abuse limits: Minutes to an hour
- Live updates: Nothing is kept once you leave the page
- Error reports: Up to 90 days at Sentry
- Optional Umami analytics: Retained while needed to measure site usage and manage the service; contact us to request information or deletion
International Transfers
Some providers, such as Stripe, Cloudflare, Discord, Google and Sentry, may process data outside the EEA. Where required, we rely on applicable adequacy decisions (including the EU-US Data Privacy Framework) or appropriate transfer safeguards such as Standard Contractual Clauses. Contact us for details of the safeguards used by a particular provider.
Your Rights
- Request access to your personal data, or a copy of it
- Correct your data in your dashboard, or ask us to
- Delete your account yourself in Settings, or ask us to delete your data
- Request restriction of processing and, where applicable, data portability
- Object to processing based on legitimate interests
- Withdraw consent to optional Umami analytics at any time without affecting earlier processing
- Lodge a complaint with your data protection authority (in Finland: Tietosuojavaltuutettu)
To exercise these rights, contact [email protected]. Providing account details is necessary to create an account; optional profile fields and optional analytics are not required to use the service. Evilkitty is for people aged 18 and over.
Contact
Questions about this policy: [email protected]