Privacy Policy

Tracerr (tracerr.cc) is a profile page service run from the Netherlands. We are the data controller for the personal data described here, and we process it under the EU General Data Protection Regulation (GDPR, in Dutch: AVG).

You can reach us through our Discord server.

We only collect what we need to run your page.

• Account details: your email address, username and a hashed version of your password. We never see or store your password in plain text.
• Discord, if you connect it: your Discord user ID, username, avatar and the access tokens Discord gives us to confirm it's you. We don't read your messages or servers.
• Your profile: everything you add in the editor, such as your display name, bio, links, songs, images and settings. This is public by design, because it's your page.
• Sessions: when you log in we store the IP address and browser of that session, so you stay logged in and we can spot misuse.
• View counts: we count how many times your page is opened. We store a number, not who the visitors are.
• Server logs: our hosting provider keeps short-lived technical logs (such as IP address and requested page) for security and debugging.

• To provide the service (performance of a contract): creating your account, logging you in, showing your page, and handling Premium.
• To keep Tracerr safe (legitimate interest): preventing spam, abuse, impersonation and fraud, and enforcing our Acceptable Use Policy.
• To meet legal obligations, such as keeping payment records for tax purposes once payments are live.

We don't sell your data, we don't show ads, and we don't build advertising profiles.

Your profile at tracerr.cc/yourname is visible to anyone, and search engines and link previews (for example on Discord or X) can show it. This includes your display name, username, bio, links, badges, songs, images, view count and, if you turn it on, your live Discord status.

Your email address, password, sessions and Discord tokens are never public.

We use a small number of providers to run Tracerr. Each only gets what it needs.

• Vercel hosts the website and keeps short-lived logs.
• Neon stores our database in Frankfurt, Germany (EU).
• Discord handles "Continue with Discord" and our community server.
• YouTube plays the songs on a profile. When a visitor plays music, their browser connects to YouTube, which may set its own cookies under Google's privacy policy.
• Lanyard provides live Discord status. Visitors' browsers fetch the status of the profile owner directly from Lanyard.
• Vercel Blob stores the images and videos you upload, in Frankfurt, Germany (EU). Files you replace or remove are deleted when you save, and all of them are deleted with your account.
• Images you link to instead of uploading load from wherever you host them, such as Discord's image servers.

Some of these providers are based in the United States. Where data leaves the EU, they rely on the EU-US Data Privacy Framework or standard contractual clauses.

We only use what is strictly necessary, so we don't ask for cookie consent.

• A session cookie keeps you logged in. It is removed when you log out or when the session expires.
• Session storage in your browser remembers which pages you opened during a visit, so a refresh doesn't count as a new view.

We use no analytics, tracking or advertising cookies. YouTube may set its own cookies when music plays, as described above.

• Your account and profile stay until you delete them or ask us to.
• Sessions expire automatically after a period of inactivity.
• Hosting logs are deleted by our provider within days.
• If we suspend an account for abuse, we may keep the minimum needed to prevent the same person from coming back, for up to 12 months.

Under the GDPR you can ask us to:

• show you the data we have about you (access),
• correct it (rectification),
• delete it (erasure),
• give it to you in a portable format (portability),
• stop or limit certain processing (objection and restriction).

You can change most of your data yourself in the dashboard. For anything else, contact us and we'll respond within 30 days. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Tracerr is not meant for children under 13, matching Discord's minimum age. If you are under 16 and live in the EU, please only use Tracerr with permission from a parent or guardian. If we learn that a child under 13 has an account, we will delete it.

Passwords are hashed, all traffic is encrypted with HTTPS, and access to the database is limited to what the service needs. No system is perfectly secure, so use a unique password, and tell us right away if you think your account was accessed by someone else.

If we change this policy in a way that matters, we'll announce it in our Discord and update the date at the top of this page before the change takes effect.