Privacy Policy

sorry.love is not directed to children under 13 years of age, and we do not knowingly collect, solicit, or maintain personal information from anyone under the age of 13. In compliance with the Children's Online Privacy Protection Act (COPPA) and international digital privacy standards, individuals under the age of 13 are strictly prohibited from registering an account, claiming vanity handles, or submitting personal data to sorry.love. If you are a parent or guardian and believe your child under 13 has registered or provided personal data, please contact us immediately at us@sorry.love, and we will promptly delete the data and terminate the account.

We operate strictly on data minimization principles. We only collect and process information necessary to provide, personalize, and secure your public profile: • Account Information: Your chosen username, vanity handle, display name, your email address (required at signup, used to verify the account and for recovery), and a cryptographically salted one-way hash of your password. Temporary or disposable email addresses are not accepted; this is checked against a list stored on our own servers, and your address is not sent anywhere for it. • Profile Content & Assets: Custom links (URLs, platform handles), custom typography, avatar/banner image assets, background audio files, selected themes, layouts, and public badges. • Activity & View Metrics: Aggregated, non-personally identifiable profile view counts and link click metrics for your creator analytics. • Security & Operational Logs: Client IP addresses, user agents, and security timestamps utilized for brute-force defense, anti-abuse rate limiting, and spam protection. • Sign-In History: Each time you sign up, log in, verify your email, or switch between linked profiles, we record the time, your IP address, approximate country, browser and operating system. • Device Signals: At sign-in we set a long-lived device cookie (a random identifier for that browser) and record a browser fingerprint (a one-way hash of technical traits such as your browser version, screen size, time zone, and graphics hardware). We use these only to detect one person operating many accounts, ban evasion, and other abuse. They are never used for advertising, and never shared or sold. • Network Reputation: We check whether an IP address belongs to a VPN, proxy, Tor exit, or datacenter. See Section 3 for the provider involved. Sign-in history, device signals, and network reputation are visible only to sorry.love administrators. Legal Basis: We process this data for the performance of our contract with you (providing the service) and for our legitimate interests (securing the platform and preventing fraud).

We work with reputable, industry-leading infrastructure partners who adhere to strict data security and privacy standards: • Cloudflare (R2 Storage & CDN): Hosts user-uploaded media assets (avatars, banners, audio) with secure isolated presigned uploads, DDoS mitigation, and global CDN delivery. • PostgreSQL Database Hosting: Secure, encrypted-at-rest database infrastructure maintaining user records and profile metadata. • Stripe & NOWPayments: PCI-DSS compliant payment gateways processing optional digital creator upgrades (Premium, Verified). sorry.love NEVER stores or has access to your full payment card details or cryptocurrency private keys. • Resend / Nodemailer: Transactional email delivery service utilized solely for email verification and password reset links. • ipapi.is (IP Reputation): To learn whether an IP address is a VPN, proxy, Tor exit, or datacenter, we send the IP address alone (no username, email, or other account data) to ipapi.is. Each address is looked up once and the answer is stored for 30 days.

When you configure third-party links or connect a public Discord User ID: • We only query publicly accessible Discord Presence data (such as online status, custom status, and active game activity via our Discord presence service) to render on your profile. • We NEVER request, access, or store your private passwords, direct messages, payment accounts, or private Discord tokens. • Linked social media handles (e.g., Spotify, Steam, GitHub, YouTube, Twitch) are public URLs provided voluntarily by you for your public profile card.

We use two first-party cookies, both HTTP-only: • Session Cookie: Authenticates your logged-in session, maintains your dashboard state, and protects against Cross-Site Request Forgery (CSRF). • Device Cookie: A random identifier set when you sign up or sign in, kept for up to two years. It tells us that two sign-ins came from the same browser and is used only for the abuse prevention described in Section 2. Profiles shown on our other domains (assume.love, forgot.love, risking.love) set no login cookies; signing in happens only on sorry.love. WE DO NOT SELL DATA: We never sell, rent, monetize, or trade your personal information. We do not use third-party tracking pixels or cross-site behavioral advertising networks, and we do not track you across other websites. The browser fingerprint described in Section 2 is computed by our own code, at sign-in only, for security. We respect Global Privacy Control (GPC) and Do Not Track (DNT) signals.

All network communication between your browser and sorry.love is encrypted in transit using industry-standard Transport Layer Security (TLS 1.3). Account passwords are protected using computationally intensive cryptographic hashing (bcrypt / Argon2) and are never accessible in plaintext. Media uploads are stored in isolated cloud buckets with strict MIME validation and random entropy keys.

We retain your personal data only as long as your account remains active or as needed to provide our services: • Profile & Account Data: Retained until you update, remove, or delete your account. • Unverified Signups: A signup that has not verified its email within 1 hour is removed and its username is released. • Sign-In History & Device Signals: Kept for as long as the account exists and removed with it. • IP Reputation Results: Stored for 30 days per IP address, then looked up again only if that address is seen again. • Security & Audit Logs: Retained for a limited rolling period for threat analysis and fraud prevention, after which they are purged. • Account Deletion: When an account is deleted, its profile, custom links, uploaded assets, and credentials are permanently purged from active databases. To stop deleted accounts being used to evade bans, we keep a minimal security record (username, email, IP addresses, and device signals) for 30 days after deletion, after which it is purged too. The same applies to unverified signups that expire.

Depending on your jurisdiction (such as the European Economic Area, United Kingdom, or California), you are entitled to specific statutory privacy rights: • Right to Access / Know: The right to request confirmation and a copy of the personal data we hold about you. • Right to Rectification: The right to correct inaccurate or incomplete information in your profile settings. • Right to Erasure (Right to Be Forgotten): The right to request permanent deletion of your account and personal data. • Right to Data Portability: The right to obtain your personal data in a structured, commonly used, and machine-readable format. • Right to Restrict or Object to Processing: The right to object to or limit certain processing activities. • Right to Non-Discrimination: We will never discriminate against you, deny services, or charge different prices for exercising your privacy rights. To exercise any of these rights, contact us at us@sorry.love. We will verify and process your request within statutory timeframes.

sorry.love operates globally. Your information may be transferred to, stored, and processed in secure data centers located in the United States or other jurisdictions where our infrastructure partners operate. We ensure appropriate cross-border data transfer safeguards and encryption standards are maintained in compliance with applicable international privacy regulations.

We may periodically update this Privacy Policy to reflect platform enhancements, legal requirements, or operational changes. When updates occur, the revised date will be indicated. For any privacy-related inquiries, data requests, or compliance questions, contact our administrative team directly at: Email: us@sorry.love We respond promptly to all verified privacy and data protection inquiries.