Privacy Policy

• We collect what we need to run your account and page, to count visits, to take payments, and to stop abuse such as duplicate accounts.
• Your page is public on purpose. Anything you put on it can be seen by anyone.
• We don't sell your personal information and we don't use it to build advertising profiles ourselves. If ads are shown on a free page, our advertising partner sets its own cookies.
• We never hold your cryptocurrency. Payments go from your wallet to the recipient's wallet and are read from public blockchains.
• You can edit your data, turn off emails, and delete your account from Settings, and you can ask us about your data at any time (section 11).

“yumu”, “we” and “us” mean the people who run yumu. This policy covers the website, your page, the dashboard, the Shop, the Market, the Help center and our Discord features.

Your account. Your email address and username; your password (stored only as a secure hash) or the Discord account you sign in with (its id, username and picture); any passkeys you add; the sessions you are signed in on, including the network address and browser they were created from; and whether your email is verified. If you sign in to several accounts on one device, a separate sign-in session is kept for each. Staff accounts also record when a passkey check was last done.

Your page and uploads. Everything you put on your page: display name, bio, pronouns, location, links, social handles, pictures, background, music, video, fonts, custom CSS, blocks, design settings, badges you choose to show, and any text, wallet addresses (for the wallet block) or ids (such as a Discord id for a presence card) you enter. Files you upload are stored with our file storage provider.

Visits to pages. When someone views a page or clicks a link on it, we record the event, the referring site, the visitor's country (worked out from their network address) and device type, plus a one-way hash used to count unique visitors. We don't store visitors' network addresses with these records. Your own visits to your own page aren't counted. Page owners see this as totals and charts in Insights, not as a list of people.

Keeping it to one account per person. When you sign up or log in we record one-way hashes of a random device identifier cookie, a device fingerprint our sign-up and log-in pages work out from technical properties of your device (graphics chip, screen, processor, memory, time zone, languages and installed fonts), and your network address and its range. They can't be turned back into the original values. We also check whether a sign-up comes through a VPN, proxy or Tor, and refuse sign-ups from throwaway email services. We use this to prevent fraud and abuse: to stop duplicate accounts, to enforce the one-account rule and to spot ban evasion. When an account is made with an Extra account voucher, we record which voucher was used.

Purchases, vouchers and gifts. What you bought, its price, the coin, the wallet addresses involved (ours and the seller's or payout address) and the transaction ids you submit. Payout wallets you add are stored so buyers can pay you. Extra account vouchers are linked to the account that owns them and, once used, to the account made with them. yumu pro gift links record who made the link, how many days it carries, an optional message, when it was claimed and by which account. Blockchain transactions are public and permanent by nature; we only read them.

Using the service. Actions you take that we need to run or protect the service, such as changing your username, listing something on the Market, sharing a template, reports you send us, and requests that were blocked by our rate limits. Staff actions on accounts (bans, role changes, badge grants, voucher or gift creation and similar) are recorded in an audit log with the account concerned.

Emails and messages. We send emails you need (sign-in verification, password resets, changing or deleting an account) and, unless you turn it off, a weekly stats email. We keep what we need to send them and to prevent repeats. If you contact us on Discord, we see whatever Discord shows us, such as your Discord username and what you write.

Information from others. If you sign in with Discord, we receive the details above from Discord, and we refresh your saved Discord picture when you log in. If someone reports your content, we keep the report and what we decided.

• To create and run your account, keep you signed in, show your page and deliver what you buy.
• To count visits and show you Insights, and to rank pages on the leaderboard by views.
• To take payments, check them against the blockchain, handle problems, and pay sellers on the Market.
• To prevent fraud, duplicate accounts, spam, ban evasion and other abuse, and to enforce our Terms, including investigating reports.
• To keep the service secure and working: rate limits, error and performance monitoring, backups and fixing bugs.
• To email you about your account and, if you leave it on, your weekly stats.
• To follow the law and respond to valid requests from authorities.

We don't make decisions that have legal or similarly significant effects on you using automated profiling alone. Some safeguards are automatic (for example refusing a sign-up that matches a suspended account); a person can review them if you contact us.

If the GDPR or UK GDPR applies to you, we process personal data on these bases: contract (to provide the service you asked for, including your account, page and purchases); legitimate interests (keeping the service secure, preventing abuse and duplicate accounts, counting visits, and improving the service, balanced against your rights); legal obligation (records we must keep and requests we must answer); and consent (for non-essential advertising cookies on free pages shown to visitors in the EEA, UK and Switzerland, which you can withdraw at any time).

• Your page and everything on it, including your username, name, bio, links, pictures, music, badges shown and any wallet address you add to a wallet block. Search engines are asked not to index profiles, but anyone with the link can see them, and others can copy what they see.
• If you rank on the leaderboard: your display name, username, picture and view count.
• Templates you share to the gallery, including your username as the creator, how many people use them, and the design itself. Listings you make on the Market, including your username and price.
• Link previews. When your page, a gift link or the leaderboard is pasted into services such as Discord, a preview card is shown to people in that chat using the page's public information.
• Blockchain transactions made to pay or be paid, which are visible to everyone on the public ledger.

Don't put anything on your page that you want to keep private.

We use cookies, and local storage in your browser, to make the service work. Most are essential and can't be turned off if you want to use the service.

Our advertising partner Google and its partners may use cookies to serve and measure ads, including ads based on your visits to this and other sites. You can turn off personalised ads at Google Ad Settings or aboutads.info. Visitors in the EEA, UK and Switzerland are asked for consent first. yumu pro pages never show ads. You can block or delete cookies in your browser; if you block essential ones you won't be able to stay signed in.

Embedded content (such as Spotify or YouTube) may set its own cookies once it loads.

We don't sell your personal information. We use these services to run yumu, and they process data only to provide them for us:

• IONOS (hosting), Neon (database), Cloudflare (network and file storage), and Resend (email).
• proxycheck.io, which receives the network address of a sign-up so it can tell us whether it is a VPN or proxy.
• Discord, if you sign in with it or use our Discord features; and Lanyard, if you add a Discord presence block (it reads presence for the Discord id you enter).
• Public blockchain explorers and node providers (to read payments and balances), CoinGecko (prices), lrclib.net (song lyrics), and Telegram, Roblox, GitHub, Steam, Twitch, YouTube and Discord public APIs for the cards you add. These requests come from our servers, not from your browser.
• Spotify and YouTube, when a page includes their embeds, and Google, when advertising is shown. Your browser connects to them directly.

We may also share information: where the law requires it or a valid legal request requires it; to protect the safety of people, our service or our rights, for example by reporting illegal content or fraud; with an acquirer if yumu is sold or merged (we will tell you if your data would be handled differently); and with your consent.

Staff see account information (email, username, plan, badges, role and signals about duplicate accounts) only to run the service, handle reports and support, and enforce our Terms. Staff actions are logged.

Our providers run servers in several countries, including the United States. If you are in the EEA, UK or Switzerland, your data may be transferred outside it. Where that happens we rely on the safeguards our providers offer, such as the European Commission's standard contractual clauses.

• Account, page and uploads: until you delete your account. Deleting it removes your profile, uploads and personal data from our live systems. Backups are overwritten over time.
• Visit records: kept so your Insights and view counts keep working, and removed with your page.
• Sign-in sessions: until they expire, you sign out, or you revoke them.
• Anti-abuse records (the hashed sign-up identifiers, network ranges, and the audit log): kept as long as needed to prevent abuse and ban evasion, which can be after an account is deleted.
• Records of purchases, Market sales, vouchers and gifts: kept as long as needed for accounting, disputes and the law.
• Accounts that were suspended or banned: can't be deleted, so we keep the account record and its identifiers to enforce the ban.
• Reports and moderation decisions: kept as long as needed to keep the service safe.

Content you shared that other people already copied, such as a template someone used, stays with them. Public blockchain records can't be removed by us or anyone.

Passwords are hashed and checked against known breaches. Staff and sensitive actions need a passkey check. Data is encrypted in transit, access to it is limited to people who need it, and our providers secure their own infrastructure. The sign-up identifiers we keep for abuse prevention are one-way hashes. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires. Please use a strong, unique password or a passkey, and tell us right away if you think your account was accessed by someone else.

In Settings you can edit or delete your page content at any time, change your email, add or remove passkeys, see and end your sessions, turn off the weekly stats email, remove your Discord connection, download a copy of your data (Settings → sign-in, as one file), and delete your account (a confirmation link is sent to your email first). You can't delete an account while a sale is in progress or while it is suspended.

Depending on where you live (including the EEA, UK and some US states such as California), you may have the right to: know what we hold about you and get a copy; correct it; delete it; restrict or object to some processing; move your data to another service; withdraw consent you gave; and not be treated worse for using these rights. We don't sell personal information or share it for cross-context behavioural advertising ourselves.

To use a right, contact us (section 14) from the email on your account or tell us your username, so we can check it is you. We will answer within the time the law sets, normally within one month. We can't always do everything you ask: for example we may keep records we need to stop abuse, comply with the law or handle a dispute, and we will explain when that applies. If you think we have handled your data wrongly, you can complain to your local data protection authority.

yumu is not meant for children under 13 (or the minimum age in your country, if higher), and we don't knowingly collect their information. If you think a child has given us personal data, tell us and we will delete it.

We may update this policy as the service changes. When the changes matter, we will say so in the dashboard's Updates tab and change the date above. Continuing to use the service after that means you accept the updated policy.

Questions, data requests, or privacy concerns: contact us through our Discord server, or see the Help center.