Privacy

This policy says what personal data m4a1.wtf handles, why, who else sees it, how long it stays, and what you can do about it. We only collect what the service needs to work.

The short version

• m4a1.wtf is free and run by a private person in Germany. Nothing is sold, rented or used for advertising, and there is no analytics or tracking.
• We store your account (a Discord ID, or an email address with a password hash), the content you put on your page, and settings. Your page is public unless you switch that off.
• We count visits to your page without keeping the visitor's address: one daily number per page, and a one-way fingerprint that is thrown away after two days.
• If you add a Roblox, Discord or TikTok card, we copy public information from that service and refresh it every few hours.
• Staff can warn, suspend, ban or terminate accounts. Those decisions, your appeal and internal notes are stored as records about you.
• Our email goes through Mailjet. Cloudflare handles our DNS and may route traffic.
• You can download your data and delete your account in Settings, or write to [email protected].

Everything below is the same policy in full. If the short version and the full version ever disagree, tell us.

Who is responsible

The controller under Article 4(7) GDPR is:

m4a1.wtf is published under the name Asta. There is no company. We have not appointed a data protection officer because none is required at this size.

What we process, why, and on what basis

Visiting a page

When you open a page or any part of the site, our server and the reverse proxy in front of it receive your IP address, the time, the address you asked for and your browser's identification. They are needed to deliver the page and to defend it against abuse, which is our legitimate interest (Article 6(1)(f) GDPR). Server logs are kept for a few weeks at most.

To limit abuse we count how often an address calls certain functions (sign-in, sign-up, reports, searches, views). The address is held in a memory database for at most one hour for this, then it expires.

View counter. A visit counts once per page per day. For that we compute a one-way hash of your address together with a random value that changes every day, keep it in the memory database for two days, and add one to a daily total for the page. The address is not stored with it, and the hash of one day cannot be matched to the next. Crawlers and the page owner are not counted. Legal basis: legitimate interest in a counter that bots cannot easily inflate (Article 6(1)(f)). Clicks on links are only counted as a number per link and day.

Signing up and signing in

• With Discord: we receive your Discord ID, your username and your avatar picture. We use the username as a suggestion for your display name and copy the avatar into our own storage once, so no Discord server is contacted when someone views your page. We ask for the identify permission only, not your email address and not your servers.
• With email: we store your email address and a salted password hash (scrypt), never the password itself. If you confirm the address, we keep that it was confirmed and when. We send you the confirmation and, if you ask for it, the password reset link.
• Passkeys: if you add a passkey, we store its public key, its identifier, a name you give it, whether it is synced between devices, and when it was created and last used. The private key never leaves your device or your password manager. We do not receive or store your fingerprint, face or PIN.
• Sessions: after you sign in we store a hash of your session token, your browser's identification and when it was last used, so you can see and end your sessions in Settings. A session ends after 30 days without use.
• Sign-up checks: when you choose a password, the first five characters of its SHA-1 hash are sent through our server to the "Have I Been Pwned" service to see whether the password appears in known breaches. The password itself and the rest of the hash are not sent. Cloudflare Turnstile can be shown on the sign-in page to keep out bots, see below.

Legal basis: performance of the contract you enter into when you create an account (Article 6(1)(b) GDPR), and our legitimate interest in keeping accounts secure (Article 6(1)(f)).

Your page

Whatever you put on your page is stored and, unless you switch it off, shown to everyone: display name, handle, picture, bio, pronouns, location, status, links, projects, quote, music, lyrics, backgrounds, badges, the numbers on your cards, and your view counter if you show it. The settings Page is public and Allow search engines are in Settings. Your numeric account number is shown when someone hovers over your name, unless you switch that off. Content that others can see can be copied by them. We cannot take it back from them.

Do not put other people's personal data on your page. Legal basis: the contract with you (Article 6(1)(b)).

Uploads (picture, background, music, video, cursor, entry image, the picture on a custom link, the picture or GIF of a custom badge) are stored on our server. Pictures for badges and links are re-encoded and shrunk, and a badge picture is public with the badge, and so are its name, its description and its colour. Presets store your look and can include a copy of your background.

Lyrics. If you search for lyrics, the song title you typed is sent from our server to lrclib.net, a free lyrics database, to find synced lyrics. We do not send your account or address along, though lrclib.net sees our server's address. Lyrics you add to your page are your content.

Cards for Roblox, Discord and TikTok

For a Roblox card we look up your username in Roblox's public interfaces and store your Roblox ID, names, follower, friend and following counts, join year, verified mark and a picture of your avatar. To prove the account is yours we show you five words, which you add to your Roblox About text, and we read that text when you press Verify. For a Discord card we read a public invite and store the server's name, icon, and member and online counts. For a TikTok card we read the public TikTok page and store the name, picture and counts. Pictures are copied into our storage. Data is refreshed about every six hours.

This data comes from Roblox, Discord and TikTok, who are independent controllers for their own data. Only our server contacts them, never your visitors. Legal basis: the contract with you (Article 6(1)(b)), because you ask for the card.

Badges, presets, leaderboard

Some badges can be claimed through a code or through a special page that is open only at certain times. For those we store who claimed it and when (a night and a time), so that a limit per night can be kept. That record stays with the account and goes with it when you delete it.

We store which badges you hold, how you got them (automatic, given by staff, or by code) and when. Badges for views and the leaderboard use the daily counts above. The leaderboard only lists pages whose owners switched it on.

Reports

When someone reports a page we store the reason, up to 1000 characters of details, the page, the time and, if the reporter was signed in, who they are. Staff see it and decide. We email the team's address about new reports, with the page, the reason and the details. Legal basis: our legitimate interest and our duties as a host in handling notices (Article 6(1)(f), and Article 6(1)(c) with Articles 16 and 17 of the DSA).

Notifications

The bell in your dashboard shows updates the team posts for everyone and messages meant for you, such as a code or a badge from staff. We store those messages (a code is stored in the message so you can copy it) and the time you last opened the bell. Messages are deleted after 60 days, or with your account.

Bug reports

When you send a bug report we store your title and description, the area you chose, the page you were on (without anything after a question mark), the time and, if you were signed in, who you are. By default the form also attaches a short trail of what you did in that tab just before: the pages you opened, the labels of buttons and links you clicked, and the address and result of requests that changed something or failed. You can see the exact list in the form and switch it off before sending. The trail is held only in your browser's memory until you send, and nothing you typed into a field is recorded. When attached, we also store your window size, language and browser identification. Email addresses and long codes in labels are blanked before saving. Staff read the report in the console, and we email the team's address that a report arrived, with its title.

Legal basis: your request, because you send it (Article 6(1)(b)), and our legitimate interest in finding and fixing faults (Article 6(1)(f)). Attaching the trail is voluntary.

Moderation records

Staff can also give or remove a badge, change a handle, mark an email address as confirmed and send a message to your notification bell. Each of these is written to the audit log with who did it, and a handle change needs a reason.

If staff take action on an account, we store a numbered case with the kind of action, the reason you read, an internal note, links used as evidence, who decided, and the dates. If you appeal, we store your text, the decision and who made it. Staff can also write internal notes about an account. Every staff action is written to an audit log. For a termination we also keep the sign-in identity of the account (the Discord ID or the email address) in a block list so that the account cannot register again.

Legal basis: our legitimate interest in protecting the service and other users, and in being able to show what we did and why (Article 6(1)(f)), and our duties as a host (Article 6(1)(c) with Article 17 DSA). Notes, evidence and block-list entries are part of this and are not given out in an access request where that would harm others or the investigation. You can still object, see below.

Email

If you write to us, we keep the conversation as long as it is needed. We send our own mail through Mailjet SAS (France), which processes the messages for us under a data processing agreement. Messages from us to you contain your email address, the subject and the content, for example a confirmation or reset link. We do not send newsletters or marketing.

Domains and extra handles

If the team gives you extra handles or a custom domain, we store the handles and the domains you connect, a verification code, and whether the domain was verified. A DNS lookup checks your verification record.

Who receives data

• Cloudflare, Inc. runs our DNS and routes all traffic to m4a1.wtf through its network as a reverse proxy, so it sees every request, including your IP address, the time, the address you asked for and your browser's identification. It acts as our processor. If Turnstile is switched on for sign-in, your browser loads a script from Cloudflare and Cloudflare receives your address and browser details to decide whether you are a person.
• Mailjet SAS delivers our email (processor, France).
• Roblox, Discord, TikTok receive the usernames or invite codes we look up, from our server, for the cards.
• Have I Been Pwned (Troy Hunt) receives the five-character hash prefix described above, from our server.
• lrclib.net receives the song title you search for.
• Authorities and courts receive data only when the law requires it or a lawful order demands it.

Our database, our uploads and our caches are on our own servers in Germany. We do not sell data and we use no advertising or analytics service. Fonts and icons are served from our own domain. Apart from the Cloudflare script on the sign-in page when Turnstile is switched on, your browser contacts no other third party while you use the site.

Transfers outside the EU

Cloudflare, Inc. is based in the United States. Its processing for us is covered by its data processing addendum, which includes the EU standard contractual clauses. Roblox, Discord and TikTok are companies outside the EU. We only send them a public username or invite code that you gave us. Have I Been Pwned and lrclib.net also receive only the small items named above. Mailjet works in the EU.

How long we keep data

Where the law or a legal claim requires us to keep something longer, we keep it as long as needed for that purpose only.

Cookies and similar storage

We use no analytics, advertising or tracking cookies. What we set on your device is needed to run the service you asked for or is a choice you made, so no consent banner is needed under § 25 (2) No. 2 TDDDG.

The entry screen of a page and the music player store nothing on your device.

Automated decisions

We do not make decisions about you with legal or similarly significant effect by automated means. Automatic parts (rate limits, bot filtering of the view counter, the password breach check, automatic badges) do not restrict your account. Staff decide about warnings, suspensions, bans and terminations.

Your rights

You can ask us for access (Article 15), correction (16), deletion (17), restriction (18), a copy in a machine-readable format (20) and you can object (21) to processing that rests on our legitimate interest. Most of this you can do yourself: Settings has a download of your data and a button to delete your account. For anything else, write to [email protected]. We answer within one month.

Deletion has limits where the law allows it, for example where we need records to establish or defend legal claims (Article 17(3)(e)) or to keep a terminated account from returning.

If you think we handle your data unlawfully, you can complain to a supervisory authority (Article 77), in the country where you live or work, or to the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany. We would like to hear from you first, but you do not have to.

You do not have to give us any of the data listed here by law. Without the account data and the content you choose to add, we cannot provide the service.

Security

Passwords are stored only as salted scrypt hashes. Session, confirmation and reset tokens are stored only as hashes. Sensitive actions are limited in how often they can be tried, and staff access is split by role and logged. No system is perfect. If a breach puts you at risk, we tell the authority and you as the law requires.

Children

You must be at least 13. We do not knowingly store data from anyone younger. If you think a younger child has an account, tell us and we delete it.

Changes

We change this policy when something about our processing changes, and the date at the top says when. We announce important changes in the dashboard.

Contact

Questions or requests about your data: [email protected]. Who we are: imprint.