The short version
- We collect what's needed to run your account and page: your email, a scrambled (hashed) password, and what you put on your profile.
- To protect accounts and stop abuse, we keep a short security record of recent logins (network address and device). It's never public.
- Visitor stats (country, device, which site they came from) are counted as totals. We don't build profiles of visitors.
- To keep the site safe, some text and images on profiles are checked by OpenAI's moderation service. The AI assistant in your dashboard is optional.
- No ads, no tracking pixels, and we never sell your data.
- You can download your data or delete your account at any time from Settings.
1Who we are
repent.info ("we", "us") is a free link-in-bio and file hosting site. We're the data controller for the personal data described here. This policy applies to everyone who uses repent.info: people with accounts and people who just visit a page. It's written to follow UK data protection law (the UK GDPR and the Data Protection Act 2018).
2What we collect from account holders
| Data | Details |
|---|---|
| Account details | Username, any extra usernames (aliases) you add, email address, and your password. The password is stored only as a salted scrypt hash, so we can't read it. When you sign up we email you a 6-digit code. We keep only a hashed copy of it, for 5 minutes, and delete it once used. |
| Linked Discord account | If you link Discord: your Discord user ID, username, account badges and Nitro type, and when you linked it. We use this to show your Discord status and badges on your page and to give you matching roles in our Discord server. You can unlink it in Settings at any time. |
| Profile content | Display name, bio, tags, links, colours and settings, profile picture, banner, background, music, cursor, widgets (for example a GitHub or Roblox username, or Discord ID), and templates you publish. |
| Uploads | Files you upload to the image host, with their name, type, size and upload date. When you upload an image, it's checked for nudity by an AI model running on our own server, and hidden photo metadata (such as GPS location, camera model and time taken) and the location recorded in phone videos are removed before the file is stored. We don't keep the original. |
| Automatic moderation | To block hate speech, sexual content involving minors and similar abuse, the text you put on your profile (such as your username, display name, bio, links and tags) is checked by OpenAI's moderation service. Images used on your profile (such as your picture, banner and background) may also be sent to it, resized and with metadata removed. OpenAI only returns a yes/no result for each category. If something is flagged, we keep a short note of what was flagged and why, so staff can review it. |
| Activity | Likes and dislikes you give, comments you post, reports you send, and when you agreed to these policies. |
| Security | The IP address you signed up from, and the IP address, browser and time of your last 15 logins and of each active session. Each network address can only be used for a limited number of accounts. If you turn on two-factor authentication: the secret key and hashed backup codes. |
| Browsers and devices | To stop people making lots of alt accounts, we give each browser a random ID (stored as a cookie and in local storage) and record a hashed (not readable) copy of it on the accounts that sign up or log in with it, with the browser name and time. When you sign up or log in we also record a device fingerprint: a short hash made from your browser and device settings (such as screen size, time zone, language and graphics card). It can't be turned back into those settings. Staff use these to spot alt accounts, and a browser that has already been used for the maximum number of accounts can't sign up for another. |
| Invites | Who invited you, if you signed up with an invite link, plus a hashed (not readable) identifier of the network you signed up from. This is used to stop people faking invites. |
| Your page's stats | Totals of views and link clicks per day, and counts of visitors' countries, device types and referring websites. Only you and staff can see these. |
| AI assistant | The AI assistant in your dashboard is optional. If you use it, your message, the recent chat and your page's text and style settings are sent to OpenAI so it can answer and make the changes you ask for. Changes it makes go through the same checks as changes you make yourself. We don't store the chat. It stays in your browser tab until you close it. |
| Support and Discord | If you ask our support bot a question in Discord, the question is sent to OpenAI to write an answer. In our Discord server, the bot checks messages for slurs, blocked links, spam and mass pings so it can remove them automatically. When it removes a message, a short copy of it is posted in a private staff log channel so staff can check the decision. Other messages aren't stored by us. |
3What we collect from visitors
When someone views a profile, we count the view in a way that blocks bots and repeat counting:
- A random visitor ID cookie (
vid), so one visitor counts once per day. - A hashed version of the visitor's IP address and network, kept only for the current day, then deleted.
- Their approximate country (worked out from their time zone or browser language, or from our hosting provider's country header if there is one), their device type (desktop, mobile or tablet), and the name of the website they came from (for example "discord.com", never the full address).
These are added to the page owner's totals. We don't store a list of who viewed which page. Link clicks are counted the same way.
Like every website, our server sees the network (IP) address of each request. We use it only for security: rate limits, spotting attacks, and blocking addresses that abuse the site. Recent traffic is kept for up to an hour. An address stays on record only if it's blocked or banned for abuse (until that block or ban ends), or if it was one of the main sources of a detected attack on the site (kept with that attack's record).
4Why we use it (and our legal basis)
| Purpose | Legal basis |
|---|---|
| Running your account and showing your page | Contract: it's needed to provide the service you signed up for. |
| Keeping accounts secure, stopping spam, bots, fake views and abuse | Legitimate interests: keeping repent.info safe and fair for everyone. |
| View and click stats for page owners | Legitimate interests: page owners want to know how their page is doing. We only keep totals. |
| Moderation: handling reports, bans and appeals | Legitimate interests, and legal obligations where content is illegal. |
| Automatic moderation with OpenAI, and the optional AI assistant | Legitimate interests for moderation (keeping illegal and hateful content off the site). Contract for the assistant, which only runs when you ask it something. |
| Important emails about your account or these policies | Contract and legitimate interests. We don't send marketing emails. |
| Responding to legal requests | Legal obligation. |
5What's public
Your profile page is public: your username, display name, picture, bio, tags, links, badges, widgets, view count, like and dislike counts, and comments. It can be reached at repent.info/username and through our short link court.rip/username, which simply forwards to the same page. Anyone can see them, and search engines and link-preview bots (for example Discord or X) may show them. Files shared by link can be seen by anyone with the link. Templates you publish appear in the public gallery.
Your email, password, IP addresses, login history, browser IDs, device fingerprints and detailed stats are never public.
7Third-party services
We never sell or rent personal data. These services process data for us to run the site:
- OpenAI: automatic moderation of profile text and images, the dashboard AI assistant, and the Discord support bot, as described above. OpenAI is based in the US. Data sent through its API isn't used to train its models and is kept by OpenAI for up to 30 days to detect abuse, then deleted.
- Cloudflare Turnstile: the "I'm human" check on sign-up, which looks at your browser and IP address to stop bots.
- Our email provider: delivers sign-up codes, confirmation links, password resets and security alerts to your inbox.
- Our hosting and database providers: store the site's data and files.
Some features load content from other services. When they do, your browser connects to that service, which can see your IP address:
- Google Fonts: fonts used on the site and on profiles.
- Simple Icons CDN: social media icons.
- Discord: live Discord status and Spotify "now playing" come from the repent.info bot, for members of our Discord server whose ID is on a profile. If the bot is offline, pages fall back to Lanyard (api.lanyard.rest).
- Spotify: the embedded player, only on pages with a Spotify widget. Spotify may set its own cookies.
- Kick and TikTok: the embedded players, only on pages with a Kick or TikTok widget. They may set their own cookies.
- Discord, GitHub, Roblox, Steam, Spotify, Telegram and Bluesky image servers: avatars and album art shown in widgets.
For GitHub, Roblox, Steam, Telegram, Bluesky, Lichess, Chess.com, Minecraft and TikTok widgets, our server looks up the public username you entered. When you search for song lyrics or album covers in the dashboard, our server sends the song title and artist to LRCLIB and Apple's iTunes search. None of these lookups send anything about you or your visitors.
Where data is sent outside the UK (for example to OpenAI in the US), we rely on the UK's approved safeguards for international transfers, such as the UK International Data Transfer Addendum or the UK-US data bridge.
We may share data if the law requires it, to protect people from serious harm, or to deal with illegal content, for example reporting child sexual abuse material to the authorities. Requests from police and other authorities have to follow the process in section 11 of our Terms, and we'll usually tell you about a request for your data unless the law stops us. If repent.info is ever taken over by someone else, this data would move to them under this same policy, and we'd tell you first.
8How long we keep it
- Your account and content: until you delete them. Deleting your account removes your page, links, uploads, templates, likes, dislikes and comments straight away.
- Login history: your last 15 logins. Older entries are replaced automatically.
- Browser IDs and device fingerprints: the last 12 browsers and 8 fingerprints per account, older ones replaced automatically, and deleted with your account.
- Sessions: up to 30 days, or until you log out or revoke them.
- Sign-up codes and email links: sign-up codes last 5 minutes, confirmation links 48 hours, and password reset links 1 hour. All are deleted once used or expired.
- AI assistant chats: not stored by us. They stay in your browser tab until you close it.
- Moderation results: the latest automatic check on your profile is kept with your account and deleted with it.
- Hashed visitor IPs for view and click counting: deleted at the end of each day.
- Security traffic records: up to an hour. Blocked or banned addresses are kept until the block or ban ends. Records of detected attacks (including their main source addresses) are kept for the last 100 attacks.
- Page stats: kept as totals with your account and deleted with it.
- Reports and staff action logs: kept while needed for safety and moderation. Staff logs keep the last 5,000 actions.
9Keeping it safe
Passwords are hashed with scrypt, login cookies are HTTP-only and can't be sent by other websites, and we offer two-factor authentication. We also use strict security headers, protection against cross-site requests, rate limits and lockouts against password guessing, and file-type checks on uploads. We test the site for security holes regularly. No system is perfect, though. If a data breach puts you at risk, we'll tell you and, where required, the Information Commissioner's Office (ICO).
10Your rights
Under UK data protection law, you can:
- Get a copy of your data. Use "Export my data" in Settings, or ask us.
- Correct it. Most of it you can edit yourself in the dashboard.
- Delete it. Use "Delete account" in Settings, or ask us.
- Object to or restrict how we use it, where we rely on legitimate interests.
- Move it to another service. The export is a standard JSON file.
Email us to use any of these rights. We'll reply within one month. If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office.
11Children
You must be 13 or older to make an account. We don't knowingly collect data from children under 13. If you think a child under 13 has an account, tell us and we'll delete it.
12Changes
If we change this policy in an important way, we'll show a notice on the site before the change takes effect. The date at the top shows when it was last updated.
13Contact
For privacy questions or requests, email support@repent.info.
See also our Terms of Service.