Privacy Policy

1. Who is responsible

The controller is the operator of puh.gg, Puh Network, email [email protected]. For anything about your data, write to this address or use the contact page.

2. Visiting the site

When you open any page, our server receives technical data your browser sends with every request: IP address, date and time, the page requested, browser and operating system. We need it to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Server logs are kept for at most 14 days.

For profile statistics we store only the country (derived from the request) and the device type (desktop, mobile, tablet) of a view or link click. We do not store visitors' IP addresses for statistics and do not build visitor profiles.

To keep the statistics honest and stop generated views (bots, scripts, proxy networks), a view is only counted after the page has been open in a browser for a few seconds, and each visitor counts once per profile per day. For this we store a keyed hash of the IP address, the profile and the day, from which the IP address cannot be read, and a count per network block per hour. These entries are deleted after about one day. Requests from bots and automated browsers are not counted. Legal basis: Art. 6(1)(f) GDPR (reliable statistics and protection against manipulation).

3. Cookies

We only use cookies that are needed for the site to work, so no consent banner is required (§ 25(2) TDDDG):

• puhgg_session: keeps you signed in, up to 30 days.
• puhgg_2fa_pending, puhgg_passkey_challenge, puhgg_discord_state: short-lived (10 minutes) for two-factor sign-in, passkeys and Discord sign-in.

When you close the "Claim your profile" note on a profile, your browser remembers this in its session storage (puhgg-claim-promo-closed) until you close the tab. It is never sent to us.

We do not use advertising or tracking cookies and no third-party analytics. The payment pages of Stripe and NOWPayments (section 9) are run by those providers on their own domains and set their own cookies there.

4. Your account

To create an account we need your email address, a username and a password, which we only store as a secure hash. For security we store each sign-in with its IP address and browser so you can see and end your sessions under Security. To stop password guessing we count wrong passwords and two-factor codes per account and per IP address for 15 minutes; the IP address and any typed name are only kept as a keyed hash, and the counts are deleted after one day. Optional: two-factor authentication and passkeys. Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for) and Art. 6(1)(f) GDPR (account security).

We send emails that belong to your account: confirmation codes, password resets, security notices, email changes and gift notifications. We do not send newsletters.

5. Your public profile

Everything you add to your profile is public on your profile page unless you hide it: name, bio, links, images, music, sections, badges, widgets, comments you receive and the number of views and likes. Comments and likes you leave on other profiles are shown with your username.

Widgets. If you add a widget (for example GitHub, Last.fm, Valorant, Fortnite, Minecraft or the weather), you enter a public account name, link or place. Our server then fetches the public data for it from that service and caches it for about ten minutes: Discord, GitHub, Last.fm, stats.fm, chess.com, Lichess, Mojang, mc-heads.net and mcsrvstat.us (Minecraft), Roblox, Modrinth, Kick, OverFast (Overwatch), Enka.Network (Genshin Impact), fortnite-api.com, OpenXBL (Xbox), HenrikDev (Valorant), Pinterest, TikTok, unavatar.io (profile pictures for TikTok and X), Spotify (song and playlist cards with their 30 second previews) and Open-Meteo (weather). Pictures and Spotify previews from these services are passed through our server as well. Only the name or link you entered is sent to the service, never data about your visitors, and visitors' browsers do not contact these services. Legal basis: Art. 6(1)(b) GDPR for you, Art. 6(1)(f) GDPR for showing the widget to visitors.

YouTube and Twitch. Video and stream players of these services are only loaded when a visitor clicks "Load" on the widget. Until then no connection to the service is made. After the click, the visitor's browser connects to YouTube (Google Ireland Ltd., using the privacy-enhanced youtube-nocookie.com mode) or Twitch (Twitch Interactive, Inc., an Amazon company, USA), which receive the IP address and may set cookies. The click is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); it applies to that one player and that visit.

Discord on profiles. Discord avatars, avatar decorations and server icons are also passed through our server, so visitors' browsers do not contact Discord.

6. Image host, comments and reports

Files you upload to the image host, pastes and short links are stored with their settings until you delete them or they expire. PNG and JPEG pictures are stored as smaller WebP files, and their metadata (such as camera details and GPS location) is removed. If you report a profile or upload, we store the report and the details you give to review it (Art. 6(1)(f) GDPR, keeping the platform safe).

7. Linking Discord

If you link Discord under Connections, we receive your Discord ID, username, avatar and avatar decoration from Discord and store the access token encrypted. We use it to show your Discord status on your profile if you turn that on, to let you sign in with Discord and to give you roles and badges on our Discord server (for example Premium, Donator or Beta Tester). You can unlink at any time, which deletes this data.

8. Our Discord server and bot

On our Discord server, our bot processes data to run the server (Art. 6(1)(f) GDPR, a well-run and safe community, and Art. 6(1)(b) GDPR where you use a feature):

• Levels: your Discord ID and name, message count, voice minutes and XP, plus daily totals for the server statistics.
• Birthdays: the date you enter yourself with the birthday command, until you remove it.
• Tickets: your answers to the ticket form, who handled the ticket and its messages. The messages are deleted 7 days after the ticket closes; topic and answers are kept for our records.
• Logs: moderation actions, deleted and edited messages, joins and leaves. Logs of messages, joins and leaves are deleted after 30 days, all other logs after one year.
• Giveaways, suggestions and voting, temporary voice channels and link rule warnings, as long as they are needed for that feature.
• Beta applications: your Discord ID and name and your answers. They are only seen by the review team and deleted at the latest six months after the beta ends.

Discord itself is run by Discord Inc., USA; its own privacy policy applies to everything you do on Discord.

9. Shop, payments, gifts and donations

When you buy something or donate, we store the purchase (product, amount, currency, date, status and the payment provider's reference). You enter your payment details directly with the payment provider; we never see full card numbers or bank details. Legal basis: Art. 6(1)(b) GDPR, and for keeping records Art. 6(1)(c) GDPR together with German tax and commercial law, which require us to keep purchase records for up to 10 years.

Card and other payment methods are processed by Stripe Payments Europe, Ltd. (Ireland). Depending on your country Stripe offers cards, Apple Pay, Google Pay, SEPA Direct Debit, Klarna and similar methods, and may show the price in your local currency. To prevent fraud, Stripe also processes data about your device and connection. Stripe's privacy policy applies to the payment page.

Crypto payments are processed by NOWPayments (nowpayments.io), which converts the payment and forwards it to our wallet. We receive the payment status and amount, not your wallet. Please note that blockchain transactions, including the sending address and amount, are public and permanent by design.

If you gift a product to another user, they see your username and receive an email about the gift. Gift links can be opened by anyone who has the link. Your total spent decides your Donator badge, which is public on your profile.

10. Team email

If you write to an address of our team (for example [email protected]), we store your email, your address and our reply so we can answer you and follow up (Art. 6(1)(b) or (f) GDPR). Only the team members responsible for that address can read it.

11. Service providers

We use these providers, who process data on our behalf under data processing agreements:

• netcup GmbH, Germany: hosting of the website, the database and the Discord bot
• Cloudflare, Inc.: DNS, protection against attacks and file storage
• Resend: sending and receiving email

Stripe, NOWPayments and Discord act as independent controllers for their part (sections 7 to 9). Some providers are based in the USA or may process data there. Transfers are covered by the EU-U.S. Data Privacy Framework or by the European Commission's standard contractual clauses (Art. 46 GDPR).

12. How long we keep data

• Account and profile: until you delete your account. Deletion takes effect after a 7-day grace period in which you can cancel it.
• Ended sessions: deleted after 30 days. Email codes: deleted one day after they expire.
• Uploads and short links: until you delete them or until their expiry date.
• Widget data: cached for about ten minutes, pictures for up to one day.
• Hashed keys against fake views and clicks: about one day.
• Discord server data: as described in section 8.
• Purchase records: up to 10 years, as required by tax law, even after the account is deleted.
• Moderation records (reports, warnings, bans): as long as needed to keep the platform safe.

13. Your rights

You have the right to:

• access your data and get a copy of it (Art. 15 and 20 GDPR); you can download an export under Security in your dashboard
• have wrong data corrected (Art. 16 GDPR); most data you can change yourself in the dashboard
• have your data deleted (Art. 17 GDPR); you can delete your account under Security
• restrict processing (Art. 18 GDPR) and object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw a consent at any time with effect for the future
• complain to a data protection supervisory authority, for example the one where you live

To use your rights, email [email protected] or use the contact page. We answer within one month.

14. Age

You need to be at least 16 years old to create an account, or have the consent of a parent or guardian.

15. Changes

We update this policy when the service changes. The date at the top shows the latest version. For important changes we notify signed-in users.