Data Protection

Privacy Policy

Last Revised: September 10, 2026 Strict No-Sale Commitment
OUR ZERO-MONETIZATION PRIVACY PLEDGE: We respect your anonymity and digital sovereignty. We NEVER sell, rent, or trade your personal information or browsing activity to advertisers, data brokers, or third-party marketing networks under any circumstance.

01. Overview & Scope

This Privacy Policy explains how kpr.lol ("we", "us", or "our") collects, protects, uses, and discloses information when you visit our website (kpr.lol), use our bio-link profile services, access our Crash simulation game, or interact with our Discord bot.

We are dedicated to operating with the utmost transparency and collecting only the minimal information strictly required to authenticate your account, maintain platform security, and serve your bio profile pages.

02. Information We Collect

We collect information in three primary ways:

A. Information You Voluntarily Provide

  • Account Credentials: When you sign up, you provide a username, an optional email address for verification, and a password. Passwords are immediately salted and hashed on our backend using industry-grade cryptography (PBKDF2 with SHA-256 and 100,000 iterations); we never see or store your plaintext password.
  • Profile & Bio Data: Display name, bio description text, avatar URL, social links, theme preferences (colors, background images, custom CSS, audio tracks), and any public comments you post on profile pages.
  • Referral / Invite Information: Invite codes used during signup to track registration access.

B. Information Collected Automatically

  • Security & Network Telemetry: When you access our endpoints, we temporarily log Internet Protocol (IP) addresses, browser user-agent strings, and request timestamps. This telemetry is collected solely to prevent DDoS attacks, mitigate abusive spam, enforce rate limiting (e.g. 30 requests/minute for authentication), and secure our infrastructure.
  • Simulation Gameplay Telemetry: Virtual crash game bets, multipliers, and virtual balances are stored to maintain the entertainment game state and user leaderboards.

C. Discord Integration Data

If you link your Discord account or interact with the kpr Discord bot, we receive your public Discord User ID (snowflake) and Discord avatar hash to link your wallet and identity. We never access your Discord password, private direct messages, email (unless explicitly granted via OAuth), or payment information.

03. How We Use Your Information

We use your information exclusively for legitimate operational purposes:

  • To create, authenticate, and manage your account and secure session tokens;
  • To display and deliver your public bio-link profile to internet visitors at kpr.lol/username;
  • To deliver interactive features, including profile comments, music playback, and virtual crash simulation;
  • To protect against fraud, malicious scripts, spam, brute force attacks, and system abuse;
  • To comply with applicable legal obligations and enforce our Terms of Service.

04. Local Storage & Cookie Practices

We do NOT use third-party behavioral tracking cookies, cross-site analytics beacons, or invasive advertising tracking pixels.

Instead, we use browser localStorage solely for functional authentication purposes:

  • kpr_token: An encrypted JSON Web Token (JWT) issued upon successful login to authenticate your requests to our API.
  • kpr_user: Cached non-sensitive profile information (username, avatar, roles) to render your dashboard quickly.

You can instantly clear these tokens at any time simply by clicking "Logout" in your navigation bar or clearing your browser's site data.

05. Zero Sale or Commercialization of Personal Data

We do not sell, rent, lease, or monetize your personal information to third parties, data brokers, or advertisers under any circumstances.

We do not participate in targeted advertising networks or share your information with marketers. Your data is used strictly to provide the core services of kpr.lol.

06. Security & Cryptographic Standards

We implement robust technical and organizational measures to safeguard your personal data:

  • Cryptographic Password Hashing: All passwords are hashed using Web Crypto PBKDF2 with SHA-256 and 100,000 iterations combined with a cryptographically secure random salt.
  • Transport Layer Security: All communications between your browser and our edge workers are strictly encrypted via modern TLS/HTTPS.
  • Parameterized Queries: Database interactions are handled via parameterized SQL to eliminate SQL injection vectors.
  • Edge Cloud Architecture: Backend systems run on Cloudflare Workers and Cloudflare D1 distributed edge infrastructure with automatic DDoS mitigation.

07. Third-Party Service Providers

To provide reliable, high-performance services globally, we partner with trusted infrastructure providers:

  • Cloudflare, Inc.: Provides Content Delivery Network (CDN), serverless edge compute (Workers), distributed SQLite storage (D1), and DDoS protection. Cloudflare processes network requests in accordance with strict global data privacy standards.
  • Discord, Inc.: Used for Discord bot integration, community support, and optional identity linking via Discord OAuth.
  • External Checkout Gateways (e.g. SellAuth): When purchasing digital items or perks, financial transactions are handled directly by third-party payment processors. kpr.lol never sees, receives, or stores your credit card, bank account, or payment credentials.

08. Your Rights & Account Deletion (Self-Service)

You maintain full control over your personal data. You possess the right to access, modify, export, or permanently erase your data at any time:

  • Profile Modification: You can edit your display name, bio, social links, and theme at any time directly through your Dashboard.
  • Permanent Self-Deletion: You can permanently delete your entire account and all associated profile data at any time by navigating to Dashboard > Settings > Delete Account. Upon confirmation, your user row, profile settings, social links, and comments are permanently erased from our active database.

09. Children's Privacy (COPPA Compliance)

Our Services are strictly not directed to children under thirteen (13) years of age. We do not knowingly solicit or collect personal information from any child under 13. If you are a parent or guardian and believe your child under 13 has registered an account with us, please contact us immediately at legal@kpr.lol. Upon verification, we will promptly expunge the account and associated information from our records.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications to our operational, legal, or regulatory practices. Any changes will be posted directly to this page with an updated "Last Revised" date at the top. We encourage you to review this policy periodically to stay informed about our data handling practices.

11. Contact & Privacy Officer

If you have any questions, inquiries, or data privacy requests regarding this policy, please reach out to our team: