The short version
We collect what we need to show your page and keep the site safe. We don't sell your data, we don't run ads, and we don't use tracking or advertising cookies. You can delete everything from the editor whenever you want.
Who's responsible
Portfolioser is run by Cordyx Studios. For anything in this policy, email support@portfolioser.com or ask in our support server.
What we collect when you sign in
We use Discord to sign you in. With the "identify" permission, Discord gives us your Discord user ID, username, display name and avatar. We store your Discord ID and use the rest to set up your page. We never see your Discord password or email.
When you prove you own a server, we also ask Discord for the "guilds" permission once. We use it to see which servers you own, keep that list for about 30 minutes while you finish, and then throw it away. We keep only the servers you actually make pages for.
What you put on your page
Everything you add in the editor is stored so we can show it: your name, bio, links, colours and effects, songs you pick, and files you upload (images, video, audio, fonts). Uploads can be up to 20 MB each and 300 MB in total. Your page and its content are public. Anyone with the link can see them, and search engines may index them.
Server pages
For server pages we store the server's name, icon, banner and member count, and the Discord ID of the owner. To check staff, our bot asks Discord which roles a team member has in that server. We cache those checks briefly and don't store anyone's full role list.
Things we record automatically
View counts. When someone opens a page, we add one to its view count. A cookie stops one visitor counting twice in a day. We don't store who viewed it.
Security logs. Our host, Cloudflare, processes IP addresses and request details to deliver the site and stop abuse. We use your IP address only for short-term rate limits (for example, how many reports you can send in a minute) and don't keep it.
Notifications. Things like team invites and new badges are stored for up to 60 days, then deleted.
Reports. If you report a page, we store the reason, your note, and, if you were signed in, which account sent it.
Moderation log. Actions our core team takes (badges, suspensions, deletions) are logged with who did it, so the team stays accountable.
Cookies and local storage
We use a small number of cookies, all needed for the site to work:
ds: keeps you signed in, for up to 30 days.dsst,dsg,dsu,dspend: short-lived cookies (10 to 30 minutes) used during Discord sign-in.v<number>: stops a page view counting twice in a day.
Your browser also stores a few preferences locally, such as which announcement you dismissed. We don't use analytics, advertising or cross-site tracking cookies, so there's nothing to opt out of.
Other services your browser talks to
Some parts of a page load straight from other services, which then see the visitor's IP address:
- Discord for avatars, server icons and invite links.
- Lanyard (api.lanyard.rest) for live Discord status, if the page owner turns it on.
- Vybe (vybe.pcdev.info) for songs picked from the Vybe library.
- Google Fonts and Fontshare for fonts.
- Any site the page owner links to or embeds, such as YouTube or SoundCloud.
Their privacy policies apply to what they collect.
Who we share data with
We don't sell or rent personal data. We share it only with the services that run the site: Cloudflare (hosting, database and file storage) and Discord (sign-in and server checks). We'll also share it if the law requires us to, or to protect people from harm.
How long we keep it
Your page and account stay until you delete them. Sign-in sessions expire after 30 days. Notifications are deleted after 60 days. Short-lived sign-in data expires within 30 minutes. Copies may stay in Cloudflare's backups or caches for a short time after deletion.
Deleting your data
Open the editor, go to Settings and choose Delete my page. This removes, right away, your page, every upload, your badges, notifications, server pages you own and their teams, and your account. Reports others made about your page are deleted too. Reports you filed are kept for moderation, but your name comes off them.
If you can't sign in, or want a copy of your data, email support@portfolioser.com from any address and we'll help you prove the page is yours.
Your rights
Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you can ask to see, correct, delete or get a copy of your data, and to object to how we use it. Most of this you can do yourself in the editor. For anything else, contact us and we'll answer within 30 days. You can also complain to your local data protection authority.
We process your data to provide the service you asked for (your page), and for our legitimate interest in keeping Portfolioser safe and working.
Children
Portfolioser isn't meant for anyone under 13, or under the minimum age for Discord where they live. If you believe a child under that age has a page, tell us and we'll remove it.
Security
Sign-in cookies are HTTP-only and sent only over HTTPS. Every core-team action is logged. No system is perfectly secure, so avoid putting anything on your page you wouldn't want public.
Changes
If we change this policy in a way that matters, we'll post an announcement on the site before it takes effect.