Privacy Policy

larpin.lol (“larpin”, “we”) lets people build a personal page with links, media, widgets and badges. This policy covers the website, the dashboard, the public profile pages and the larpin Discord bot.

It explains what information we handle, why, who else is involved, and the choices you have. The Terms of Service set the rules for using larpin; this page is only about information.

• Account: your email address and password. Passwords are stored by our sign-in provider as a one-way hash — nobody at larpin can read them.
• Profile: your username, aliases, display name, description, location, occupation, links, badges, widgets, layout and style settings.
• Uploads: avatars, banners, backgrounds, videos, music, cover art, cursors and fonts you upload.
• Things you write for others: comments on profiles and messages or reports you send us.
• Widget accounts: the usernames or IDs you enter for widgets (for example Steam, osu!, Xbox, Last.fm or Fortnite) so we can show their public stats.

• Sign-in sessions: for each device you sign in on, the browser and system it reports, its IP address and when it was last active. You can see and end them under Settings → Devices.
• Profile visits: when someone opens a profile we record the time, a rough country and a one-way visitor code made from their connection, so a refresh isn’t counted as a new visit. We don’t keep the visitor’s name or exact address with it.
• Link clicks and likes: which link on a profile was clicked and when, and who liked a page, so owners see what people use and a page can’t be liked twice by the same account.
• Technical logs: errors, request times and security events, used to keep the site running and to stop abuse. These are kept briefly.

Profile owners see their visit and click statistics in their dashboard as totals and trends, not as a list of people.

When you link Discord, Discord tells us your account ID, username, avatar, banner and your Nitro subscription type. We use them to show your Discord widget and badges and so the larpin bot can recognise you.

The larpin bot sits in the larpin Discord server. For members of that server it reads the online status, custom status and current activity (such as a game or a Spotify track) that Discord shows to everyone in the server, and stores the latest one so it can appear on that member’s profile if they add the Discord widget.

To show the Nitro tier and profile badges Discord only reveals to signed-in users, we look up the public profile of the Discord account on a profile through a public profile mirror (dcdn.dstn.to). Only the Discord account ID is sent.

You can unlink Discord at any time in Settings → Account; the widget then stops showing live data.

Widgets show public information from other services. To fill them, our servers ask those services for the account you entered — for example Steam, osu!, Xbox (through OpenXBL), Fortnite (through fortnite-api.com), Valorant (through HenrikDev), GitHub, Last.fm, Roblox, Minecraft, Twitch, Kick, weather or crypto price services. They receive the username or ID, not your email.

Some pictures on a profile — album art, avatars, game art, embeds such as Spotify or YouTube — load straight from those services in the visitor’s browser, so that service can see the visitor’s IP address as it would on any website. Their own privacy policies apply to that.

Payments for Larpin Pro, gifts and cases are handled by Stripe. You enter your card details with Stripe, not with us. We receive what we need to deliver what you paid for: a payment reference, amount, status, the subscription period and limited billing details. We never see or store your full card number.

We keep a record of case openings and their results, inventory, item grants, trades and gifts, so we can deliver items, enforce the published odds and limits, settle disputes and stop fraud.

• To run your account and show your profile the way you set it up.
• To sign you in, keep your account secure and let you manage your devices.
• To show owners their visit and click statistics.
• To deliver Pro, gifts, cases and trades, and keep an accurate history of them.
• To find and stop spam, fake views, fraud, payment abuse and breaks of our Terms.
• To send emails about your account: sign-in links, password resets, receipts and security notices.
• To fix problems and make larpin faster and more reliable.
• To follow the law and answer valid legal requests.

Your profile is a public web page. Anything you choose to put on it — username, aliases, display name, picture, description, links, media, badges, widgets and the details you turn on, like location or join date — can be seen by anyone, copied, shared, and indexed by search engines unless you turn that off in Settings.

Your email address, password, sessions, payment details and the private statistics in your dashboard are never shown on your profile. You can turn your whole page off at any time in Settings → Account.

We don’t sell personal information and we don’t share it for advertising. We share it only with:

• Service providers that run larpin for us: hosting and content delivery (Cloudflare), our database, sign-in and file storage (Supabase, through Lovable Cloud), payments (Stripe) and email delivery. They may only use it to provide their service to us.
• The services behind widgets and Discord, as described above, and only the account you connected.
• When the law requires it, or to protect people, larpin or the public from harm, fraud or abuse.
• In a sale or merger of larpin, where this policy would continue to apply to your information.
• When you ask us to, for example by linking an account.

We don’t use advertising or cross-site tracking cookies. We store a few things in your browser:

• Essential: your sign-in session, the accounts you’ve added to the account switcher, and your cookie choice. larpin doesn’t work without these.
• Preferences: things like music volume, whether you’ve entered a profile, dashboard layout choices and whether “Hide sensitive info” is on. These stay on your device.

You can clear them any time in your browser settings; you’ll just be signed out and your preferences reset.

• Your account and profile: for as long as your account exists. Deleting your account removes your profile, uploads, links, aliases and widget settings.
• Visit and click statistics: for as long as the profile exists, as totals and trends.
• Sessions: until you sign out, end the session in Settings → Devices, or it expires.
• Payment, case and trade records: as long as needed for accounting, tax, fraud prevention and disputes — this can outlast your account.
• Moderation records: as long as needed to keep banned people from returning.
• Backups: deleted information can stay in backups for a limited time before it is overwritten.

Connections to larpin are encrypted. Account data sits behind access rules so each person can only reach their own private information, and staff access is limited.

You can help: use a strong password you don’t use elsewhere, check Settings → Devices for sign-ins you don’t recognise, and turn on “Hide sensitive info” when you stream or share your screen. No online service can promise perfect security; if something goes wrong that affects you, we’ll tell you.

• Change or remove what’s on your profile, or turn the whole page off.
• Hide your page from Explore and from search engines.
• Unlink Discord and remove widget accounts.
• See every device signed in to your account and sign any of them out.
• Ask for a copy of your information, for a correction, or for your account to be deleted.

Depending on where you live — for example in the EU, the UK or California — the law may give you further rights, such as objecting to some uses or limiting them. Ask through the larpin Discord and we’ll respond within the time the law requires. We’ll need to confirm the account is yours first, and some records (like payments) may have to be kept even after deletion.

larpin and the companies that run it for us operate in several countries, so your information may be processed outside the country you live in. Where the law requires it, we rely on the protections those providers offer for international transfers.

larpin is not for children under 13, or under the minimum age to use online services on their own where they live. If you believe a child has made an account without the permission the law requires, tell us and we’ll remove it.

If larpin changes how it handles information, we’ll update this page and its date. For bigger changes we’ll also let you know on the site or in the Discord before they take effect.