This Privacy Policy explains what personal data PFP Vault collects, why, and what your rights are. PFP Vault is the data controller under the EU General Data Protection Regulation (GDPR).
1. Data we collect
| Data | When |
|---|---|
| Name, username, email address, hashed password | When you create an account |
| IP address used to sign up, and the date and time you signed up | When you create an account |
| Estimated location of that IP address: country, region and city | Right after sign-up |
| Date, time and IP address of your most recent login | Every time you log in (the previous value is overwritten) |
| Discord, GitHub or Google account ID, username, display name and verified email | Only if you sign in with one of these services |
| Uploads, their names, tags, AI label and review status; saved PFPs; download history | When you use those features |
| Messages and reports you send us | When you contact us or report content |
We do not collect your exact address. The location is an estimate derived from the IP address. It usually shows the city of your internet provider and can be wrong.
1a. Email address checks
When you sign up we check that your email address can receive mail: we look up the mail (MX) records of the part after the @ in the public DNS, block known throw-away email services, and check that the same mailbox is not already used by another account (for example with extra dots or a “+tag”). We do not send anything to your mailbox for this check. The result (for example “valid”) is stored with your account and is only visible to administrators.
2. How the location is determined
After you sign up, your IP address is sent to an IP geolocation service (ipwho.is, with ip-api.com as fallback). These services only receive the IP address, not your name or email. They return an estimated country, region and city, which we store with your account.
3. Why we use it (legal bases)
- Running your account and the Service (account data, uploads, saves, downloads): performance of a contract, Art. 6(1)(b) GDPR.
- Security, fraud and abuse prevention (sign-up IP, estimated location, login time and IP, download history): our legitimate interest in protecting the Service and its users, Art. 6(1)(f) GDPR. This helps us detect fake accounts, ban evasion, scraping and attacks.
- Understanding our audience (country and city statistics): legitimate interest, Art. 6(1)(f) GDPR. You can object at any time (see section 7).
- Legal requests such as copyright notices: legal obligation, Art. 6(1)(c) GDPR.
4. Who can see it
Your username, name, avatar and approved uploads are public. Your email address, IP addresses, estimated location and download history are only visible to PFP Vault administrators. They are stored on our server in our database and in an internal export file, which is never published on the website. We do not sell personal data and do not use it for advertising.
We share data only with providers that host and run the Service, with the IP geolocation services described above (IP address only), and with authorities when the law requires it.
4a. Discord bot
The PFP Vault Discord bot only shows public data from the website (PFPs, bundles, categories and public profiles). It does not store messages or Discord user data. Discord’s own privacy policy applies to your use of Discord.
5. Cookies
We only use strictly necessary cookies. See the Cookie Policy.
6. Retention
- Account data, sign-up IP, estimated location and download history: until you delete your account.
- Last-login IP: replaced at every login, deleted with your account.
- Rejected uploads: deleted within 30 days.
- Rate-limit and security data: up to 30 days.
- Contact messages and reports: up to 12 months.
7. Your rights
You can access, correct, export or delete your data, object to processing based on legitimate interest, restrict processing, and withdraw consent at any time. You can delete your account yourself in Dashboard → Settings, which removes your sign-up IP, location and download history. For anything else, email privacy@pfpvault.com. You may also complain to a data-protection authority; in Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données.
8. Children
You must be at least 13 years old to create an account. If we learn that we hold data of a child under 13, we delete it.
9. Security
Passwords are hashed with scrypt, sessions use signed httpOnly cookies, uploads are verified by file signature, and access to personal data is limited to administrators.
10. Changes
We post changes here and update the date above. Significant changes are announced on the site.