1.What this policy covers
This policy describes information handled by narc when you sign in, create or visit a profile, upload media, connect widgets, share templates or use enabled checkout. It covers this application, not the independent websites and services you reach through links or embeds.
A public profile is designed for sharing. Please review what you add before publishing, especially contact details, photographs, location information and links that reveal other accounts. You do not need to put sensitive personal information in a profile to use the service.
2.Account and session information
When you register with email and password, we store your email, a random account identifier, a salted password hash and the account creation time. Your password is not stored as readable text. Temporary attempt counters help limit repeated sign-in attempts. Short-lived hashes of request addresses are used for rate limits on sign-in, views and reactions; those counters expire after their request window.
When you sign in with an enabled provider such as Google or Discord, the service receives a provider account identifier and the name and email information returned for that sign-in. These are used to associate your profile and purchases with your account. Your sign-in email is not automatically displayed on the public profile.
The service creates a random session token and stores a hash of it with the account identifier, name, email and expiry in the database. A session cookie lets your browser remain signed in. OAuth authorization codes and access tokens are used on the server to complete sign-in; never send them to support.
3.Profile content and uploads
The service stores your username, display name, profile settings, bio, About Me text, links, posts, media references, badges, widget settings and publication status. Uploaded images, audio and video are stored in object storage. Your saved profile and update time are stored in the application database.
Published content, social buttons, connected-account identifiers and visible widgets can be seen by visitors. If you enable them, your chosen timezone, public wallet addresses and recorded joined date are also public. Crypto price quotes are requested from Coinbase through the application server; this does not connect a wallet or reveal a balance. An entrance screen controls entry to the presentation; it is not a password or privacy barrier. Uploaded media can have a direct address that remains reachable even after its reference is removed from a page.
Community templates store the title, description, cover, tags, author identifier, visibility and selected design settings you share. Public templates and their included media may be visible to other users. Private visibility is a feature setting, not a promise that previously public copies can be recalled.
4.Visits, likes and technical information
The application records aggregate profile views. These are visit totals and are not a verified count of unique people. Likes and dislikes associate a reaction with a secret-hashed network identifier so duplicate votes from the same network do not add extra reactions. Template likes and favorites are associated with the signed-in account.
Hosting, DNS, object-storage and payment providers may process connection information such as IP addresses, request headers, browser information and timestamps to deliver the service, prevent abuse and investigate failures. Provider logging and retention depend on the deployment and provider configuration. When enabled, Cloudflare Turnstile processes browser and connection information to verify sign-in requests. The application validates the verification token on the server.
We do not claim that activity counters identify a particular visitor. Avoid interpreting counts or public presence data as proof of who viewed a page.
5.Cookies and browser storage
The application uses a narc_session cookie for sign-in, a short-lived narc_oauth cookie to validate the sign-in flow, and an optional 15-minute narc_security cookie after a Cloudflare Turnstile security check. Session cookies are configured as HttpOnly; secure production connections use the Secure attribute.
The editor uses browser session storage to keep a working draft. Other preferences may remain in browser storage while you use the interface. Clearing cookies signs you out and may require another security check; clearing session storage may remove an unsaved draft.
The application does not include an advertising tracker in its current code. An embedded third-party player or linked service may use its own cookies or storage under that provider’s policy.
6.Widgets, embeds and outside providers
When you configure a widget, narc may request public information from the relevant provider using the account name, user ID, invite or URL you supply. Discord presence can use Lanyard, server cards use public Discord information, GitHub provides public profile data, and Last.fm provides public listening information.
Some responses are temporarily cached to reduce repeated provider requests. Images, covers, embeds and external media may be requested directly by a visitor’s browser, which allows the destination service to receive connection information. Providers can change or stop their APIs at any time.
A sign-in connection and a public widget connection are separate. Removing a widget from narc does not delete the outside account or its public information. Use the provider’s own controls to change what it publishes.
7.Payments and Premium
When enabled, xohuspay processes checkout. narc stores an account association, order reference, checkout session identifier, checkout address, payment status and relevant timestamps to confirm a purchase and provide Premium. The application does not collect or store full payment-card numbers.
The payment provider handles the payment information you submit to it under its own policies. Order records may need to remain for reconciliation, disputes, fraud prevention or legal obligations even when other profile information is removed. For billing help, email [email protected] with the order reference rather than payment credentials.
8.How information is used and shared
Information is used to authenticate you, save and deliver your profile, serve uploads, show the widgets you select, operate templates and reactions, verify custom-domain control, confirm purchases and respond to requests.
Publishing intentionally shares the content and settings needed to render your page with visitors. Infrastructure providers process data to host the application, database and media. Sign-in and payment providers process the information required for their respective functions.
We may disclose relevant information when required by a lawful request or when reasonably necessary to investigate abuse, protect accounts or resolve a dispute. Requests should be directed to [email protected]. Do not assume public content is private because you did not share its URL widely.
9.Storage and retention
Saved profile information remains in the database while it is needed to operate the account. Uploaded files remain in object storage until removed through an available process or an operator action. Removing a file from a profile does not itself schedule deletion of the stored object.
Sessions expire after their configured lifetime, currently 30 days, and expired session records are cleaned up during sign-in activity. OAuth state cookies have a short lifetime. Cached widget responses expire or are replaced as the application runs.
There is no single fixed retention period for every record in the current deployment. Infrastructure backups, operational logs and order records can have different retention needs. For a specific deletion request, contact support. Deletion cannot remove copies that other people or external services have independently retained.
10.Your choices and requests
You can edit your public profile, remove links or widget references, change media selections from the dashboard. Saving those edits changes what the profile displays. You can also sign out and clear local browser storage.
For access, correction, account closure or deletion of uploaded files that you cannot handle through the dashboard, email [email protected]. Specify the relevant account or profile address and what you need. We may verify control of the account before acting. Do not email passwords or identity documents unless a necessary verification method has been agreed.
Depending on where you live, additional rights may apply to your information. Requests will be considered under the rules that apply to the service and your request. Some information may need to remain to resolve payments, protect security or satisfy legal obligations.
11.Security and children
To reduce artificial views and votes, we store a secret-hashed network identifier. IPv6 addresses are grouped by network. Shared networks may be counted as a single visitor. These identifiers remain until the related records are deleted. Raw addresses are not stored in these counter records.
The service uses server-side authorization checks, hashed session tokens and HTTPS when correctly deployed. No online system can promise absolute security. Protect your sign-in provider, avoid publishing private details and report suspected account misuse promptly.
The service is not designed to collect personal information from young children. If you believe a child has supplied information without appropriate permission, contact [email protected] with the affected profile address so the situation can be reviewed. Do not include unnecessary information about the child in an initial report.
12.Contact and policy updates
Questions about privacy, stored information or this policy can be sent to [email protected]. Include enough context to identify the relevant profile, upload or request. We will need to distinguish an account request from a request involving someone else’s public content.
This policy may be updated when features, providers or data practices change. The revision date appears at the top. Material changes will be identified through the service or an appropriate account communication where available.
Questions?
For account help, content reports, billing or privacy requests, email [email protected] with your profile address. Never include passwords, sign-in codes or full payment details.