Privacy Policy

This policy covers the Toxin link-in-bio site, its account features and the t.toxin.cc link shortener.

Information we process

Discord OAuth provides your account ID, username, display name and avatar. We store information you publish, such as profile details, links, badges, comments, media, optional Discord activity and profile-view counts. Security and moderation records can include sessions, two-factor authentication settings (stored encrypted), reports, warnings, blocked users and action history. When you create an account, we record which version of the Terms of Service and Privacy Policy you agreed to, and when.

We also store the settings for features you choose to use, for example: link schedules, groups and 18+ confirmation settings; shortened URLs; Minecraft or Roblox usernames for your character; the Twitch or YouTube channel for your live status; comment approval and word filter settings; badge order; analytics goals; the profiles you follow and your Follow button settings; your poll votes; brand profile requests; and a Discord webhook URL for the weekly analytics digest. The webhook URL is kept private and is never shown on your profile or sent back to your browser.

Public content

Your profile and approved comments are public. Visitors can see content you choose to show, including your profile UID, social links and follower count. Admins may feature your profile URL and avatar in the showcase on the Toxin homepage. If you require approval for comments, a comment waiting for approval is only visible to the person who wrote it and to you.

Followers, polls and announcements

When you follow a profile, its owner can see your name and profile in their followers list; other visitors only see the follower count. Followers get notifications when a profile they follow adds a link or page, or sends an announcement to its followers. Poll results only show totals; nobody can see how you voted.

Verified links

Verified links are optional. If you choose "Verify with Discord" in the dashboard, Discord shares the accounts you have connected and verified there (such as Twitch, GitHub or X). We store the platform, account ID and username of those verified connections until you verify again or remove them. We only use them to show a check mark on profile links that point to one of your own accounts; the list itself is never shown on your profile. You can remove them at any time in the dashboard.

Brand profiles

If you request a brand profile, we store the brand name, profile URL and presentation you send for our team to review. An approved brand profile is a separate public profile managed from your account. It does not show your personal profile, name or UID, but our team can see which account it belongs to.

Profile visitors and analytics

When someone views a profile, clicks a profile link or opens a shortened URL, we record daily totals: the number of views or clicks, the kind of site the visitor came from (such as TikTok, Instagram or Google, a tag like ?src=, or simply "other"), their approximate country, and for shortened URLs the device type (desktop, mobile or tablet). The country is provided by our hosting provider based on the visitor's IP address; the IP address itself is not stored in these totals.

To count unique visitors, we store a one-way keyed hash of the visitor's IP address (or of their account ID when signed in) for each profile, so repeat visits aren't counted twice. Obvious bots are not counted. Profile owners with Premium can see these totals, but never which individual people visited. Daily totals are kept for up to about 400 days.

Services we contact for your features

Some features need information from other services. These requests are made by Toxin's servers, not by your visitors' browsers, and only send what the feature needs:

• Character showcase: your Minecraft username is looked up with Mojang/Minecraft services, PlayerDB and mc-heads.net, and your Roblox username with Roblox, to show your character.
• Live status: the Twitch or YouTube channel you enter is checked with Twitch or YouTube.
• Link previews: when you save a link, we fetch that page's title, and we get the site's icon from DuckDuckGo's icon service using only the site's domain name.
• Link import: we fetch the link page you ask us to import from.
• Weekly digest: if you add a Discord webhook, your profile's weekly stats and goal updates are posted to that Discord channel.

Badges and profile cards on other websites

If you put your Toxin badge or profile card on another website, visitors to that site load it from Toxin. These loads do not set cookies and are not counted as profile views.

Optional Discord activity

When enabled, status and activity data supplied through our Discord integration may be temporarily shown on your profile. The presence bridge uses a Discord bot behind the scenes. Disabling it stops new display, subject to short-lived caches.

Cookies and local storage

Toxin uses necessary cookies for Discord sign-in, remembered sessions, security checks and account preferences. These cookies are required for signed-in features to work. Toxin also uses your browser's local storage for small conveniences, such as remembering your last dashboard tab or a smoother display mode on slower devices; this stays in your browser. Stripe may set its own cookies when you open its checkout, subject to Stripe's privacy and cookie policies.

Payments

Payments for Premium, donations and custom badge slots are processed by Stripe. Stripe receives the payment and billing information you provide during checkout. Toxin may receive and store limited transaction information such as a Stripe transaction or customer identifier, payment status, amount, currency and the Toxin account connected to the purchase. Toxin does not receive or store your full card number or card security code.

How we use information

We process data to operate profiles and shortened URLs, serve media, show analytics to profile owners, send the digests you set up, apply account preferences, deliver purchases (Premium, the Donator badge and badge slots), show verified link check marks, send notifications, maintain account security, prevent abuse and investigate errors.

Sharing and retention

We do not sell personal data. We only share information with the services listed above as needed for the features you use, or when required by law or necessary to protect users. If we find illegal content, such as child sexual abuse material, we may preserve the related account information and report it to the authorities. Data is retained as needed for the service and moderation. You can delete your account in the dashboard; necessary abuse or legal records may be retained where applicable.

Your choices

You can edit visibility settings, hide your view or follower count, turn off your Follow button, unfollow profiles, disable comments or optional presence, remove your Discord webhook and delete uploaded files. In the dashboard under Account, you can permanently delete your account, which also deletes your brand profile. To have your profile removed from the homepage showcase, contact us through the support server. Depending on applicable law, you may also request access to or a copy of your personal data, or its correction or deletion, through the support server.

Changes

We may update this policy as the service changes and will revise the date above.