Privacy Policy
What HOKORA knows about you, why, how long it keeps it, and how to take it back. No ads, no selling, no trackers.
This is a translation. The French version is the one that applies. Read the French version
Who is responsible
The data controller is HOKORA’s publisher, Baptiste Bourut EI (Studio Baoul), reachable at [email protected]. Full details are in the legal notice.
What we collect, and why
Your account: email, password (kept hashed by Supabase), username, the version of the terms you accepted, and what brought you if you signed up from HOKORA (the page where you clicked “Make yours on HOKORA”, an entry page or a shared template)
- Creating and securing your account, signing you in; knowing which pages bring new sign-ups
- Performance of the contract (the Terms); legitimate interest for the measurement
- Until the account is deleted
Your Discord account, if you link it or sign in with it: its ID, your username, display name and avatar (never your servers or your messages); the email Discord provides, if you sign in with it
- Show the Discord badge on your page, sign you in, and give you the HOKORA roles on the Discord servers that use them: Discord then receives whether your page is published, how many of your templates are approved and, on the HOKORA server, whether you hold a Founder seat (the “Fondateur” role)
- Your consent, when you link the account; performance of the contract for signing in
- Until you unlink Discord or delete your account. No Discord token is kept
Your Discord status, if your account is linked, your page shows a Discord block and you are a member of the HOKORA Discord server: online or not, the game you’re playing, the track playing on Spotify, your custom status
- Showing it in the Discord block of your page, if you add one
- Your consent: linking Discord, adding the block and joining the HOKORA server
- Only the latest state is kept, replaced at every change; erased as soon as you unlink Discord, remove the block or leave the server
Your page: blocks, words, links, settings, uploaded images
- Showing it to its visitors
- Performance of the contract
- Until you delete them, or your account: images go with it
Your background videos and tracks (paid plans): the file, its format and size, the upload date, and the moderation decision if there is one
- Showing and playing them on your page; checking they play everywhere; applying a takedown
- Performance of the contract
- A file your page no longer uses is deleted at your next upload; the others go with your account. The record of a takedown: as long as your account exists
Your page’s template: the one you pick when you create it or switch (one of HOKORA’s or one from the gallery), with the date; the date you first published; and the HOKORA landing page your sign-up came from, if any
- Knowing which templates get used, and which really help people publish a page, to improve the others; showing the creator of a gallery template how many pages used it — a total, never who
- Legitimate interest (improving the service)
- Until the account is deleted
Your shared templates: their name, description and category, your page’s look and shape when you saved it (without your words, links or photos), a fingerprint of that content, and the review decisions with their reasons
- Showing them at their link and in the gallery; spotting copies; applying a refusal or a takedown
- Performance of the contract (the Terms)
- Until you delete them, or your account. Pages built from a template keep their copy
Views and tries of your templates: the date and, for a view, a fingerprint
- Showing you how many people viewed or tried your template
- Legitimate interest
- 90 days
Your former usernames
- Redirecting links already shared, and keeping anyone else from taking them
- Legitimate interest (protecting your visitors from a hijack)
- 30 days after the change
Visits to the HOKORA site (home, pricing, templates, guides, sign-up…): the page visited, without the rest of the address, the date, the site you came from and a fingerprint
- Knowing how many people discover HOKORA, where they come from and how many go on to create their page, as totals only
- Legitimate interest
- 90 days
Your page’s stats: for a view, the date, the site the visitor came from and a fingerprint; for a click, the link and the date
- Showing you your views, visitors and clicks
- Legitimate interest
- 90 days
Reports: reason, details, fingerprint, and your name and email if you leave them
- Handling the report, answering you, keeping a record of decisions
- Legal obligation (Digital Services Act); legitimate interest
- Fingerprint: 30 days. Name and email: 6 months after the decision, or after the report if it was never decided. The report: as long as the page exists
Your purchases, if you take a paid plan: the plan, its status, its end date and your customer ID at Stripe. Stripe itself receives your name, email, country and payment method; HOKORA never sees your card number
- Taking payment, invoicing, turning your plan on and off
- Performance of the contract (the Terms of Sale); legal obligation for invoices
- The plan: until the account is deleted. Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code)
Technical logs kept by the hosts (IP address, date, page requested)
- Running and securing the service
- Legitimate interest
- According to each host’s policy
The fingerprint is never your IP address. It’s a hash (SHA-256) of the day, the IP address, the browser and a secret key, and it changes every day: it counts roughly unique visitors and slows down bursts of submissions, it can’t follow you from one day to the next. For a report, it leaves the browser out (the day, the IP address and the secret key): switching browsers doesn’t let anyone send more. The IP address itself is never written to our database; of the site a visitor came from, we keep only the domain name.
After a deletion, the host’s automatic backups may keep a copy until they rotate. We don’t sell anything, don’t run ads and don’t build profiles.
If you visit a HOKORA page
- A public page loads no measurement script and sets no cookie. HOKORA’s server counts the visit when the page is requested, with the day’s fingerprint and only the name of the site you came from; a click is counted by the link’s “ping” attribute (which Firefox turns off by default). The page’s owner only sees totals, never who visited. HOKORA’s other pages are counted the same way.
- A shared template’s page (hokora.page/t/…) counts its visits with a one-pixel image served by HOKORA and the same fingerprint: its creator sees a total, never who.
- YouTube and Twitch players only load after you click: before that, no request goes to those services. After, their privacy policies apply. A music track is a plain link to the service that streams it.
- Information from Discord (through the HOKORA bot or Lanyard), Steam or AniList is requested by HOKORA’s server. Their images (avatar, game art, album cover), though, are loaded by your browser from those services’ servers (Discord, Steam, AniList, Spotify for a cover), which then receive your IP address, as with any image.
- Some pages load a cursor effect or an animated background chosen by their owner: those are HOKORA’s own scripts, and they collect nothing.
Who can access it
Only HOKORA’s publisher accesses the data, to run the service and handle reports. Three providers host or carry it, on our instructions:
- OVH SAS (OVHcloud) (France) hosts the server that runs the site.
- Cloudflare, Inc. (United States) carries requests to that server, so it sees visitors’ IP addresses. Cloudflare is certified under the EU–US Data Privacy Framework, and its data processing terms include the European Commission’s standard contractual clauses.
- Supabase Pte. Ltd (Singapore), a subsidiary of Supabase, Inc., stores accounts, pages and images, in the region chosen for the project (see the legal notice). Its data processing terms include the European Commission’s standard contractual clauses.
For a paid plan, payment goes through Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Dublin, Ireland). For what it collects on its payment page and for its own obligations (fraud prevention, financial regulation), Stripe is responsible for its processing: its privacy policy applies. Data may be transferred to Stripe, Inc. (United States), certified under the EU–US Data Privacy Framework.
The identifiers you choose to show on your page (Discord, Steam, AniList) are sent to those services to read their public information. If you link your Discord account, Discord Inc. (United States) receives whether your page is published, how many of your templates are approved and whether you hold a Founder seat, for the HOKORA roles; for everything else, its privacy policy applies. Data may also be disclosed to authorities that request it under the law.
If you report a page
Your name and email are optional. If you leave them, they’re used to acknowledge your report and tell you the decision, then erased 6 months after it — or 6 months after your report if no decision was ever made. They’re never shown to the page’s owner.
Your rights
- Access, correct or erase your data: most of it happens in the studio (Account), where you can also delete your account.
- Take it with you: the studio’s export gives you your whole page, in a file.
- Restrict or object to a processing, especially the ones based on legitimate interest.
- Decide what happens to your data after your death (article 85 of the French Data Protection Act).
For anything else, write to [email protected]: we answer within one month. If you’re not satisfied, you can complain to the CNIL, the French data protection authority (cnil.fr), or to the authority where you live.
Children
You must be at least 15 to create a HOKORA account. If you learn that an account belongs to a younger child, write to us: we’ll delete it.
Security
Traffic is encrypted (HTTPS) and passwords are kept hashed by Supabase. Every write goes through HOKORA’s server, which checks each one: a session can’t change the database directly. An image is checked on upload (format read from the file, 4 MB at most).
Changes
If this policy changes, the new version is published here with its date; a significant change is announced in advance.