Privacy Policy
Effective October 12, 2026
guilty.bio ("we", "us") is a fan-made community website based at 784 Easton St, Los Angeles, CA 1183. You can contact us at contact@guilty.bio. This policy explains what information we collect, how we use it, and the choices you and your parents have. guilty.bio may be used by children under 13, so it also explains how we follow the U.S. Children's Online Privacy Protection Act (COPPA).
What we collect
| Information | Who | Why |
|---|---|---|
| Username and password (passwords are stored only as a salted scrypt hash, never in readable form) | Everyone | To run your account. Your username is public: it's shown on your profile and games, and logged-in players can find it with People search. |
| Date of birth | Everyone | To know whether Privacy Mode applies. It can't be changed after sign-up. |
| Avatar settings, items you own, B$ and ticket balances, membership, codes you've redeemed | Everyone | To run the site's features. Logged-in players can see your avatar (body colours and catalog items you wear), badges, membership badge and limited items on your profile. |
| Your friends, friend requests and who you follow | Everyone | To run friends and following. Logged-in players can see your friends, and how many followers and followings you have, on your profile. |
| Private messages and chat you send to friends | 13 and over only | Delivered only to the friend you send them to. Admins read a message or chat line only if the person who received it reports it. |
| Games you create (name, genre, and for players 13 and over a description). These are public. | Everyone | To list your games on the site |
A session cookie (bh_session) | Everyone | To keep you logged in. It's the only cookie we use. |
| Bio, feed posts, email address, Discord name, social network links, country, gender, if you choose to add them | 13 and over only | Your bio is shown on your profile to logged-in players; the rest only on your own settings pages. We don't send emails and don't verify email addresses. |
| Your IP address | Everyone | Kept in memory for about a minute to limit repeated login attempts, and in our hosting provider's request logs |
Some features (groups, forum posts and clothing you upload) are currently saved only in your own web browser's storage and are not sent to us. Clearing your browser data removes them.
Children under 13
When someone says at sign-up that they're under 13, their account is put in Privacy Mode:
- We only collect what's needed to run the account: a username, a password, a date of birth, avatar settings, game names and the session cookie. COPPA allows this kind of information to be collected without a parent's consent because it's used only to support the site's internal operation.
- Our server refuses to store an email address, bio, feed posts, social links, country, gender or game descriptions for the account, and those settings are hidden.
- They can add friends and follow other players, which shares only usernames and avatars, but they can't send or receive private messages or chat, with anyone.
- We ask players not to use their real name as a username or game name. Admins remove games and accounts that contain personal information.
- We never use a child's information for advertising, profiling or any purpose besides running guilty.bio, and we don't share it with anyone except the service providers listed below.
Parents: you can ask us to show you the information we hold about your child, to delete your child's account, or to stop collecting information from your child. Email contact@guilty.bio with your child's username. We'll ask you to help us confirm the account belongs to your child before acting on the request. Deleting the account removes it and all of its games.
If you believe we've collected personal information from a child under 13 beyond what is described here, please contact us and we will delete it.
How we use information
Only to run guilty.bio: logging you in, saving your avatar and items, listing games, keeping the site secure, and enforcing our Terms of Use (for example, banning accounts that break the rules). We don't sell, rent or trade personal information, and we don't use it for advertising.
Who else receives information
- Render hosts our website and database, and uses Cloudflare to deliver it. They process data only to provide that service.
- Google Fonts supplies the site's font, and jsDelivr supplies the 3D avatar viewer's code. Your browser downloads these files directly from them, so they receive your IP address and browser details. We don't send them any account information.
- We may disclose information if the law requires it, or to protect the safety of our players.
How long we keep information
- Account information is kept until the account is deleted.
- Login sessions expire after 30 days. Play links expire after one minute and are deleted within a day.
- Chat is deleted after 30 days. Private messages are kept until the sender's or the recipient's account is deleted. Reports of messages are kept so admins can review them.
- We keep automatic backups of the database to recover from mistakes. Each backup is deleted after about 7 days, so deleted accounts disappear from backups within that time. Our host may also keep short-lived disk snapshots.
- IP addresses used for rate limiting are kept in memory for about a minute.
Security
Passwords are hashed, session cookies are HTTP-only and sent only over HTTPS, and only a hash of each session token is stored. No system is perfectly secure; if we learn of a breach affecting your information we will tell affected users as the law requires.
Your choices
You can change your avatar, bio and settings at any time. To delete your account, or for any other privacy request, email contact@guilty.bio.
Changes
If we change this policy we'll update the date at the top. If a change affects how we handle children's information, we'll make sure it still follows COPPA before it takes effect.