Human Readable Privacy Policy

      We only store (and keep) the data you can see/access in your dashboard.
      We only use it to display your profile the way you configure it.
      We **never** sell or share your data with any third party.

Data we collect

Per social account you connect (Discord, GitHub, GitLab, Codeberg, Twitch, Steam, X, Bluesky)

  • Your unique identifier provided by the platform (for Bluesky this is your DID)
  • Your display name / handle on the platform
  • Your profile picture, display name and bio as provided by the platform (only fetched once, when your account is first created)

What you enter or upload yourself

  • Your display name and bio
  • Your public link, e.g. goatl.ink/<slug>, in the capitalization you choose
  • Any avatar or background images you upload
  • Custom themes (colors) you create
  • Titles and subtitles you give your link groups
  • Any custom links you add (a label, an optional subtitle and a URL you provide)

If you add a custom link

  • The favicon of the site you're linking to (fetched once, when you add the link) — shown next to it on your profile
  • Custom links are always marked "Unverified" on your public profile, since — unlike a connected account — they're just a URL you typed in and aren't proven to belong to you

If you feature a Discord server

  • The name and icon of servers your Discord account is an admin of, so you can pick which ones to feature
  • An invite link for the servers you decide to feature (if you provide one)

If you feature repositories (GitHub, GitLab, Codeberg)

  • The list of your public repositories is fetched from the platform's public API so you can pick which ones to feature — it's only cached for a few minutes and never stored
  • Only the repositories you pick are stored: their name, URL, description, star count and archived state, as shown on your profile

Public statistics shown on your profile

When someone views your profile, we fetch a small public statistic per exposed connection from the platform's API and show it under the connection — e.g. follower counts (Twitch, X, Bluesky, Codeberg, GitHub), repository counts and stars (GitHub, GitLab), your Steam game count, and — while you're streaming — your live Twitch stream's title, game and viewer count. These are cached for up to 10 hours and never stored permanently.

How this data is used

All of the above exists for exactly one reason: to render your profile page the way you set it up, and to let you log in with any of your connected accounts. Each connection has its own visibility toggle — data for a connection is only ever shown on your public profile if you've explicitly marked it as exposed. Nothing is analyzed, profiled, or used for advertising.

Deleting your data

You're always in control. Removing a connection from your dashboard immediately deletes everything we stored for it — including featured servers or repositories, fetched icons, and cached statistics. To delete everything, scroll to the "Danger zone" section at the bottom and click "Delete account". After confirming, your profile, connected accounts, uploaded images, custom themes, and slug are permanently and immediately deleted — this cannot be undone. You're welcome to sign up again afterwards; it starts you off as a brand new account with none of the old data.

Cookies

We use mandatory cookies to store your session so we can identify you when you login.

Third Party Services

  • Cloudflare (May log data like your IP Address when visiting this website) (see their Privacy Policy)
  • The OAuth provider(s) you choose to connect (Discord, GitHub, GitLab, Codeberg, Twitch, Steam, X, Bluesky) — used solely to authenticate you and read the public profile data listed above; we never store the access tokens after login, which also means we're unable to act on your behalf on any connected platform
  • The platforms' public APIs, to look up the public statistics, featured servers and featured repositories described above — no data about you is sent beyond what's needed to make those requests
  • Bluesky's public AppView (public.api.bsky.app), to resolve your handle when you log in with Bluesky
  • Whatever site you link to with a custom link, once, to fetch its favicon — no data about you is sent, only a request for that site's icon

YouTube API Services

If you connect a YouTube channel, goatl.ink uses the YouTube API Services. We make a single read-only request during the connection flow to identify your own channel and store only its public identity: channel ID, title, @handle, avatar and description — used to show a verified link to your channel on your profile and to let you sign in with it again. We do not store Google access or refresh tokens and never access your videos, playlists, subscriptions or any other private data. Because no tokens are kept, we are technically unable to act on your behalf — we can't post, comment, subscribe, or change anything on your YouTube account, only show the public channel identity you connected. Google's handling of your data is described in the Google Privacy Policy. You can revoke goatl.ink's access at any time via your Google security settings. Note that because we don't keep any access tokens, revoking access there doesn't notify us and won't remove the channel data already on your profile — to delete it, simply log in to goatl.ink and remove the YouTube connection in your dashboard, which deletes everything we stored.