Legal

1. Terms of use

PRFL lets you claim a username and publish a structured profile page at prfl.net/yourname. The Service is provided “as is,” without warranties of any kind, to the fullest extent permitted by law. We may change, suspend, or discontinue features at any time.

Acceptable use

• Do not use PRFL for illegal activity, scams, or harassment.
• Do not upload malware, content you do not have rights to, or material that exploits minors.
• Do not attempt to break security, scrape at abusive scale, spam accounts, or interfere with other users.
• Profile content (bio, links, images, embeds) is your responsibility. You must have the rights to anything you publish.

Accounts, usernames & moderation

• You are responsible for keeping your password and 2FA credentials secure. There is currently no email-based password recovery.
• Free usernames require periodic keep-alive (captcha). Missed keep-alive can suspend your public page and, after a further period, allow others to claim the username.
• We may rename, reclaim, or reserve usernames (including for brand or safety reasons).
• We may ban, suspend, unpublish, or delete accounts or content at our sole discretion, with or without notice, including for violations of these terms, abuse, legal risk, or operational needs. Banned users lose access to the Service; public profiles of banned accounts are not shown.

Liability

To the maximum extent permitted by law, PRFL and its operators are not liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, profits, or goodwill arising from your use of the Service. Your sole remedy for dissatisfaction is to stop using PRFL and delete your content where the product allows.

2. Privacy — what we store

We store only what is needed to run accounts and profiles. We do not sell your personal information, and we do not sell or rent user lists to advertisers or data brokers.

Account & security

• Username and display username
• Password (stored as a secure hash — we cannot read your password)
• Optional two-factor authentication secrets and backup codes (encrypted/handled by the auth system)
• Session data (including approximate IP and user agent when you sign in, for session security)
• A synthetic internal email address used by the auth system (PRFL does not require a real email address today)
• Ban status and reason if an administrator takes moderation action
• Limited operational audit records (for example bans, username changes, keep-alive renewals)

Profile content you provide

• Display name, bio, ordered links
• Avatar and optional background images you upload
• Optional anthem / media URL (and derived embed metadata for supported platforms)
• Publish state and related timestamps
• Free-username keep-alive timestamps and status (active / grace / suspended)

What is public

When you publish a profile, the content you chose to show (name, bio, links, images, anthem embed, username) is visible to anyone with the URL. Unpublished profiles are not publicly listed and return as not found to others. There is no public directory or search of all users in the MVP.

Captcha

Registration and free-username keep-alive use hCaptcha (or equivalent) to reduce abuse. Completing a captcha means the captcha provider processes the interaction under their privacy policy. We receive a verification result, not a full dossier of your browsing history from them.

Sharing & disclosure

We do not sell your data. We do not disclose your account or profile data to third parties for their marketing. We may process or expose data only as needed to:

• Operate and secure the Service (including infrastructure providers)
• Show published profiles to visitors you share links with
• Comply with law, valid legal process, or urgent safety needs
• Enforce these terms and protect the Service and users

Embedded media (for example Spotify or YouTube players on a published profile) is loaded from those platforms when a visitor views the page; those platforms may collect data under their own policies. That is not PRFL “selling” your data — it is a consequence of linking or embedding third-party content you chose.

3. Infrastructure (Railway & others)

PRFL is hosted on Railway (application, PostgreSQL database, and file storage for uploads). Data you provide is stored and processed on Railway’s systems in order to provide the Service.

Use of the Service therefore also depends on Railway’s platform. Railway’s own terms and privacy practices apply to their processing as a hosting provider. Review Railway’s documentation and legal pages (including their terms of service and privacy policy) at railway.com. Other limited processors (for example hCaptcha for bot protection) similarly process data only as needed for their function under their terms.

We do not control every subprocess of cloud infrastructure. Outages, backups, and physical security of data centers are governed by those providers’ practices.

4. Built with AI

PRFL was designed and developed with substantial assistance from artificial intelligence tools (code generation, iteration, and documentation). Humans remain responsible for operating the Service, moderation decisions, and these policies. AI assistance does not change who is accountable for how the product is run or for your obligations as a user.

Profile content you upload is not used by PRFL to train public third-party AI foundation models as part of a data-sale or data-sharing program. Operational use of AI tooling by maintainers (for example to debug or improve the product) is separate from selling user data.

5. Age

The Service is not directed at children under 13 (or the minimum digital consent age in your jurisdiction). Do not create an account if you are below that age.

6. Changes

We may update this page as the product evolves. Continued use after changes are posted constitutes acceptance of the updated terms. Material changes may be noted by updating the “Last updated” date above.

7. Contact

For questions about these terms or your data, contact the operator via the channels published on the Service or the project repository associated with PRFL. For account bans or abuse reports, use the same contact path or an administrator if one is available.