Y2K PROFILE
Privacy Policy
Last updated: 12 November 2026
Your profile is built in your browser. There is no account, profile database or profile-upload service.
Who runs this site?
Y2K Profile at y2kprofile.kooheji.dev is an independent project by kooheji.dev. For privacy questions or requests, contact y2kprofile@kooheji.dev.
Profile information and browser storage
Names, biographies, details, friend lists, image and media URLs, and appearance settings are processed locally to generate your profile. Drafts, saved profiles, saved designs, recovery copies and your external-media preference use this browser's local storage. They are not sent to a Y2K Profile profile server. Backup files you restore are read locally.
This storage supports the features you request. It is not used for advertising or analytics. It is not encrypted by the application and may be accessible to someone who can use your browser or device. Only enter information you are comfortable publishing; take particular care with sensitive details and other people's information.
Cookies and optional external media
The application does not set advertising or analytics cookies and does not include analytics or advertising scripts. Browser storage is still a storage technology, even though it is not a cookie.
User-linked external images, backgrounds, audio link checks, Ruffle and video embeds are blocked in the builder until you select Allow external media. Selecting Keep media off leaves editing, saving and exporting available. Use External media: on/off in the sidebar to change your choice. Withdrawing consent removes media from the builder and stops further automatic loads; it cannot recall requests already received by another provider. Your choice is stored on this device for up to 180 days. If storage is unavailable, it applies only to the current visit.
When allowed, these providers may receive your IP address, browser information and the resource you request, and embedded providers may use their own cookies or storage. Y2K Profile does not control their practices. Links you choose to open connect directly to their destination even while preview media is off.
Bundled fictional demo photos are served with the project assets and can appear while external media is off. They do not contact Unsplash or another photo provider. Optional videos and the Ruffle runtime still require your media choice.
Third parties and recipients
| Provider | When and why | Policy |
|---|---|---|
| InMotion Hosting | Delivers this site and shared profile assets. Technical requests may include IP address, browser details, requested path, time and error/security information. | InMotion privacy |
| Unsplash and image/audio hosts you choose | Provide optional random landscape cover presets or your linked media after external media is allowed. Your selected URLs determine the hosts. | Unsplash privacy; each selected host's own policy |
| jsDelivr | Delivers the pinned Ruffle runtime when the MySpace player loads and external media is allowed. A separately configured theme CDN, if used, also receives asset requests. | jsDelivr privacy |
| YouTube / Google and Vimeo | Provide videos you add. Video players load only after media permission in the builder. Exported video players require their visitor to click Load video. YouTube uses its privacy-enhanced embed domain; that does not mean no personal data is processed. | Google privacy; Vimeo privacy |
| Email provider | Processes messages if you choose to contact us. We receive your address, message and any information you include. | Your mail service's policy and the operator's mail hosting arrangements |
Application fonts and interface assets are served locally. There is no automatic Google Fonts request. We do not sell profile data or run a mailing list. We may disclose information where required by law or necessary to address abuse or security incidents.
Purposes and legal bases
Where GDPR or comparable rules apply, we rely on the following bases for the processing described here:
- Requested service: local profile editing, saving, recovery and export to deliver the features you request (GDPR Article 6(1)(b), where applicable). Essential browser storage supports those requested functions.
- Consent: optional external media connections and any non-essential storage used by embedded providers (Article 6(1)(a)). You can withdraw this choice without losing the editor.
- Legitimate interests: necessary site delivery, technical security, abuse prevention and answering enquiries (Article 6(1)(f)). You may object where this basis applies.
- Legal obligation: handling information where a specific applicable law requires it (Article 6(1)(c)).
We do not use automated decision-making or profiling to make decisions about you.
Retention and deletion
Local work and recovery copies remain until you delete them, clear this site's browser data, or your browser removes them. Deleting a saved profile does not automatically delete its recovery copies or downloaded files. Download important editable backups first. Use Data & backups to manage recovery copies. Clearing this site's browser data removes local work and the media choice; it does not delete HTML or JSON downloads or profiles you have published.
Enquiries are kept for as long as needed to answer and resolve them, and longer only where required to meet legal obligations or address a dispute. Hosting logs follow the host's configured retention and security requirements. Contact us for details about technical records associated with a request.
International processing
Hosting, email and external-media providers may process technical information outside your country, including in the United States. Their policies explain locations and safeguards. Choosing an external host or embedded provider connects you to its service. Where applicable law requires transfer safeguards for processing arranged by the operator, those safeguards must apply; a media preference does not replace those requirements.
Security
The site is designed for HTTPS, restricts preview frames with a sandbox and content security policies, validates links, and escapes profile text rather than accepting executable HTML. No API keys are required in the frontend. These measures reduce risk but do not guarantee security or continued availability. Browser data and downloads are not encrypted by the app; protect your device and backups.
Your rights and contact
Depending on applicable law, you may have rights to access, correct, erase, restrict or export personal data, object to processing, and withdraw consent. Contact y2kprofile@kooheji.dev. We respond within the period required by applicable law; under GDPR this is normally one month, subject to permitted extensions. You may also complain to your competent data protection authority. We cannot remotely access or erase your browser-only drafts; you control them through the editor and your browser's site-data settings.
Exported profiles and changes
Exports contain the information and URLs you entered. They may be public when you publish them, and images and audio can contact their hosts when opened. The builder's media choice is not a consent record for your profile's visitors. As publisher, review your hosts and embeds and provide any notices or consent controls your own page requires. This policy covers the generator, not independently hosted exports.
Material changes to data use will be reflected here. We will request a new choice before introducing new optional media purposes.