Last updated 25 October 2026.
This policy covers ender.bio, its dashboard, the Ender Capes shop at ender.bio/capes and its giveaways, and the parts of api.enderphone.cloud that run them. "We" means EnderBio. Questions or requests go to connerfolla@gmail.com.
What we collect and why
Your EnderBio account
- Email and password. To sign you in and send sign-up and reset codes. The password is stored only as a salted scrypt hash.
- Your page. Your name, the text, links, images and settings you add. Your page is public: that's what it's for.
- Accounts you link. When you prove a Discord, GitHub, Twitch, osu! or Steam account, we keep its ID and name, and nothing else. The access token is used once and thrown away. Linking an EnderPhone account keeps its Minecraft name and ID.
The cape shop
- Your email and your order. To send your code and so you can find your order again.
- Payments are handled by Stripe. We never see or store your card details. Stripe tells us whether a payment went through.
Giveaways and Google sign-in
To enter a cape giveaway you sign in with Google, so we can check that you subscribe to our YouTube channel. We ask Google for the openid and youtube.readonly permissions and use them only for this:
- Your Google account ID, so each YouTube account enters once.
- Your YouTube channel name, shown publicly as the winner's name if you win.
- Whether you subscribe to our channel. We ask YouTube when you sign in and again when you enter.
- The email you give for your code, so each email enters once and winners get their code.
The access token Google gives us is kept in memory for at most an hour, then forgotten. We don't read your videos, comments, other subscriptions or anything else on your account. We don't sell this data, use it for ads, or give it to anyone. You can remove our access at any time at myaccount.google.com/connections.
EnderBio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Giveaways use YouTube API Services; see the Google Privacy Policy.
Visits
We count visits to our pages without cookies or trackers. A small script sends the page's address and the referring site. We keep the page path, the referring site's name, the device type (phone, tablet or computer) and the country. We never store your IP address: a visitor is counted with a code that changes every day and can't be traced back to you. Visit counts are deleted after 400 days.
Cookies and storage
- eb_session, to keep you signed in to EnderBio.
- Short-lived cookies that only exist while you sign in with another service, to check the sign-in started here.
- Your browser's own storage, for your basket, your giveaway sign-in (gone when you close the tab) and settings like dismissed banners.
No advertising or tracking cookies.
Who else sees it
- Stripe processes payments.
- Resend sends our emails (codes, orders).
- Google handles Google sign-in and answers the YouTube subscription check. Our pages load fonts from Google Fonts.
- Discord, GitHub, Twitch, osu! and Steam, only when you choose to link one of them.
- OVHcloud hosts our servers.
We don't sell personal data. We'd only share it beyond this if the law required it.
How long we keep it
- Your account and page: until you delete them from the dashboard.
- Orders: kept as a record of what was sold.
- Giveaway entries: kept with the giveaway, so its results stay checkable.
- Visit counts: 400 days.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it, by emailing connerfolla@gmail.com. You can delete your EnderBio account yourself from the dashboard. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.
Age
You must be 13 or older to make an account, buy from the shop or enter a giveaway.
Changes
If this policy changes, we'll update it here and change the date at the top.