Terms

Anyone with an email address they can receive mail at. One account per person and one handle per account (plus up to ten aliases). A handle can be anything that works as an address: there is no word filter. It does not change once taken, unless it is banned (see below), in which case you pick a new one or use one of your aliases.

You are responsible for what happens under your account. Do not share your password. If you think somebody else is in it, change it.

Anything illegal where you are or where this site is hosted. Sexual content involving minors, of any kind, in any form. Content that exists to harass a specific person. Malware, phishing, or links that pretend to be something they are not.

Impersonating somebody else, or presenting yourself as part of mutate.lol when you are not.

Pictures for your profile (avatars, backgrounds, badges, link icons and custom cursors) are checked automatically: one showing nudity or sexual activity is refused, and the same image is refused on sight from then on. Only that image is affected, never the account.

You keep whatever rights you already had in what you upload. You are confirming you have the right to upload it, and giving this site permission to store it and show it on your page. Nothing more than that.

Files on the file host can be up to 1 GB, with 1 GB of big-file space per account. A one-time link, an expiry or a password is yours to set; a file you delete, or that deletes itself, is gone for good and cannot be restored.

A handle can be temporarily shut down: it shows that the owner of the handle is being contacted, while your page stays reachable at your other names. It can be banned: it leaves mutate.lol for good, nobody can register it or use it as an alias again, and if it was your main handle you pick a new one (or one of your aliases) the next time you sign in. A page can be taken down and a whole account can be suspended; a suspended profile returns the same page as a name nobody has.

For anything unlawful, or anything involving a child, there is no warning and no appeal, and it is reported.

If you have an account: your email address, a hash of your password, your username and everything you put on your page (text, pictures, music, links, settings), your aliases, and, only if you turn them on, your two-factor secret (with its recovery codes kept as hashes) and your linked Discord id, handle and picture. The date you agreed to these terms is kept too.

About your page's visitors: a running total of views, the total for each day, and the total from each country. Totals only: there is no record of an individual visit, and no address, city or browser behind any of it.

Short-lived, to keep the site working: rate limits and the “here now” count each use a salted hash of the visitor's address, which cannot be turned back into the address and is gone within minutes. The address itself is never written down.

Security blocks: an address caught probing the sites for weaknesses is blocked from mutate.lol, status.mutate.lol and preinfection.lol for a year. Only a salted hash of that address is kept, never the address.

In your own browser, not on this site: the sign-in cookie (only if you sign in), a one-day cookie per profile so refreshing does not count as a second view, whether the dashboard sidebar is open and where it was scrolled, and, for each profile you visit, whether you muted its music and how loud you set it, so the page remembers your choice next time. That last one never leaves your device; clearing your browser's data for this site forgets all of it.

Passwords are never stored. Only a PBKDF2 hash with a random salt and a secret pepper that lives in Cloudflare's encrypted secret store rather than in the database, so even a stolen copy of the database cannot be used to work out anybody's password. Nobody can read yours, including whoever runs this site.

You can remove anything you have added to your page at any time. Ask and the account goes with everything on it.

An account that never verifies its email is deleted within a day, and its username goes back into circulation.

This is free and it is run by one person. It may be down. Something may break. A feature may change or go away. Keep your own copy of anything you would be upset to lose.

Live Discord status has ten slots because that is what the free tier pays for. Holding one is first come, first served, and is not guaranteed to anybody.

Signing up requires confirming that you are at least 13. That is the floor this site sets and it is not negotiable: services that let under-13s create public profiles take on obligations, in the US under COPPA and in the UK and EU under the equivalent rules, that a site of this size cannot meet responsibly.

If your country sets a higher age of digital consent than 13, that higher age is the one that applies to you. In parts of the EU it is 16.

The check is a declaration, not a verification. This site does not ask for documents or scan anybody's face, because holding that kind of data would be a far larger risk to you than the problem it solves. If an account is found to belong to somebody under the floor, it is removed along with everything on it.

Cloudflare serves this site and holds its database, so they process what is stored. Resend sends the verification code, so they see the address it goes to. Those two are unavoidable. The optional ones are below.

Fonts are the case worth explaining. A profile can use any of 1,825 Google Fonts, but your browser never contacts Google: the stylesheet and the font files are fetched by this site and served from it. Google sees Cloudflare asking for a font. It does not see you, your address, or which profile you were reading.

If you add your Discord user id, this site asks Discord for your account's badges and decoration, and asks Lanyard (lanyard.rest) for your status. Avatar decorations come from avatardecoration.com and discord-decoration.art. The same rule holds for every one of them: the request is made by this site and the result is served from it, so a visitor to your page never contacts any of them.

There is no analytics script, no advertising, no tracking pixel and no third-party embed anywhere on a profile page.

Connecting Discord is optional and everything works without it. If you do, this site stores your Discord id, handle and avatar hash, and asks Discord to add you to the server so the bot can see your status.

Only your status word is read, and only while you have the switch on: online, idle, do not disturb, or offline. Not what you are playing, not what you are listening to, not anything you have said. Turn the switch off and the bot stops reading you at all.

One Discord account can be connected to one profile. Wearing somebody else's is not possible, because the connection is made through Discord's own authorisation rather than by typing an id.

A username is yours while your account exists. It is not property, it cannot be sold, and a request to transfer one between accounts will be refused.

Names that impersonate this site or its staff are held back and cannot be registered. A handful of others are held back because they are already pages here.

If an account is deleted its username returns to circulation, and somebody else may take it. Nothing about a deleted profile is kept or restorable.

Anything that changes what you agreed to is written in the changelog with a date on it, on the same day it ships. There are no silent edits to this page.

Continuing to use the site after a change is how the new version is accepted. If you do not accept it, delete the account; nothing is held back on the way out.

If a page on this site breaks these rules, use the report page, which goes straight to the owner. Include the address of the page. Anything involving a child is acted on immediately. What the site keeps about you is set out in full in the privacy policy.