Privacy Policy

1. Introduction

This Privacy Policy describes how we collect, use, store, and protect information when you use our service.

2. Information We Collect

2.1 Account Information

• Email address (required for account creation and authentication)
• Name (provided during signup)
• Password (hashed and stored securely, never accessible in plain text)

2.2 Workspace and Content Data

• Workspace names, slugs, and settings
• Links, folders, and their associated metadata (titles, slugs, embed codes, redirect URLs)
• Custom domain configurations
• Workspace member relationships and roles
• Password-protected link passwords (hashed, never stored in plain text)

2.3 Analytics Data

We collect analytics data to help you understand how your links are being used. This includes:

• Event type (view or redirect)
• Link and workspace identifiers
• Request hostname (domain and subdomain)
• Referrer hostname only (not full URLs)
• UTM parameters (source, medium, campaign, term, content) when present
• Country code (when available from edge headers)
• Device type, browser name, and operating system
• Hashed visitor identifier (HMAC of IP address + User-Agent; no raw IP addresses are stored)

Important: We do not store raw IP addresses. Visitor identifiers are hashed server-side using a secret key and cannot be reversed to identify individual users.

3. How We Use Your Information

• To provide, maintain, and improve our service
• To authenticate users and manage access to workspaces
• To display and serve your embedded content and redirect links
• To generate analytics reports for your links
• To enforce password protection on links when configured
• To verify custom domain ownership
• To send account-related emails (confirmation, password reset, etc.)
• To detect and prevent fraud, abuse, and security threats
• To comply with legal obligations

4. Data Storage and Security

We take reasonable measures to protect your data. Your data is stored securely using industry-standard encryption and security practices. We use secure communication protocols (HTTPS) for all data transmission.

Data Retention

• Account data: Retained until account deletion
• Analytics events: Raw events retained for 90 days, aggregated data retained longer
• Deleted links and folders: Removed immediately upon deletion

5. Data Sharing and Third-Party Services

5.1 Third-Party Services

We use the following third-party services to operate our platform:

• Supabase: Database, authentication, and backend infrastructure. See Supabase Privacy Policy
• Vercel: Hosting and deployment platform (if custom domains are configured). See Vercel Privacy Policy

5.2 Data Sharing

We do not sell, rent, or trade your personal information. We only share data:

• With third-party service providers (listed above) necessary to operate our service
• When required by law or to protect our rights and safety
• With your explicit consent

6. Your Rights and Choices

You have the following rights regarding your data:

• Access: View and export your data through the dashboard
• Modification: Update your account information and content at any time
• Deletion: Delete your account, workspaces, links, and folders at any time (contact support for assistance)
• Export: Export analytics data in JSON or HTML format
• Opt-out: Disable analytics tracking (contact support for assistance)

7. Cookies and Tracking

We use cookies and similar technologies for:

• Authentication and session management (required for service functionality)
• Password-protected link access tokens (signed cookies for security)
• Analytics tracking (hashed identifiers, no personal information)

You can control cookies through your browser settings, though this may affect service functionality.

8. Children's Privacy

Our service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.