Privacy Policy

1. Data we collect

• Account data — your email address and any name you provide.
• Link data — the links, destinations, campaigns, and any recipient details you create or upload.
• Click analytics — when a link is clicked we record a timestamp, a hashed (non-reversible) form of the visitor's IP, approximate location (country/region/city), and device, browser, and OS. We do not store raw IP addresses.
• Billing data — handled by Stripe; we store a customer reference and plan, never card numbers.
• Cookies — an essential session cookie for sign-in, and optional analytics cookies (only with your consent — see below).

2. How we use data & legal bases

• To provide the Service and resolve your links — performance of our contract with you.
• To produce the analytics that are the Service's core purpose — contract / legitimate interests.
• To secure the Service and prevent abuse (rate limiting, hashing IPs) — legitimate interests.
• To take payment and manage subscriptions — contract / legal obligation.
• To run product/website analytics via cookies — your consent.

3. Cookies & consent

We use a strictly necessary cookie to keep you signed in, which does not require consent. For analytics we use Google Consent Mode: we set no analytics cookies until you accept via our cookie banner. Before you choose, we may measure aggregate traffic using anonymous, cookieless signals (no cookies and no identifiers). Accepting enables full analytics cookies; declining keeps analytics cookieless. You can change your choice at any time using the "Cookie settings" control.

If you arrive from one of our ads (for example on Reddit), we store a single first-party ad-attribution token — a random click id, not personal data — so we can measure whether that ad led to a sign-up. It is used solely for our own ad measurement, is never shared for cross-site advertising profiling, and expires automatically.

4. Recipient data you upload

When you use individualised tracking, you may upload details about your recipients. For that data you are the controller and we are your processor: you are responsible for having a lawful basis and for informing your recipients as required. We process it only to provide the Service to you.

5. Sharing & processors

We do not sell personal data. We share it with service providers who process it on our behalf:

• Supabase — database hosting.
• Vercel — application hosting and delivery.
• Twilio SendGrid — transactional and contact emails.
• Stripe — payment processing.
• Upstash — caching and rate limiting.
• Cloudflare — DNS, custom-domain routing, and edge delivery.
• Google Analytics — website analytics; cookieless until you consent, full analytics after.

Business customers can review our Data Processing Addendum for the full sub-processor list and processing terms.

6. International transfers

Some providers process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

7. Retention

We keep account and link data for as long as your account is active. Aggregated analytics may be retained longer; detailed click records are kept only as long as needed for the Service and then deleted or further aggregated. We delete data when it is no longer needed or on a valid request.

8. Your rights

Subject to law, you may request access to, correction, deletion, or a copy of your personal data, object to or restrict certain processing, and withdraw consent. To exercise these rights, contact us. You may also complain to the UK Information Commissioner's Office (ICO).

9. Security

We use encryption in transit, hashed IPs, hashed API secrets and passwords, and access controls. No system is perfectly secure, but we work to protect your data and will notify you of a breach where required.

10. Changes & contact

We may update this policy; material changes will be notified in the Service or by email. For any privacy question or request, use the contact page.