Privacy Policy

Effective Date: August 6, 2026

1. Information We Collect
2. How We Use Your Information
3. Cookies & Click Tracking
4. Sharing Your Information
5. Data Security
6. Your Rights
7. Children's Privacy
8. Changes to This Policy

1. Information We Collect

Account Information: When you sign up, we collect your email address and other profile details you provide.
Links & Content: We store the links, profile information, and content you add to your LinkIo page.
Accepted Click Analytics: When a visitor follows a short link, we may retain the click time, link, coarse device/browser/operating-system family, trigger (such as link or QR), the tags the link carried at that moment, and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) present on the link. We do not claim or derive page views, impressions, bounce rate, or destination time-on-page from these events.
Approximate Location: Where our hosting provider supplies it, we may retain the country, region, and city our provider associates with the request. This is derived by our hosting provider from network routing information; we do not perform any location lookup ourselves, and we do not retain the source IP address, GPS, or any device-reported location. Location is unavailable — and therefore not retained — outside our hosting provider's network.
Referring Page: We may retain the hostname and page path of the page that linked to a short link (for example example.com/blog/post). We deliberately discard the query string of the referring URL at the point of collection, because such query strings can contain session tokens, email addresses, or search terms. We never store the full referring URL.
Approximate Visitor Identifier: We use a keyed one-way HMAC derived from request network and browser signals to approximate unique visitors and suppress duplicate clicks. The stored identifier is truncated, is not disclosed to creators, and changes when its independent secret is rotated. New click events do not retain the source IP address, raw user agent, or full referrer URL.
Service and Authentication Data: Better Auth may process account session information, including session IP address and user agent, for authentication and security. Operational logs may contain request/error metadata needed to secure and operate the service, but tracking telemetry is designed not to include visitor identifiers, raw IP/user-agent values, destination URLs, or full referrers.

2. How We Use Your Information

To provide and improve our services.
To personalize your experience.
To analyze usage and performance.
To communicate with you about your account or important service updates (we do not send marketing emails).
To protect against fraud and abuse.

3. Cookies & Click Tracking

Better Auth uses cookies to maintain signed-in account sessions. LinkIo does not use advertising or marketing cookies.
Short-link analytics do not require a visitor cookie. Upstash Redis temporarily stores a pseudonymous duplicate-prevention key for approximately one hour and applies abuse limits. PostgreSQL is the authoritative analytics store; Redis does not hold canonical click history.
Bots, social-preview agents, explicit test traffic, duplicate/limited traffic, requests with ?no_track=1, and requests carrying linkio-no-track: 1 are excluded from creator-facing click analytics.

4. Sharing Your Information

We do not sell your personal information.
We may share data with service providers needed to operate LinkIo, including hosting, PostgreSQL/database infrastructure, Upstash for temporary deduplication and abuse limiting, Resend for account email, and storage infrastructure.
We may disclose information if required by law or to protect our rights.

5. Data Security

We use industry-standard security measures to protect your data.
No method of transmission or storage is 100% secure; use LinkIo at your own risk.

6. Your Rights

You can access, update, or request deletion of your account at any time by contacting us at nishitbaria@gmail.com.
Detailed accepted click events are retained for 12–13 months, according to service configuration, then converted into per-link daily counts and deleted in bounded maintenance runs. These older counts contain no approximate visitor identifier, approximate location, device/browser/operating-system family, trigger, referring page, campaign parameters, or tags — only a per-link daily total. Account and content retention may differ where required to provide the service, meet legal obligations, prevent abuse, or complete requested deletion.
Link creators receive aggregate and sanitized event analytics, and may export them. They do not receive source IP addresses, raw user agents, visitor hashes, or full referrer URLs.

7. Children's Privacy

LinkIo is not intended for children under 13. We do not knowingly collect data from children.

8. Changes to This Policy

We may update this Privacy Policy. We'll notify you of significant changes by email or on our website.

1. Information We Collect

Account Information: When you sign up, we collect your email address and other profile details you provide.

Links & Content: We store the links, profile information, and content you add to your LinkIo page.

Accepted Click Analytics: When a visitor follows a short link, we may retain the click time, link, coarse device/browser/operating-system family, trigger (such as link or QR), the tags the link carried at that moment, and campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) present on the link. We do not claim or derive page views, impressions, bounce rate, or destination time-on-page from these events.

Approximate Location: Where our hosting provider supplies it, we may retain the country, region, and city our provider associates with the request. This is derived by our hosting provider from network routing information; we do not perform any location lookup ourselves, and we do not retain the source IP address, GPS, or any device-reported location. Location is unavailable — and therefore not retained — outside our hosting provider's network.

Referring Page: We may retain the hostname and page path of the page that linked to a short link (for example example.com/blog/post). We deliberately discard the query string of the referring URL at the point of collection, because such query strings can contain session tokens, email addresses, or search terms. We never store the full referring URL.

Approximate Visitor Identifier: We use a keyed one-way HMAC derived from request network and browser signals to approximate unique visitors and suppress duplicate clicks. The stored identifier is truncated, is not disclosed to creators, and changes when its independent secret is rotated. New click events do not retain the source IP address, raw user agent, or full referrer URL.

Service and Authentication Data: Better Auth may process account session information, including session IP address and user agent, for authentication and security. Operational logs may contain request/error metadata needed to secure and operate the service, but tracking telemetry is designed not to include visitor identifiers, raw IP/user-agent values, destination URLs, or full referrers.

3. Cookies & Click Tracking

Better Auth uses cookies to maintain signed-in account sessions. LinkIo does not use advertising or marketing cookies.

Short-link analytics do not require a visitor cookie. Upstash Redis temporarily stores a pseudonymous duplicate-prevention key for approximately one hour and applies abuse limits. PostgreSQL is the authoritative analytics store; Redis does not hold canonical click history.

Bots, social-preview agents, explicit test traffic, duplicate/limited traffic, requests with ?no_track=1, and requests carrying linkio-no-track: 1 are excluded from creator-facing click analytics.

4. Sharing Your Information

We do not sell your personal information.

We may share data with service providers needed to operate LinkIo, including hosting, PostgreSQL/database infrastructure, Upstash for temporary deduplication and abuse limiting, Resend for account email, and storage infrastructure.

We may disclose information if required by law or to protect our rights.

6. Your Rights

You can access, update, or request deletion of your account at any time by contacting us at nishitbaria@gmail.com.

Detailed accepted click events are retained for 12–13 months, according to service configuration, then converted into per-link daily counts and deleted in bounded maintenance runs. These older counts contain no approximate visitor identifier, approximate location, device/browser/operating-system family, trigger, referring page, campaign parameters, or tags — only a per-link daily total. Account and content retention may differ where required to provide the service, meet legal obligations, prevent abuse, or complete requested deletion.

Link creators receive aggregate and sanitized event analytics, and may export them. They do not receive source IP addresses, raw user agents, visitor hashes, or full referrer URLs.

Privacy Policy

Table of Contents

1. Information We Collect

2. How We Use Your Information

3. Cookies & Click Tracking

4. Sharing Your Information

5. Data Security

6. Your Rights

7. Children's Privacy

8. Changes to This Policy

Privacy Policy

Table of Contents

1. Information We Collect

2. How We Use Your Information

3. Cookies & Click Tracking

4. Sharing Your Information

5. Data Security

6. Your Rights

7. Children's Privacy

8. Changes to This Policy