Privacy Policy

What we collect when someone clicks a link

When a visitor opens a short link (linkto.email/r/...), we record: date and time, device class (desktop/mobile/tablet), browser and operating system name, country and city, the referring page, and the browser language. This powers the click analytics shown to the link owner.

We do NOT store the visitor's IP address or full user-agent string. The IP is used in memory only — to derive the country/city and to enforce rate limits — and is then discarded.

How geolocation works

Country and city are derived preferably from a local MaxMind GeoLite2 database on our own server, so the IP never leaves our infrastructure. When that database is unavailable, we may query ipinfo.io over HTTPS with the IP solely to resolve the location; the result is stored, the IP is not.

Account data

Authentication is handled by Clerk (clerk.com), which stores your email and login credentials. Payments are processed by Stripe; we never see your card details. Transactional and lifecycle emails are delivered through Resend. These providers act as data processors.

Links created without an account

If someone asks, on the page of a link created without an account, to reactivate it, we send one reactivation email to the link's destination address — only when the address typed matches the link's. We don't use that address for anything else.

Cookies and analytics

On this website (not on your short links), we use Google Analytics and Microsoft Clarity to understand how visitors use the site: which pages they open, where they click and where they give up. Clarity may record session replays and heatmaps; email addresses and form fields are masked.

In the EU/EEA, the UK, Switzerland and Brazil, these tools only run after you accept the cookie banner. Elsewhere they run by default and you can opt out at any time via “Cookies” in the footer. People who open a short link (linkto.email/r/...) are never tracked by these tools.

When you open a link from one of our emails, your browser stores which email it was and when, for 7 days, so we know which emails lead to purchases. It holds no personal data and is deleted after a purchase.

We also record usage events on our own servers — for example, a video played, or a link copied, edited or downloaded as a QR code in the dashboard — with the page and the device class (desktop, mobile or tablet). When you're signed in they're linked to your account. We never store your IP address or raw user agent with them.

Retention

Click analytics are kept for 12 months and then deleted automatically. Links and account data are kept while your account exists.

Your rights & contact

You can request access to or deletion of your data at any time. Email [email protected] and we'll take care of it.