Privacy Policy

This policy explains what Linkfold collects, why, and what you can ask us to do with it. It covers two groups of people: creators, who hold an account and publish pages and links, and visitors, who click a linkfold.in link or open a creator’s page.

1. What we collect

From creators

• Account details — your email address, and a hashed password if you registered with one. If you sign in with Google, we receive your email address, name and profile picture from Google; we never receive your Google password.
• Profile — your handle, display name, bio, avatar and the theme settings for your pages.
• Your links — destination URLs, titles, thumbnails, tags, campaigns, UTM parameters, scheduling dates, and the affiliate IDs you save for Amazon or Flipkart.
• Uploads — images you add for avatars or link thumbnails, stored in our media bucket and served publicly.

From visitors

When someone follows a Linkfold link, we write one row to a click log. That row holds the time of the click, a device class (iOS, Android, desktop or other), a two-letter country code, the referring website if the browser sent one, whether the link was a QR scan, and whether we attempted to open a native app.

We do not store IP addresses, full user-agent strings, advertising identifiers or any device fingerprint in that log. The country code is derived from our hosting provider at the moment of the request and the underlying IP address is not retained by us. Nothing in the log identifies an individual visitor, and there is no cookie or pixel set on a visitor’s device by the redirect.

When someone opens a Linkfold page, we write one row to a page view log: the time, the page, a device class, a two-letter country code, and where the visit came from (for example Instagram, YouTube, a QR code, or the referring website’s domain). To count unique visitors and ignore repeat visits within 30 minutes, the row also holds a one-way code computed from the network address and browser type with a key that changes every day. The code can’t be turned back into an address or linked across days, and the address itself is not stored. Nothing is stored on the visitor’s device.

Cookies

Linkfold sets cookies for one purpose: keeping you signed in. These are session cookies issued by our authentication provider and are required for the dashboard to work. We run no advertising cookies, no third-party analytics scripts and no cross-site trackers.

2. How we use it

• To create your account, sign you in and keep your session alive.
• To publish your page, resolve your short links to the right app or web URL, and generate your QR codes.
• To produce your analytics — page views and visitors, clicks per link, device split, traffic sources, QR scans, campaign and tag totals.
• To attach your affiliate tag and UTM parameters to outgoing links, because you asked us to.
• To keep the service safe: investigating abuse, phishing and spam reported to us or detected in our logs.
• To contact you about your account — password resets, email confirmation, security notices, and material changes to this policy.

We do not sell personal data, and we do not use your links or your audience’s click data to advertise to anyone.

3. Legal basis

Where the GDPR applies, we rely on performance of a contract for everything needed to run your account and serve your links, on legitimate interests for aggregate click analytics and for keeping the platform secure, and on consent where you volunteer something optional, such as an affiliate tag. Where India’s Digital Personal Data Protection Act, 2023 applies, we process your data for the purpose you signed up for, and you may withdraw consent as described below.

For click data on a creator’s links, the creator determines why those links exist and we process the data on their behalf as well as our own.

4. Who we share it with

Only the providers that make the product run, each under their own data-processing terms:

• Supabase — our database, authentication and file storage. Account details, profiles, links, uploads and the click log live here.
• Netlify — hosting and the CDN that serves the site and runs the redirect function.
• Google — only if you choose to sign in with Google, and only to authenticate you.

We may also disclose data where the law requires it, or to protect the rights and safety of our users. If Linkfold is ever acquired, we will tell account holders before their data moves.

Note that a destination site you link to is not ours: once a visitor lands there, that site’s own privacy policy applies.

5. Where it is stored

Our providers operate data centres in several regions, so your data may be processed outside your country. Where that involves a transfer out of the EEA or the UK, it is covered by the standard contractual clauses those providers maintain.

6. How long we keep it

• Account, profile and link data: for as long as your account exists.
• Click log rows: retained while the link exists, so your analytics stay comparable over time. Deleting a link deletes its clicks.
• Page view rows: retained while the page exists. Deleting a page deletes its views.
• After you delete your account, your data is removed from our live systems promptly and ages out of encrypted backups within 30 days.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or port it elsewhere. You can also withdraw consent at any time — for example by removing an affiliate ID — without affecting what we did before you withdrew it.

Much of this is self-service: your profile and links are editable in the dashboard, and deleting your account removes them. For anything else, write to privacy@linkfold.in and we will respond within 30 days. If you are in the EEA or the UK you may also complain to your local data protection authority; in India you may approach the Data Protection Board.

8. Children

Linkfold is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it.

9. Security

Traffic is served over HTTPS, passwords are hashed by our authentication provider and never visible to us, and database access is governed by row-level security so one account cannot read another’s data. No system is perfect: if a breach ever affects your personal data, we will notify affected users and the relevant authority as the law requires.

10. Changes to this policy

When this policy changes, the date at the top of the page changes with it. For material changes we will email account holders before the new version takes effect.

11. Contact

Privacy questions and data requests go to privacy@linkfold.in; anything else reaches us at support@linkfold.in. The terms governing your use of the service are in our Terms of Service.