Legal

Privacy Policy

Last updated September 6, 2026

The short version. Linkamy turns a link into a short link and, optionally, a bio page. For every click we record the country, device type and the app it came from — never an IP address and without setting any cookie on the visitor. Raw click records are deleted after 90 days, leaving only daily totals. You can export or permanently delete everything from your account settings at any time.

Who we are

This policy covers linkamy.io and the Linkamy service (“Linkamy”, “we”, “us”). It explains what we collect, why, how long we keep it, and the choices you have. For anything not covered here, or to exercise a right below, write to privacy@linkamy.io.

Two kinds of people interact with Linkamy: account holders, who create links and bio pages, and visitors, who click those links. We hold very little about visitors and describe both below.

What we collect from account holders

Account details — your email address (used to sign in and to contact you about your account) and your current plan. Sign-in is passwordless: we send a one-time link by email.
What you create — the short links, destination URLs, titles, descriptions, routing rules, and any content you put on a bio page. Bio pages are published at a public address you choose and are meant to be seen by anyone.
Billing — if you subscribe, our payment provider (Polar) processes your card and sends us the plan, status and renewal date. We never see or store card numbers.
Optional connections — if you connect a Shopify store for conversion tracking, we store the shop domain and the credentials needed to verify its webhooks.

What we collect when someone clicks a link

For each click that is not a bot or a prefetch, we store a single record containing:

a two-letter country code, derived on our server from the request and then discarded at source;
the device type — iOS, Android or desktop;
the source app, when the click comes from an in-app browser (for example Instagram or TikTok);
the referring site, stored as the site address only — never the full page URL or its query string;
campaign tags (utm_source, utm_medium, utm_campaign) if they are present on the short link;
which destination was served (for geo, language or A/B routing) and whether the in-app-browser help page was shown;
the timestamp.

We do not store IP addresses, we do not set cookies on visitors, and we do not fingerprint devices or track anyone across sites. Bot and crawler traffic is filtered out and only counted in aggregate.

How long we keep it

Raw click records are kept for 90 days. After that they are rolled up into per-day totals (clicks per link per day, broken down by the fields above) and the individual records are deleted. Product-usage events we record for our own metrics — such as “an account published a bio page” — are tied to the account and removed when the account is deleted. Everything else is kept for as long as your account exists.

Cookies and local storage

We use only first-party functional cookies — no advertising or tracking cookies of our own:

Sign-in session — a strictly necessary cookie set once you log in, so the dashboard knows it is you.
Age gate — if a link owner turned on an 18+ confirmation, a small cookie remembers your choice for that platform for 30 days.
Bio A/B test — if a bio page is running an A/B test, one cookie keeps you on the same version across visits so your experience is consistent. It holds only the letter “a” or “b”.
Visitor analytics consent — if a bio page owner added their own Meta Pixel or Google Analytics (see below), your accept/decline choice is remembered in that page’s local storage.
Preferences — your theme, sidebar state and a “you’ve seen onboarding” marker are stored in your browser, not sent to us.

Analytics that a bio page owner adds

A bio page owner on a paid plan can add their own Meta Pixel or Google Analytics measurement ID to their page. When they do, their page shows visitors a consent bar first. Nothing loads from Meta or Google until the visitor accepts. If a visitor accepts, those third parties then receive data about that visit under their own privacy policies, and the page owner — not Linkamy — is responsible for that processing.

Who processes data for us

We use a small number of providers to run the service:

Supabase — database and sign-in, hosted in the European Union (Frankfurt).
Vercel — application hosting and content delivery.
Polar — subscription billing and card processing.
Resend — delivery of operational email.

These providers act on our instructions. Some may process data outside the EU/UK; where they do, that transfer relies on the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

Why we are allowed to use this data

To provide the service you asked for — creating and serving your links, showing you their analytics, and billing your plan (performance of a contract).
To keep the service working and safe — rate limiting, bot filtering and aggregate usage metrics (legitimate interest).
Consent — for the optional owner-supplied pixels described above, and any future optional feature that asks for it.

Your rights

Export — from Settings → Export account data you can download everything we hold about your account as JSON.
Deletion — from Settings → Delete account you can permanently remove your account and everything in it. Public links and QR codes stop working immediately. Cancel any active subscription first.
Correction and objection — most details you can edit yourself; for anything else, email us.
If you are in the EU or UK, you can also complain to your local data protection authority.

Children

Linkamy is not directed at children and is not intended for anyone under 16. The optional 18+ age gate is a content warning a link owner can switch on; it does not verify the age of the account holder.

Changes to this policy

If we change this policy we will update the date at the top, and for anything significant we will tell account holders by email before it takes effect.

Contact

Questions, requests, or a privacy concern: privacy@linkamy.io.

linkamy.io · No IP addresses stored · 90-day click retention