A first draft, in plain terms
Written so lnkrr can launch with real policies in place — not a substitute for review by a qualified lawyer, and not legal advice. It describes how the product works today and will be revised as proper legal review happens. Corrections: privacy@lnkrr.me.
lnkrr is a link-in-bio platform where creators build a page and fans do things on it — vote, tip, buy, book, join. This policy covers two kinds of people: creators who hold an account, and visitors who interact with a creator’s public page. Where the two are treated differently, we say so.
Creator account data. When you sign up we store your email address, and — as you fill them in — your display name, avatar image, and a referral code. Sign-in is by email and password, with a one-time email link as an alternative. Your password is stored only as a salted hash by our authentication provider (Supabase) — neither they nor we can read it back — and if you turn on two-factor authentication, the secret behind your codes is held there too.
The page you publish. Your handle, bio, social links, the blocks you add (their titles, prices, poll questions, and other content you type), your theme, and — on the Ultra plan — the optional FAQ you write for your page assistant. This is content you choose to make public.
Visitor interactions. When someone votes in a poll, answers a quiz, moves a slider, asks a question, or follows a page, we store the interaction with a random browser-generated visitor id (kept in the browser, not an identity we can trace to a person) and a salted, one-way hash of their IP address used only for rate limiting. We never store raw IP addresses.
Emails collected by a creator’s widgets. If a creator adds an email-capture or form widget and a visitor submits it, we store the email address (and optional name) the visitor entered, on the creator’s behalf, so the creator can reach them.
Payments. Card payments are processed by Stripe on Stripe-hosted checkout — card numbers are entered on Stripe and never reach lnkrr. We store the buyer’s email, the amount and currency, any public tip message, Stripe identifiers, and, for fraud prevention, an opaque card fingerprint from Stripe (a stable token per card that is not a card number and cannot be reversed into one).
Subscriptions and Circle memberships. For Pro/Ultra subscriptions we store the plan, status, and Stripe subscription and price identifiers. For a creator’s Circle, we store each member’s email, optional name, tier, and Stripe identifiers.
Referrals. Who referred whom, a ledger of commission earned from paid invoices, and — where a referral is flagged for review — the evidence behind the flag (card fingerprints and timing), used to prevent self-referral and payment fraud.
Core analytics — deliberately minimal, always on. We count page views and block clicks server-side, with no cookie, no browser script, no raw IP address, and no user-agent string (it is discarded after we derive a coarse device class such as “mobile”). What we keep is the referring site’s host (not the full URL), that coarse device class, and a salted hash of your IP combined with the calendar day — which cannot be reversed and cannot link you across different days. This runs for everyone because it sets nothing on your device; it is not the analytics category on the banner.
Product analytics (PostHog) — only if you accept. Separately, we use PostHog to understand in aggregate how the product itself is used — which flows people complete, where they get stuck — so we can improve it. This one does run a script and set storage in your browser, so it loads only if you accept the analytics category on the cookie banner, and switching that category back off stops it and clears what it set. We do not create a personal profile for an anonymous visitor, and this is our own measurement of our own product — it is not advertising, and lnkrr still adds no advertising pixel of its own to any page.
A creator’s own advertising pixel. Creators on our Pro and Ultra plans can add their own Meta (Facebook) or TikTok pixel ID to their page, so that ads they pay for can be measured. Where a creator has done that, and only if you accept the ad-pixel category on the cookie banner, that platform’s script loads in your browser on their page and reports the visit to them. It is the creator’s tracker and the creator is its data controller; what Meta or TikTok then collect is governed by their own policies, not ours. lnkrr adds no pixel of its own to any page, and nothing loads on the pages of the great majority of creators, who have not set one.
The AI page assistant (Ultra only). On pages whose owner is on the Ultra plan, a visitor can chat with an AI assistant. We store the conversation (the visitor’s questions and the AI’s answers) so the creator can see what people ask, together with a salted IP hash. See the processors section for what is sent to the AI provider.
We do not sell personal data, and we do not use it for third-party advertising. The creator ad pixel described above is not an exception to that: it is the creator’s own measurement of their own ads, it requires your consent, and lnkrr receives nothing from it.
We share data with a small set of service providers who process it on our behalf, only as needed to run lnkrr:
We may also disclose information if required by law, to enforce our terms, or to protect the safety of people using lnkrr.
We keep data for as long as the account or page it belongs to exists. Emails collected by capture widgets, form responses, questions, tip messages, and AI-assistant transcripts persist until the page or the account holding them is deleted. Analytics events are swept on a schedule; nothing else is.
Closing your account is self-serve. Settings → Close your account asks for your password and for you to type your handle, then does it immediately. There is no grace period and it cannot be undone. Your page comes down and your photos, bio, links and connected accounts are deleted. If you are still owed money — a Stripe balance not yet paid out, or referral commission not yet settled — it tells you the amount and refuses, so closing cannot strand a payment.
Two things survive it, deliberately. Records of completed sales and memberships are kept where we are required to keep financial records — they are your buyers’ receipts as much as yours — and they no longer carry your name. And your handle is held for 180 days rather than released to the next person, so links your audience already shared do not quietly become somebody else’s page. Salted IP hashes cannot be reversed to an address at any point.
To request a copy of your data or a correction, email privacy@lnkrr.me — those are still actioned by hand, and we reply.
lnkrr is not directed to children, and is not intended for anyone under the age at which they can hold an account under their local law (at least 13, and 16 where required). We do not knowingly collect data from children.
lnkrr runs on cloud infrastructure and the providers named above, which may process and store data in countries other than yours. By using lnkrr you understand that your data may be handled in those locations under this policy.
This is v1 and will change as the product and its legal review do. We’ll update the date at the top when we revise it, and announce material changes before they take effect where we reasonably can.