Privacy policy

lnkrr is a link-in-bio platform where creators build a page and fans do things on it — vote, tip, buy, book, join. This policy covers two kinds of people: creators who hold an account, and visitors who interact with a creator’s public page. Where the two are treated differently, we say so.

lnkrr is operated by ABUHIDAR, LLC, a Wyoming limited liability company (“we”, “us”), 30 N Gould St Ste R, Sheridan, WY 82801, United States. Questions about this policy or your data go to privacy@lnkrr.me.

Creator account data. When you sign up we store your email address, and — as you fill them in — your display name, avatar image, and a referral code. Sign-in is by email and password, with a one-time email link as an alternative. Your password is stored only as a salted hash by our authentication provider (Supabase) — neither they nor we can read it back — and if you turn on two-factor authentication, the secret behind your codes is held there too.

The page you publish. Your handle, bio, social links, the blocks you add (their titles, prices, poll questions, and other content you type), your theme, and — on the Ultra plan — the optional FAQ you write for your page assistant. This is content you choose to make public.

Visitor interactions. When someone votes in a poll, answers a quiz, moves a slider, asks a question, or follows a page, we store the interaction with a random browser-generated visitor id (kept in the browser, not an identity we can trace to a person) and a salted, one-way hash of their IP address used only for rate limiting. We never store raw IP addresses. Rate-limit keys are salted hashes that live only as long as their limit window; the daily visitor count uses a hash that changes every day, so a visitor cannot be followed across days.

Emails collected by a creator’s widgets. If a creator adds an email-capture or form widget and a visitor submits it, we store the email address (and optional name) the visitor entered, on the creator’s behalf, so the creator can reach them.

Payments. Card payments are processed by Stripe on Stripe-hosted checkout — card numbers are entered on Stripe and never reach lnkrr. We store the buyer’s email, the amount and currency, any public tip message, Stripe identifiers, and, for fraud prevention, an opaque card fingerprint from Stripe (a stable token per card that is not a card number and cannot be reversed into one).

What a buyer tells a creator. A creator can ask, at checkout, for the buyer’s name and up to three answers of their own, and can offer a box to join their mailing list. For a paid product, what the buyer enters travels with the payment: it is stored in the Stripe checkout on the creator’s own Stripe account (so it is also visible in their Stripe dashboard), and we store it with the order, with the mailing-list answer in the exact words it was given against. A creator can also give a product away for an email address: we store that address, any name and answers, the mailing-list answer, and a private download link, and we send the link to that address. Unless they have turned sale emails off, the creator is emailed the buyer’s address, name and answers when a sale or free download happens, and can see names in their Audience and everything else in its export. A tick alone adds nobody: the buyer’s delivery email carries a link to confirm it, and only a buyer who confirmed, and whose latest answer to the box is yes, is on the creator’s list. Every email from that list carries an unsubscribe link.

Subscriptions. For Pro/Ultra subscriptions we store the plan, status, and Stripe subscription and price identifiers. We do not store card details; those stay with Stripe.

Referrals. Who referred whom, a ledger of commission earned from paid invoices, and — where a referral is flagged for review — the evidence behind the flag (card fingerprints and timing), used to prevent self-referral and payment fraud.

Core analytics — deliberately minimal, always on. We count page views and block clicks server-side, with no cookie, no browser script, no raw IP address, and no user-agent string (it is discarded after we derive a coarse device class such as “mobile”). What we keep is the referring site’s host (not the full URL), that coarse device class, the country our hosting edge derives from the connection (two letters, never a city), and a salted hash of your IP combined with the calendar day — which cannot be reversed and cannot link you across different days. This runs for everyone because it sets nothing on your device; it is not the analytics category on the banner.

Product analytics (PostHog) — only if you accept. Separately, we use PostHog to understand in aggregate how the product itself is used — which flows people complete, where they get stuck — so we can improve it. This one does run a script and set storage in your browser, so it loads only if you accept the analytics category on the cookie banner, and switching that category back off stops it and clears what it set. We do not create a personal profile for an anonymous visitor, and this is our own measurement of our own product — it is not advertising, and lnkrr still adds no advertising pixel of its own to any page.

Creator advertising pixels are paused. A creator may have a saved Meta or TikTok pixel ID from an earlier setup, but no creator advertising pixel runs on public pages during launch review. Enabling this later will require a separate notice and consent choice.

The AI page assistant (Ultra only). On pages whose owner is on the Ultra plan, a visitor can ask the page a question. We store the question, the topic it was filed under, whether it was answered and which cards were suggested, so the creator can see what people ask. We do not store the answer, and no IP address or IP hash is kept with the question; the rate limit on asking uses the short-lived salted hash described above. See the processors section for what is sent to the AI provider.

• To run the product — show creator pages, record votes and follows, deliver purchases, and pay creators out through Stripe.
• To process payments and subscriptions, and to keep a creator's own records (their orders and earnings) accurate.
• To prevent fraud and abuse — the referral fraud checks, rate limiting, and the trust & safety enforcement described on our safety page.
• To answer support, billing, referral, and partnership emails you send us.
• To understand, in aggregate, how pages are used — from the minimal analytics above.

We do not sell personal data, and we do not use it for third-party advertising. Creator ad pixels are currently paused.

We share data with a small set of service providers who process it on our behalf, only as needed to run lnkrr:

• Cloudflare (Turnstile) — the human check on our sign-in, sign-up and password forms. Cloudflare receives the browser signals its check needs and answers pass or fail; we store neither.
• Stripe — payments, payouts (via Stripe Connect), and subscriptions. Receives card data (entered directly on Stripe), buyer and creator email, amounts, and, for physical goods, the shipping address Stripe collects at checkout.
• Supabase — our database, file storage (avatars and page pictures), and authentication provider. Stores everything above, and sends the sign-in / magic-link emails.
• Vercel — hosting, and visitor counts and page-speed measurements across lnkrr, including creator pages. Both are cookieless and collected first-party: the count needs no third-party script or device storage, nothing follows you between visits, and no profile is built. What is recorded is that a page was viewed and how quickly it loaded, with the referrer and device type the browser sends anyway and the country Vercel’s edge derives from the connection. Vercel serves every request to lnkrr in any case, so nothing new is disclosed by it.
• Sentry — error monitoring, configured to suppress personal data: it does not capture IP addresses, cookies, request bodies, or session recordings. It receives technical error details only.
• PostHog — product analytics, and only if you accept the analytics category on the cookie banner. It records how the product is used — the pages you visit within lnkrr and events like completing a flow — to help us improve it. We do not create a personal profile for an anonymous visitor. Decline the category, or switch it back off, and nothing is sent.
• Groq or the configured AI host — the visitor’s Ask, the creator’s Assistant, link title ideas, and grouping the questions visitors asked into topics for the creator’s Insights. A submitted question or request, recent context, and relevant page content are sent to the configured provider. Ask stores the visitor’s question and derived topic and page-card references for the creator; it does not store the full answer transcript. The Assistant’s conversation is kept in the creator’s browser and is not stored by lnkrr.
• Anthropic — the creator’s bio rewrite, and the Assistant when it is configured to use a Claude model. It receives the creator’s request and the page context needed to answer it. lnkrr does not store those conversations.
• Resend — email delivery. It sends account verification, welcome, billing and weekly-insight messages to creators, and sends feature suggestions to us with an acknowledgement to the creator. It also delivers creator audience messages and scheduled drop announcements when those features are enabled. They are currently paused for launch review; no audience addresses are sent through those paths while paused. Sign-in and password-reset emails are sent by Supabase.
• oEmbed providers — when a creator pastes a media link (YouTube, Spotify, Vimeo, and similar), the URL is sent to that provider to fetch a preview. No visitor data is involved.
• Public content providers — live cards retrieve public data from services such as GitHub, Telegram, Tumblr, Discord, Bluesky, Mastodon, Apple Podcasts, App Store, Medium and Ticketmaster. Images from those services may load directly from their hosts when you view a creator page; your browser then contacts that host even if you decline optional cookies. We send no account token for these public lookups.

We may also disclose information if required by law, to enforce our terms, or to protect the safety of people using lnkrr.

We use essential storage to run the site. Referral attribution, product analytics are optional and remain off until you choose them in the banner. Creator advertising pixels are paused for launch review.

• Session cookies from our authentication provider — what keeps a signed-in creator signed in. Essential; there is no product without them.
• A consent cookie (lnkrr_consent) remembering the choice you made in the banner, for twelve months. Storing your answer is the only way not to ask again.
• An unlock cookie (lnkrr_unlocks), set only when Stripe returns you to a creator’s page after you pay to unlock a link. It is httpOnly, so no script on a page can read it, and it lasts one year. It holds a list of Stripe checkout references, one for each payment, at most 20 with the newest kept, and nothing else: not your name, your email address or any card detail. Each reference is checked again against the payment behind it every time you open the link, so the cookie opens nothing that was not paid for or that has been refunded. Essential: it is how this browser remembers what you paid to unlock, without an account.
• A referral cookie (lnkrr_ref), set only if you arrived from a creator’s referral link, so that creator gets credited if you sign up. This is the one we ask about — it serves us, not you — and it is off unless you accept it. It clears itself once a signup is attributed.
• Local storage, not cookies: an anonymous per-browser id and flags for whether you have already voted, answered or followed. That id exists so a poll can’t be answered twice from one browser; it is not derived from anything about you and carries no signal. Clearing your browser storage clears it, and you get a new one.
• Creator preferences. Signed-in editors store a time-zone cookie for up to one year so scheduled content follows the creator’s local clock. A local theme preference remembers light or dark mode in this browser until it is changed or cleared.
• PostHog analytics storage (a ph_* cookie and local storage), set only if you accept the analytics category. It carries an analytics id for our own product measurement described above. Switching the category back off stops it and clears this storage; declining never sets it at all.
• Creator advertising-pixel storage. Creator pixels are paused and cannot set new storage through lnkrr public pages. If you visited an earlier page where one ran, your browser may still hold provider cookies. You can clear those through your browser settings.

lnkrr sets no advertising cookie and no cross-site tracking cookie. We do run our own product-analytics script (PostHog, above) — but only after you accept the analytics category, never for ads, and never shared across sites. The Creator Meta and TikTok advertising pixels are paused during launch review.

We ask again when the purposes of an optional category change. The current product-analytics choice does not authorize creator advertising pixels.

Reopen your cookie choices to change your mind at any time.

Public live cards. A creator can add a link whose public profile, posts, statistics or events are fetched from the provider without connecting an account. We cache the result to reduce repeated requests and stop displaying it after its freshness window, which can last up to seven days. Older rows may remain in server storage until a cleanup process removes them. Removing the card stops new lookups for that link.

Connected accounts. New Instagram, TikTok and YouTube account connections are paused pending platform review. An earlier connection may still exist. Connecting keeps the platform’s id for your account and the access or refresh token the platform issues. The token is stored encrypted in our database’s vault, is used only by our servers, and is never shown to anyone — including you.

What we read, and why. From Instagram: your username, profile picture, follower count, bio and latest posts, to show them on your page and your dashboard. From TikTok: your display name and profile picture, for the same card. From YouTube: your channel’s views and watch time, for your own dashboard — none of it appears on your page. We keep what we read for up to fifteen minutes so a busy page does not call the platform on every visit; we do not keep it longer, sell it, or use it for advertising.

Removing it. Disconnect on the platform’s card in your dashboard deletes the connection and its token straight away, and your page stops showing the account at once. Closing your account does the same for every connection. You can also remove lnkrr from Instagram’s own settings (Apps and websites): Instagram then sends us a deletion request, we delete your Instagram data automatically, and Instagram gives you a confirmation link that opens a page here confirming the deletion. Or email privacy@lnkrr.me.

We keep data for as long as the account or page it belongs to exists. Emails collected by capture widgets, form responses, questions, tip messages, and AI-assistant transcripts persist until the page or the account holding them is deleted. Two things are swept on a schedule: analytics events after 400 days, and an onboarding draft that was never published after 90 days, which also frees its handle. Nothing else is.

Closing your account is self-serve. Settings → Close your account asks for your password, your two-factor code if you turned that on, and for you to type your handle. Your page comes down at once and you are signed out, but nothing is deleted for 7 days: log in before then and you can restore your account exactly as it was (a paid plan is cancelled when you close and is not restored). After 7 days your photos, bio, links and connected accounts are deleted, and this cannot be undone. If you are still owed money — a Stripe balance not yet paid out, or referral commission not yet settled — it tells you the amount and refuses, so closing cannot strand a payment; the same check runs again before deleting.

Two things survive it, deliberately. Records of completed sales are kept where we are required to keep financial records — they are your buyers’ receipts as much as yours — and they no longer carry your name. And your handle is held for 180 days rather than released to the next person, so links your audience already shared do not quietly become somebody else’s page. Salted IP hashes cannot be reversed to an address at any point.

On the way out we ask, optionally, why you are leaving. If you answer, we keep the answer without your name, email address, handle or account ID: the reason you picked, what you wrote (with email addresses, phone numbers and links removed), the tool you are moving to if you name one, your plan, how long you had the account, and what you did in the end (closed, paused, switched to Free or stayed). In place of the account ID we keep a keyed one-way hash of it, which only lets us count two answers from the same account as one.

To request a copy of your data or a correction, email privacy@lnkrr.me — those are still actioned by hand, and we reply.

• Edit or remove your page content at any time in the editor — hiding or deleting a block removes it from your public page.
• Close your account yourself, from Settings. It takes effect immediately.
• Ask us for a copy of your data or a correction, at the address above.
• Visitors: clearing your browser storage removes the anonymous visitor id and local interaction state.

lnkrr is not directed to children, and is not intended for anyone under the age at which they can hold an account under their local law (at least 13, and 16 where required). We do not knowingly collect data from children.

ABUHIDAR, LLC is a company in the United States. lnkrr runs on cloud infrastructure and the providers named above, which may process and store data in the United States and in other countries than yours. By using lnkrr you understand that your data may be handled in those locations under this policy.

If you are in the European Economic Area, the United Kingdom or Switzerland, transfers to the United States rely on our providers’ data processing agreements, which include the European Commission’s standard contractual clauses (and the UK addendum) where a provider is not covered by the EU-US Data Privacy Framework.

Where data protection law asks us to name a legal basis, ours are: performing our contract with you (running your page, taking payments, sending the emails the service needs); our legitimate interests (keeping lnkrr secure, preventing abuse and fraud, understanding how the product is used, and defending legal claims), which we balance against your rights; your consent, where we ask for it (optional cookies, marketing email from a creator, a connected account), which you can withdraw at any time; and our legal obligations (tax and payment records, responding to lawful requests).

You have the right to access, correct, delete and port your data, to object to or restrict some processing, and to complain to your local supervisory authority. Email privacy@lnkrr.me to use them; most of them you can do yourself from Settings.

This is v1 and will change as the product and its legal review do. We’ll update the date at the top when we revise it, and announce material changes before they take effect where we reasonably can.