1. Who we are
linky.lat is a URL shortening service. Our servers are hosted in the EU (Sweden) via Supabase.
2. What data we collect
- Account data: Email address and hashed password (bcrypt, 12 rounds). We never store your plain-text password.
- Link data: The URLs you shorten, titles, and creation dates.
- Analytics: Click events including device type (mobile/desktop), country (from Cloudflare's
cf-ipcountryheader — no IP processing), referrer hostname only (never full URL), and a truncated SHA-256 hash of the user agent string for basic deduplication.
3. What we do NOT collect
- ✗ IP addresses (never stored or logged)
- ✗ Full user agent strings
- ✗ Full referrer URLs
- ✗ Cookies (except the encrypted auth session cookie)
- ✗ Third-party tracking scripts
4. Data retention
Analytics data is automatically deleted after 90 days. Account data is retained until you delete your account. Deleted accounts are immediately anonymised (email replaced with an anonymous identifier, password hash cleared).
5. Your rights (GDPR)
As a user in the EU or anywhere else, you have the right to:
- • Access: Download all your data at any time from Settings → Download my data
- • Erasure: Delete your account and all associated data from Settings → Delete account
- • Rectification: Contact us to correct inaccurate data
- • Portability: Your data export is in standard JSON format
6. Third-party services
- Vercel: Hosting and CDN (US + global edge)
- Supabase (EU North, Sweden): Database storage
- Resend: Transactional email (verification, password reset)
- Stripe: Payment processing (when applicable). We share your email with Stripe for billing purposes only.
7. Contact
For privacy requests or questions, contact us at privacy@linky.lat.