Privacy Notice

Last updated: October 25, 2026

This notice explains what personal information OnlyLinks collects from creators who build pages and from visitors who view them, why we collect it, and what you can do about it.

1. The short version

We collect what we need to run your page and your account, and little else.
We don't sell personal information and we don't show ads.
There are no third-party trackers or advertising cookies on OnlyLinks pages.
Card numbers go to Stripe. They never reach our servers.
Opening a link on someone's page doesn't tell that creator who you are.

2. Who we are

OnlyLinks is operated by [OnlyLinks operator legal name, to be confirmed], which is responsible for your personal information under this notice. You can reach us at privacy@onlylinks.io.

3. What we collect from creators

What	Details
Account	Your name, email address, whether your email is verified, and your password, which we store only as a one-way hash.
Page content	Your username, display name, biography, profile photo, links, link titles and descriptions, social profiles, and design choices. Published pages are public.
Sign-in sessions	When you sign in we record the session, the time, the IP address it came from, and your browser's user agent. You can see and end your sessions under Settings.
Billing	Your Stripe customer reference, plan, subscription status, billing dates, and Founders pass status. Stripe collects your card details and billing address directly.
Referrals	Who invited you, who you invited, and the rewards each referral earned.
Messages	What you send us when you email support, report a page, or reply to a notice.

4. What we collect from visitors

Viewing a page doesn't require an account. The only cookie a visitor gets is ol_vid, a random number that lets us count each visitor once a day. It isn't linked to your name, email, or any other site.
Like every website, our hosting provider receives your IP address and browser details in order to deliver the page, and keeps short-term request logs for security and troubleshooting.
If you open OnlyLinks through someone's referral link, we set a cookie for 30 days that remembers who invited you, so the right person gets credit if you sign up.
Confirming an 18+ link doesn't store anything about you, including your age.
To stop people guessing passwords, we count sign-in attempts per IP address. We store a scrambled (hashed) form of the address, not the address itself, and delete it within an hour.

Page analytics for creators. When you view a creator's page or tap one of their links, we record:

That a visit or click happened, and on which day (in UTC).
Whether it came from a phone or a computer. We work that out from your browser details, then discard them.
For creators on Pro, the website you came from, reduced to its name (for example, instagram.com). Never the full address.
A one-way scrambled code made from the ol_vid cookie, so a repeat visit the same day isn't counted twice. It's deleted the next day.

We don't store your IP address, your browser details, or anything that identifies you for analytics. Bots and link previews aren't counted. Creators only ever see totals, never individual visitors.

5. How we use it

To create your account, publish your page, and show it to visitors.
To verify your email, reset your password, and keep your account secure.
To charge for plans, apply the features you've paid for, and run the referral program.
To prevent fraud, spam, and abuse, and to enforce our Terms.
To answer your messages and send you notices about your account or changes to our policies.
To meet legal obligations, such as tax records and valid legal requests.

We don't send marketing email without your consent, and we don't use your content to train AI models.

6. Legal bases

Where the law requires a legal basis for processing, such as in the EU or UK, ours are:

Contract: running your account, page, and plan.
Legitimate interests: keeping OnlyLinks secure, preventing abuse, and crediting referrals.
Legal obligation: keeping financial records and answering valid legal requests.
Consent: anything optional we ask you to agree to. You can withdraw consent at any time.

7. Who we share it with

We share personal information only with the service providers that run OnlyLinks for us. They may use it only to provide their service to us.

Provider	What they do	Location
Vercel	Hosts the website and serves every page and request	United States and global edge network
Neon	Runs the database that stores accounts, pages, links, and billing status	United States (US East)
Stripe	Processes payments, stores card details, and runs the billing portal. Some purchases are sold through Link, a Stripe service, as seller of record	United States and other Stripe regions
Resend	Sends account emails such as verification and password reset, once email delivery is turned on	United States

We may also share information:

When the law requires it, under our law enforcement policy.
To protect someone from serious harm, or to protect our rights in a dispute.
If OnlyLinks is sold or merged, with the new owner, who must honor this notice.

Everything on your published page is public, and anyone can see it.

8. Where it's stored

OnlyLinks is operated from Canada, and our database and hosting are in the United States. Your information may be processed in other countries where our providers work. When it is, we rely on contracts with those providers that require them to protect it, and, for transfers out of the EU and UK, on approved transfer mechanisms such as standard contractual clauses.

9. How long we keep it

Account and page information: while your account is open.
When you close your account: we delete your account and page within 30 days. Your username stays reserved for 30 days afterward so nobody can impersonate you.
Sign-in sessions: until they expire or you sign out, then they're deleted.
Hashed sign-in counters: up to one hour.
Page analytics: 3 days for creators on Free, 90 days on Plus, and 365 days on Pro, then deleted automatically. The once-a-day visitor code is deleted the next day.
Billing records: as long as tax and accounting law requires, which is usually six years in Canada. Stripe keeps its own payment records under its own policies.
Short-term backups and hosting logs: overwritten on the providers' normal schedules.

10. How we protect it

Every connection uses HTTPS. Passwords are stored only as hashes. Card details stay with Stripe. Sign-in attempts are rate-limited, and access to production data is limited to the people who run OnlyLinks. See the Trust Center for more. No system is perfectly secure. If a breach affects your information, we'll tell you and the regulators the law requires us to tell.

11. Children

OnlyLinks isn't meant for children under 16, and we don't knowingly collect their information. If you think a child under 16 has an account, email us and we'll remove it.

12. Your rights and choices

Depending on where you live, you can ask us to:

Tell you what personal information we have about you, and give you a copy.
Correct information that's wrong. You can edit most of it yourself in your dashboard.
Delete your account and information.
Give you your information in a portable format.
Stop or restrict certain processing, or withdraw a consent you gave.

Email privacy@onlylinks.io from the address on your account. We'll answer within 30 days. We won't treat you differently for using these rights.

California and other US states: we don't sell or share personal information for targeted advertising, and we don't use sensitive personal information to infer things about you.

13. Changes to this notice

When we change this notice, we'll update the date at the top. If a change is significant, we'll tell you by email or in your dashboard before it takes effect.

14. Contact and complaints

Questions or requests go to privacy@onlylinks.io. If you're not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or the data protection authority where you live.