Privacy Policy

• Your email address — used to verify your account, send login codes, and reset your password. Nothing else.
• Your password — stored only as a salted PBKDF2 hash. Nobody, including the operator, can see or recover the original.
• Your page content — the display name, bio, tags and links you publish. Remember: this content is public by design; anyone can see your page.
• Verification codes — one-time email codes are stored hashed, expire in ten minutes, and are deleted once used.
• Routine infrastructure logs — our hosting and database providers (Vercel, Turso) keep standard server logs, such as IP addresses, as part of running the internet. We do not analyze them and do not use them to profile anyone.

• No analytics — we don't count your visitors.
• No tracking pixels, no fingerprinting, no ad networks.
• No advertising of any kind.
• No selling, renting or sharing your data with anyone.
• No profiling, no audience building, no “business partners”.

The service sets exactly one cookie: an httpOnly session cookie that keeps you logged in. It contains a signed token, not your data, and expires after 30 days or when you sign out. There are no third-party cookies and no consent banner, because there is nothing to consent to.

The service stands on the shoulders of three providers, plus one for icons:

• Vercel — hosts the website and serves pages.
• Turso — stores the database.
• Resend — delivers verification and password-reset emails.
• Google favicon service — when a public page is viewed, the small icons next to links are fetched through Google's public favicon service, which therefore sees the domains of those links.

Each of these providers processes data under their own privacy policies and terms. The operator chose reputable providers but is not responsible for their conduct.

We do not guarantee the security of your data. Period. Passwords are hashed and reasonable care is taken, but this is a free indie service with no dedicated security team and no audits. You should assume that absolute confidentiality cannot be guaranteed, and you use the service at your own risk.

All responsibility for what you choose to store here — and for keeping your own backups — rests with you. If losing it would hurt, keep a copy somewhere else.

The service does not maintain off-site backups of your content. Data loss, while not expected, is possible at any time, and the service itself may be paused or shut down at any time without notice — there is no guarantee it will exist tomorrow. Please treat Links as a convenient front door to your links, not as the only place they live.

You can export or copy your links at any time, and you can delete your account permanently from Settings — deletion removes your page, your username and every link immediately. If you need a hand with either, reach out via GitHub and it will be sorted, time permitting.

The service is not intended for children under 13, and accounts belonging to children under 13 will be deleted when discovered.

This policy may be updated at any time. The “last updated” date at the top always reflects the current version, and continued use of the service after changes means you accept it.