Privacy Policy

1. Who runs Linksaff

Linksaff is a personal project run by Pedro Teixeira, an individual operator based in the European Union. For GDPR purposes, that's the data controller.

Reach us at pedro.miguelst (@) gmail.com.

2. What we collect

Your account

Your email, a hashed password (we never see the plaintext), and timestamps of sign-up, sign-in, and password reset.

What you build inside Linksaff

Projects, links, slugs, destination URLs, SubIDs, custom domains, A/B variants, geo targeting rules, and the settings around them. That's your content.

Click data

When someone clicks one of your links, the redirect Worker records:

• The timestamp.
• The country (derived from IP by Cloudflare, not the raw IP).
• Device, browser family, and operating system family (parsed from the User-Agent header).
• The referrer header, when the browser sends one.
• A short-lived hash of IP + User-Agent. Used only to pin a visitor to the same A/B variant across reloads. Not stored as a personal identifier, not joined back to any account.

We do not store raw IP addresses. We do not load ad pixels, Facebook SDK, or Google Analytics on this site.

Contact form

If you write to us through the contact form, we get the email and message you sent. That's it.

3. Why we keep any of it

• To run the redirects and show you accurate analytics.
• To sign you in and protect your account.
• To run the daily health-check that tells you when an offer has 404'd.
• To answer your messages.
• To catch fraud, click inflation, and infrastructure abuse.

4. Legal basis (GDPR)

Account and product data: performance of a contract (Art. 6(1)(b) GDPR). Without it, the service literally cannot run.

Click analytics and security telemetry: legitimate interest (Art. 6(1)(f)) in operating, securing, and improving the service.

5. Where your data lives

We use a small, deliberate set of processors:

• Supabase — Postgres and authentication, region sa-east-1 (São Paulo, Brazil).
• Vercel — hosts the web app and marketing site on a global edge network.
• Cloudflare — runs the redirect Worker that resolves your short links worldwide.

Because Supabase processes data in Brazil and Cloudflare / Vercel are global, your data may be processed outside the European Economic Area. We rely on the standard contractual clauses and equivalent safeguards these providers publish for international transfers.

6. How long we keep it

Account and product data stays as long as your account is active. Delete your account and we wipe your auth record, links, projects, and domains. Click breakdown rows tied to your links are removed within 30 days.

Backups and security logs may incidentally include fragments of your data and are overwritten within 30 days.

7. Your rights

If you're in the EEA, the UK, or somewhere with similar laws, you can:

• Ask to see the data we hold about you.
• Ask us to fix anything that's wrong.
• Ask us to delete your data.
• Get a copy of your data in a portable format.
• Object to processing that runs on legitimate interest.
• Complain to your national data protection authority if we've handled this badly.

Email pedro.miguelst (@) gmail.com to exercise any of these. We answer within 30 days.

8. Cookies

Only the ones we need to run the service:

• Session cookies from Supabase Auth, so you stay signed in.
• A theme preference cookie, so dark / light mode survives between visits.

No analytics cookies. No ad cookies. No third-party tracking pixels on this site.

9. Children

Linksaff is built for working affiliates, not kids. We don't knowingly collect data from anyone under 16. Spot a child account? Tell us and we'll remove it.

10. Changes

We'll update this page as the product changes. Material changes get announced in the dashboard or by email before they take effect. The date at the top is always the live version.

11. Talk to us

Questions, data requests, or concerns — pedro.miguelst (@) gmail.com or the contact form.