Legal

Privacy Policy

Last updated: October 15, 2026

This policy explains what personal data JustLinks collects, why we collect it, who it is shared with, how long we keep it, and the rights you have. It is a transparency notice, separate from our Terms of Service, which govern your account.

1. What we collect

• Account details. The email address you sign up with, a hash of your password (never the password itself), whether you have confirmed your email, and your plan tier.
• External sign-in. If you sign in with Google, Microsoft, GitHub, LinkedIn or Discord, we receive an account identifier from that provider and the profile fields it returns. We do not treat a Microsoft account's email as verified; it is confirmed separately.
• Page content. Your page name, description, links, images you upload, theme, SEO fields, chosen subdomain, any custom domain you connect, and — for a password-protected page — a hash of the access code (never the code itself).
• Usage analytics. A view count per page and a click count per link, counted server-side when a visitor opens the page or follows a link. Traffic from search engines and other crawlers is excluded.
• Subscriber lists (Pro and above). If you switch on email capture for your page, we store the visitor's email address, the time they consented, and the IP address it came from.
• Billing. Your Stripe customer and subscription identifiers, your plan, and the current period end. Card details are entered on Stripe's own checkout and never reach our servers.
• Technical data. Your IP address and browser user-agent, used for rate limiting (held in memory for a short time) and standard server logging.

2. Cookies and similar technologies

We set a small number of cookies and use one third-party analytics service:

• Sign-in cookie. Set by our authentication system when you sign in, marked SameSite=Lax and Secure in production. It keeps you signed in and is required for the service to work.
• Antiforgery cookie. Set when a password-protected page shows its unlock prompt, so the unlock form cannot be driven from another site.
• Unlock cookie. A protected cookie that remembers, for a short time, that a visitor has entered the correct access code, so they are not asked again on every request.
• Google Analytics 4. We use GA4 to understand how the site is used. It sets _ga and _ga_* cookies and is loaded on every route, including customer subdomains. This is the one tracking service on the platform.

3. Why we use it

To provide the service and your page; to authenticate you and keep your account secure; to prevent abuse and keep the platform clean; to process payments and manage your subscription; and to understand, in aggregate, how the product is used so we can improve it.

4. Legal bases

Where the law requires a legal basis for processing, we rely on:

• Contract — your account, your page, and billing.
• Legitimate interests — preventing abuse, security, and aggregate analytics, balanced against your rights.
• Consent — where required for analytics, and for subscriber emails captured on a page.

5. Who we share it with

We do not sell your data. We share it only with the providers that run the service:

• Stripe — to process payments and manage subscriptions.
• Google Analytics — to measure site usage.
• Identity providers — Google, Microsoft, GitHub, LinkedIn and Discord, when you choose to sign in with one.
• Our email host — to send confirmation and notification mail.
• Our hosting provider — which runs the servers that store your data.

6. Subscriber lists and page owners

When a page owner captures their visitors' email addresses, the page owner is the controller of that list and JustLinks is a processor: we store and deliver it on the owner's instructions, but the owner decides why it is collected and what it is used for. A subscriber who wants to see, correct or delete their details should contact the page owner, whose contact address is on the page. If you contact us instead, we will pass your request to the owner.

7. How long we keep it

• Account and page content — kept while your account is open. When you delete a page or your account, it is removed from the live service; copies may remain in backups until those backups rotate.
• View and click counts — kept with the page, and removed with it.
• Subscriber lists — kept until the page owner deletes them or the page is deleted.
• Rate-limiting data — held in memory for a few minutes only.
• Server and security logs — kept for a short period for security and troubleshooting, then discarded.
• Billing records — kept for as long as tax and accounting law requires, and by Stripe under its own policy.

8. International transfers

JustLinks is operated from the United States, and your data is processed there. Where data is transferred from outside the United States — for example by a provider such as Stripe or Google — those providers rely on the safeguards set out in their own terms, such as standard contractual clauses. Where GDPR applies, you may ask us for more detail using the contact below.

9. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, export it, or object to certain processing, and to withdraw consent where consent is the basis. To exercise any of these, email [email protected]. If you are not satisfied with our response, you have the right to complain to your local data-protection authority.

10. Children

JustLinks is not directed at children. You must be at least 13 years old to use the service, and we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

Passwords are stored only as hashes. The service runs over HTTPS with HSTS, accounts must confirm their email before use, requests are rate-limited, and the encryption keys we use are persisted so that protected data survives a restart. No system is perfectly secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy. When we do, we will update the "Last updated" date on this page and, where the change is significant, notify you by email or in the service.

13. Contact

For any privacy question or request, email [email protected].