Privacy policy

For an account you create, AllLinks stores:

• ▸Your email address and an authentication record held by our database provider, Supabase.
• ▸Your handle, display name, bio, category, location, website link and theme choices.
• ▸The social links, products, stories and permanent updates you publish.
• ▸The media files you upload: avatars, product images and story images.
• ▸Your follows, and the notifications generated from them.

For people who visit a public page, AllLinks stores analytics events: the page viewed, the product or link clicked, a timestamp, an approximate country, a referrer host, and a rotating one-way hash used to estimate unique visitors.

We do not store raw IP addresses in the analytics table. A salted, rotating hash is derived from the IP address, the user agent and the current date, and only that hash is kept. It resets every day and cannot be reversed into an address. The salt lives in theANALYTICS_SALT environment variable.

Story view counts are recorded only for signed-in accounts, so a creator's story numbers count real people rather than refreshes or anonymous traffic.

• ▸Public: your handle, display name, bio, category, location, active links, published products, active stories and published updates — but only while your page is published.
• ▸Private: your email address, draft content, and anything you have not published. These are protected by database row level security and are never returned to other accounts.
• ▸Moderators: reported content and the reports filed against it.

AllLinks has no advertising network, no data broker, and no third-party analytics. Your creator analytics exist for you, not for us.

Stories are removed 24 hours after publication. Expired stories are unreadable from the moment they expire, enforced by a database constraint rather than by the interface.

If you delete your account, your authentication record is deleted and every AllLinks table referencing it is removed by cascade, along with the media you uploaded.

AllLinks stores your session in an HTTP-only cookie issued by Supabase Auth. It is required to keep you signed in and is not readable from JavaScript. No advertising or tracking cookies are set.

You can edit or unpublish your page at any time, change your handle, and delete your account outright from Studio settings. To request a copy of your data, or to raise a privacy concern, use the contact form.