Privacy policy

Last updated October 16, 2026

Links2 is a service for creating and sharing a public profile page. This notice explains how the Links2 service operator (“Links2”, “we”, or “us”) handles information about account holders and visitors. Contact our privacy team at support@links2.link.

Information you give us

When you create an account, Clerk handles your sign-in, authentication emails, session cookies, and account security. We keep a Clerk user identifier, an internal customer identifier, and minimal account details such as your name and email address. We do not store passwords or authentication sessions in our application database.

We store the profile details, links, text, uploaded images, schedules, sharing settings, and domain configuration you choose to save. Drafts remain private to your account. Publishing makes the published version available to anyone with its address, including search engines. Images are public assets with hard-to-guess addresses; do not upload confidential information. Unpublishing cannot remove copies other people or search engines have already made.

Subscriptions and payments

Paddle processes checkout, payment methods, invoices, subscription renewals, and cancellations. We store the provider identifiers and subscription status needed to manage your plan. We do not receive full payment-card details. Paddle handles payment and tax information under its own privacy notice.

Audience forms and consent

If a page owner enables an email-signup form, we store the email address you submit, collection time, the consent wording and version shown to you, verification status, and integration sync status. Local submissions are marked unverified: submitting a form does not prove ownership of an email address. Links2 does not send confirmation, welcome, newsletter, or marketing emails.

The page owner determines the purpose of audience collection and is responsible for the wording of their consent request and their subsequent use of your information. We process local audience records for that owner. Contact the page owner to withdraw consent or request deletion; if you cannot reach them, contact support@links2.link with the profile address.

If the owner connects Mailchimp and selects an audience, eligible addresses are sent to Mailchimp as pending contacts so Mailchimp can request double opt-in. Confirmation and unsubscribe states are synchronized. Previously suppressed contacts are not automatically resubscribed. An owner may export contacts and consent records; those exported copies and their Mailchimp audience are under the owner’s control.

Analytics, cookies, and security

We count page views and link clicks using event identifiers, profile/link identifiers, event type, and time. Analytics does not store IP addresses or persistent visitor identifiers, does not identify unique visitors, and does not use advertising cookies. Recognized bots are excluded. Authentication cookies are used on the application origin for account access. A first-party signup cookie remembers your chosen page address for up to 24 hours and is cleared when setup finishes.

The editor saves recovery copies of unsent draft edits in this browser’s local storage, separately for each account and editor session. A successful draft save removes that session’s copy. Copies older than seven days are discarded when you next open the editor for that account. You can discard a recovery copy in the editor or clear site data in your browser. These copies are not shared across devices.

Cloudflare provides hosting, D1 storage, R2 media storage, queues, DNS/TLS services, and Turnstile spam protection. Infrastructure providers necessarily receive network information such as IP addresses when handling requests. Operational security logs and abuse reports may contain request or account information. This is separate from the anonymous analytics event store. Turnstile may use its own storage and signals to prevent abuse; see Cloudflare’s privacy policy.

External links and embeds

Following a link takes you to a separate service. YouTube, Spotify, Apple Music, SoundCloud, Bandcamp, Deezer, Instagram, and TikTok integrations connect to their providers only after you choose to load their content. Loading or interacting with embedded content shares network information with that provider and may engage its cookies or storage. Its own terms and privacy policy then apply. Subvert cards are outbound links; they do not load a third-party player.

Why and with whom we process information

We use account and profile information to deliver the service you request, subscription records to manage paid access, consent records to support a page owner’s audience collection, and limited operational data to prevent abuse, resolve issues, and meet legal obligations. Where required by applicable law, these activities rely on performing our contract with you, your consent, legal obligations, or legitimate interests in operating and protecting the service. You may withdraw consent for optional processing without affecting earlier lawful processing.

We share information only as needed with our infrastructure, authentication, payment, and selected integration providers; with a page owner when you submit their form; when you intentionally publish it; where law requires disclosure; or as necessary to investigate abuse or protect rights. We do not sell personal information or use audience addresses for our own marketing. Service providers may process information in countries other than yours, subject to applicable transfer requirements and their contractual safeguards.

Retention and deletion

Raw analytics events are kept for seven days. Daily aggregates are available for 30 days on Free and 365 days on Plus; older records are removed by scheduled maintenance. Processed authentication and payment webhook payloads are removed after seven days. Failed events are retained while they need resolution.

Saved profiles and audience records remain until you or the page owner removes them, the account is deleted, or retention is no longer justified. We keep limited keyed address hashes to enforce collection limits and prevent deleted or unsubscribed contacts from being automatically collected again. Replaced public handles are reserved for 30 days.

Account deletion immediately takes your page offline and revokes application access. We confirm subscription cancellation before completing cleanup, then retry deletion of domains, uploads, application content, integration credentials, and your Clerk account until it succeeds. Minimal account and billing identifiers may remain to prevent delayed provider messages from restoring deleted accounts and to meet legal or dispute obligations. Backups and provider records follow their configured retention periods and applicable legal requirements. We restrict their use and apply deletion again if a backup is restored. Ask support for the current backup-retention schedule.

Your choices and rights

You can edit your profile, unpublish it, export profile JSON, download local audience CSV records, disconnect an integration, or request account deletion from the workspace. Account security is managed through Clerk. Depending on your location and circumstances, you may also have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal information, and to complain to your local privacy regulator. Email support@links2.link to make a request; we may need to verify your identity.

Links2 accounts are intended for people aged 16 or older who can enter the relevant agreement, or who have the required parent or guardian authorization. Do not knowingly collect children’s information through audience forms without a valid legal basis and any required safeguards. Contact us if information has been collected improperly.

Changes and contact

We may update this notice as the service changes. Material changes will be announced in the application or through another appropriate channel before they take effect where required. The date above identifies the current version. Questions and privacy requests can be sent to support@links2.link.