Privacy

LinkForge organizes links and records click events. The service has not opened for public registration.

What the application records

We store account email, links and their destinations, campaign tags, and subscription identifiers. Click events contain a link identifier, time, inferred device category, and referrer hostname when available. Application analytics do not store raw IP addresses, full user agents, or referrer paths and query strings.

Purpose and retention

These records support redirects, account access, billing, and click analytics. Detailed clicks are retained for 90 days. Lifetime counters remain while a link exists. Deleting a link removes its analytics and disables its redirect; its slug stays reserved. Account deletion cancels billing and removes associated application records through a retryable process.

Reports, conversions, and preferences

Owners can share aggregate campaign reports through secret links with an expiration date. Anyone with that link can view the report until it expires or is revoked. Reports never include raw click rows, account email, or billing details. Weekly summaries are opt-in and sent to the recipients chosen by the owner; a disable link is included.

When an owner enables conversion goals, a signed click reference can be added to the destination URL. The optional destination-site helper removes that reference from the visible URL and stores the latest reference locally for up to 30 days. The website owner must install it consistently with their consent requirements. Goal events store a click reference, goal, time, deduplication key, source, and optional amount and currency. They do not require names, email addresses, or customer profiles. Conversion records are retained for 90 days. Browser events are reported events, not proof of a purchase.

Theme preference is stored in a one-year cookie and browser storage. Domain settings store the hostname and DNS verification record. Expired report metadata and digest delivery history are removed after 90 days; CSV review records expire after 30 minutes and are removed by maintenance after one additional day. Hosting access logs may contain request paths, including report tokens, and follow the hosting provider’s retention policy.

Optional website arrival tracking

A website owner can install the LinkForge website script through their analytics consent settings. It sends a campaign link reference or selected campaign tags, an event identifier, and a referrer hostname. The server stores the matched link, time, device category, and referrer hostname. It does not store the visitor’s full website URL, arbitrary query parameters, name, or email. Browser-origin checks and filtering do not prove that every reported event came from a person.

After analytics consent, the script uses session storage to deduplicate repeated arrivals for the same campaign within 30 minutes. Withdrawing consent through the website’s integration stops new collection and clears that storage. Test visits update installation status and are excluded from arrival reports. Detailed arrivals expire after 90 days; account deletion removes them, and link deletion removes arrivals associated with that link. Disconnecting website tracking stops new collection while retaining existing reports within the retention period.

LinkForge usage measurement

On LinkForge’s public website, optional analytics stay off until you choose “Allow analytics” or enable usage measurement here. The same browser preference controls website arrivals and product usage counts. Choose “Analytics preferences” in the footer to withdraw consent. Do Not Track and Global Privacy Control keep collection disabled. The choice is stored in this browser until you change or clear it. Website-arrival tracking is not installed on account, authentication, or private shared-report pages.

We use first-party daily counts to understand landing visits, signup actions, verified accounts, first campaigns, link handoffs, first recorded campaign traffic, and return use. These are event counts, not unique visitors or proof of a person. Source, medium, and campaign are limited to fixed categories; arbitrary tags, full URLs, email addresses, raw IP addresses, and browser visitor identifiers are not stored in these counts.

The first source categories are kept in session storage until this browser session ends. When enabled at signup, those categories and the measurement preference are saved with the account. Account milestone keys prevent repeat actions from inflating first-use counts and are removed on account deletion. Daily aggregates expire after 90 days; anonymous retry keys expire after two days. Withdrawing the preference stops new account measurement; existing non-identifying aggregates remain within their retention period. No advertising cookies or third-party analytics provider are used. A separate browser may have a different preference.

Service providers and security

If you choose “Continue with this campaign” in the homepage demo, the campaign name, destination URLs, channel settings, and proposed tracking tags are saved in this browser. The draft expires after seven days and is removed on the next draft check, when you discard it, or after successful campaign creation. It is not uploaded until you review and create the campaign while signed in. Avoid putting sensitive information in campaign names or URLs. Campaign notes store the date and text you provide; they are private to your account, retained until deleted or the campaign/account is deleted, and are not added to shared reports. Notes remain stored but inaccessible after a Premium downgrade.

Optional connected advertising accounts use Meta and Google authorization. We store an account identifier, encrypted authorization tokens, the advertising accounts you select, campaign mappings, and daily advertising metrics. We do not publish ads or change budgets. Imported metrics are retained for 90 days and sync history for 30 days. Disconnecting immediately deletes local credentials and attempts provider revocation. You can also revoke access in the provider’s account settings. After a Premium downgrade, synchronization stops and credentials are removed after 30 days. A scheduled maintenance job performs expiration and retention cleanup. Account deletion removes connection data along with your other account records. OAuth callback URLs can contain temporary codes; hosting logs follow the hosting provider’s retention policy.

Optional YouTube reporting uses YouTube API Services and Google authorization to identify the channel returned for the Google Account you authorize and read its Analytics reports. We store the channel identifier and name with encrypted authorization tokens. We request channel views, watch time, likes, and subscriber metrics when you open or refresh the report; we do not store those report results, publish videos, or change your channel. YouTube data is used only to display your private report in LinkForge and is not sold or included in shared campaign reports.

Disconnecting YouTube in LinkForge removes the local connection and tokens. You can also revoke LinkForge’s access in your Google Account connections. Account deletion removes the connection. Google’s own handling of your data is described in the Google Privacy Policy.

Hosting, authentication/database, email, and payment providers process information necessary to operate their services. Stripe handles payment details; LinkForge does not store card numbers. Providers may retain security logs or billing records under their own policies. Short-lived keyed IP hashes are used for rate limiting. Authentication uses essential session cookies.

Contact

Contact information and provider-specific disclosures must be finalized before public launch.