Privacy policy
Last updated: 23 October 2026
1. Controller and contact
Fersoft Technologies, LLC, a limited liability company organised in Delaware (file number 10321376), with its address at 1111B S Governors Ave STE 39885, Dover, DE 19904, United States, operates linko (linko.sh). For any privacy matter, write to hola@linko.sh.
2. Data we process
- Account: name, email address, password protected with a hashing algorithm (never in plain text), language and verification status. If you sign in with Google, we receive your name, your verified email and your Google account identifier; we do not keep Google tokens.
- Links and bio pages: destination addresses, aliases, titles, tags and settings (expiry, A/B tests, country or device rules). Link passwords are stored only as a hash. On your bio pages, the texts, links and photo you upload.
- API keys: we keep their name, prefix and a hash; the full key is only shown once.
- Billing: plan status, Stripe customer and subscription identifiers and the data needed for invoices. Full card details are entered in Stripe, not in linko.
- Clicks and views: we count clicks on links and views of bio pages as daily totals by country, source (for example, Instagram or direct), operating system, browser and A/B variant, to show them to their owner. We do not store IP addresses or identifiers of whoever clicks, and we discard bots and link previews. We keep these totals for about 13 months.
- Security: to limit abusive attempts (for example, link passwords or sign-ins) we keep a hash of the IP address next to a counter for minutes or hours. The platforms we use produce technical security logs.
- Reports: the reason, the details and, if given, the email of whoever reports a link or a page.
3. Purposes and legal bases
We use the data to provide the service you sign up for: shortening and redirecting links, publishing your bio pages, showing you statistics and managing your account (performance of the contract); processing payments and invoices (contract and legal obligations); sending necessary account and subscription emails (contract); and protecting the service and the people who visit links from fraud, phishing and abuse (legitimate interest). We do not use your data for advertising and we do not sell it.
4. Public content
Short links and published bio pages are reachable by anyone with their address, and search engines may index bio pages. You can pause or delete links and hide or delete pages at any time; that does not remove copies third parties made earlier.
5. Recipients and providers
- Cloudflare: infrastructure, network, database and image storage. It also gives us the approximate country of each click, which we aggregate without keeping the IP.
- Stripe: payments, invoices and subscriptions. It may act as an independent controller of some payment data.
- Resend: sending account and subscription emails.
- Google: as identity provider if you choose to sign in with Google. When the check is active, we send link destination addresses to Google Safe Browsing to detect dangerous sites; never data about whoever clicks.
- Google Analytics: only if you accept it, it measures how the public website is used (not the app or your links). Google may process your IP address and browsing data as a processor.
Fonts are served from our own servers, with no third-party requests. Some providers may process data outside the European Economic Area; where the GDPR requires it, we rely on adequacy decisions or valid safeguards such as standard contractual clauses.
6. Retention
We keep the account, links and pages while you use the service. Deleting a link or a page also deletes its statistics. If you ask us to delete your account, we will delete or anonymise its data within 30 days at most, except data we must keep by law (for example, invoices) or that remains temporarily in backups. Email delivery logs are kept for up to 30 days and attempt counters for hours.
7. Cookies and local storage
linko does not use advertising cookies. On the public website we use analytics only if you accept it; in the app and on your links, only technical storage:
__Host-linko_session: keeps you signed in (30 days).linko_google_*: protect the Google sign-in for a few minutes.lk_ab_…: if a link runs an A/B test, it remembers for 30 days which variant you saw (just a letter, no identifiers), so you always see the same version.- Browser local storage: your preferred language and, while signing up, the link you wanted to shorten.
_gaand_ga_*(Google Analytics): only if you accept analytics in the notice on the public website. They last up to 2 years and you can withdraw consent from «Cookies» at the bottom of the page.
8. Your rights
Write to hola@linko.sh to exercise your rights of access, rectification, erasure, objection, restriction and portability. You can edit and delete your links and pages from the app and export your link statistics as CSV (Pro). We may ask for reasonable information to verify your identity. You can complain to the Spanish Data Protection Agency (aepd.es) or the data protection authority of your country.
9. Minors and security
linko is intended for people over 16. We apply technical and organisational measures such as encrypted connections, hashed passwords and access controls. No system is infallible; we will handle and notify breaches where the law requires it.
10. Changes
We will publish changes on this page and, if they are significant, let you know by email or in the app.