Privacy Policy

Account Information

When you register we store your email address, an optional display name and avatar URL, and a bcrypt hash of your password. We never store the password itself and cannot recover it. We also record whether the address has been verified, your plan, your role, and the time you were last active.

If you sign in with Google or GitHub instead, we store the provider name, your account identifier at that provider, and the tokens the provider issues so the connection keeps working. We do not receive your password at those providers.

Usage and Analytics Data

When someone follows one of your short links or opens your Bio Page, we record one row describing the visit. That row contains:

• which link, Bio Page or block was used, and whether it came from a QR code;
• approximate location — country, region, city and continent — taken from headers the network edge attaches to the request, not from a device location API;
• device type, operating system and browser, derived from the user-agent string;
• the referring URL and its domain, and the browser’s preferred language;
• any UTM parameters on the short link;
• whether the request looked automated, and whether it was a new visitor that day;
• the time of the visit and a rotating visitor identifier, described below.

We do not store raw IP addresses. Not in the analytics table, not in the audit log, not anywhere else. The visitor’s IP is used in memory to derive a visitor identifier and to apply rate limits, and is then discarded with the request.

The visitor identifier is a salted HMAC-SHA-256 of the calendar date, the specific link being visited, the IP address and the user-agent string, truncated to 32 characters. Two properties follow from that construction, and they are the reason it is built this way:

• It rotates every 24 hours. The date is part of the input, so the same visitor produces a different identifier tomorrow. It cannot be used to follow anyone across days.
• It differs per link. The link is part of the input, so the same person visiting two of your links produces two unrelated identifiers. It cannot be used to build a profile across links, and it is useless for correlating activity between accounts.

It is a one-way hash of data we do not keep, so it cannot be reversed to an IP address. What it can do is count how many distinct people clicked a link on a given day, which is the only thing it exists for.

Cookies and Local Storage

We set a small number of cookies, all of them first-party and all of them strictly necessary — session, CSRF protection, and remembering that you have unlocked a password-protected link. Preferences such as your theme are kept in your browser’s local storage and never sent to us. The Cookie Policy lists every one by name, purpose and lifetime.

Information from Integrations

If you connect a custom domain, we store the hostname and the DNS records we use to verify it. If you use webhooks, we store the endpoint URL and the delivery history. If you create API keys, we store a hash of the key, its prefix and last four characters, and the time it was last used — never the key itself. If you contact support or submit an abuse report, we store what you send us, including any email address you choose to give.

We use what we collect to:

• run the service — resolve links, serve Bio Pages, render QR codes;
• show you analytics about your own links and pages;
• authenticate you, and keep your account secure;
• enforce plan limits and rate limits;
• bill you for a paid plan and send receipts;
• detect and act on abuse — phishing, malware, spam and the rest of the Acceptable Use Policy;
• send service email you cannot opt out of while you hold an account: verification, password resets, security notices and billing;
• answer support requests;
• comply with legal obligations.

We do not sell personal data, and we do not share it with data brokers. We do not run cross-site advertising trackers, we do not build advertising profiles, and there are no third-party marketing pixels on this site.

We do not use your content or your analytics to train machine-learning models, and we do not sell aggregate click data as a product.

Where the GDPR or a comparable regime applies, we rely on the following bases for processing:

• Performance of a contract — account data, link and Bio Page content, and the processing needed to deliver the plan you signed up for.
• Legitimate interests — keeping the service secure, preventing abuse and fraud, applying rate limits, and producing the aggregate usage measurements a customer needs to run their own campaigns. We designed the analytics pipeline around pseudonymous, rotating identifiers specifically to keep this interest proportionate.
• Consent — optional cookies and any marketing email. You give it explicitly and you can withdraw it at any time without affecting your account.
• Legal obligation — tax and accounting records, and responses to lawful requests from authorities.

Data is held in a PostgreSQL database, with Redis used as a cache and for rate-limit counters. Traffic between you and the service is encrypted in transit with TLS.

Controls that are worth naming because they change what a breach would expose:

• Account passwords and link passwords are bcrypt hashes at cost 12. A database copy does not yield anyone’s password.
• API keys, password-reset tokens and email-verification tokens are stored as SHA-256 hashes. A leaked database cannot be replayed against the API.
• Analytics rows contain no IP address and no raw identifier — only the rotating per-link hash described above.
• Reporter IP addresses on abuse reports, and IP addresses in the audit log, are stored only as salted one-way hashes, used to spot floods from one source.
• Our logger redacts a denylist of sensitive keys so credentials cannot reach log output.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority where the law requires it. To report a vulnerability, write to [email protected].

Account data is kept while your account is open. When you delete your account, your links, Bio Pages, QR codes and analytics are deleted with it. Copies inside routine backups age out on the backup rotation.

Per-visit analytics rows are pruned on a schedule. How far back your account can query is set by your plan:

To be precise about what that means: the pruning job deletes raw visit rows older than the longest window any plan offers — currently 1095 days (3 years) — and the query layer refuses to read past your own plan’s window. So a row from a Free account can physically survive longer than 30 days, but nothing in the product will ever return it, and it carries no IP address and only a hash that stopped being meaningful the day after it was written.

Pre-aggregated daily totals — clicks, unique visitors and QR scans per link per day — are kept for the life of the link. They are how a three-year chart is possible without keeping three years of per-request rows, and they contain no visitor identifiers at all. Deleting a link deletes them.

Abuse reports and audit records are kept while they remain relevant to trust and safety or to a dispute. Billing records are kept for as long as tax and accounting law requires, which is usually several years and is longer than the account itself.

Which providers are active depends on how this deployment is configured. Where they are used, they act as processors on our behalf and receive only what they need:

• Hosting and database providers — everything, as the underlying infrastructure.
• Payment processor — your email address, the plan you chose, and the payment details you enter on its own checkout page. Card numbers go to the processor, not to us.
• Email delivery provider — your email address and the contents of the service email being sent.
• OAuth sign-in providers — only if you choose to sign in with one. They tell us your identifier, email and profile basics.
• URL safety lookup — where enabled, the destination URL of a link is checked against a reputation service. That check sends the URL, not anything about the visitor.

A short link’s destination is a third-party site. Once a visitor arrives there, that site’s own privacy practices apply and we have no visibility into or control over them.

We disclose personal data in four situations, and no others:

• To processors, as listed above, under contracts that restrict them to our instructions.
• To your team, if you belong to one. Team members can see the links, Bio Pages and analytics in the shared workspace, and the activity log shows who did what.
• To authorities, where we are compelled by valid legal process, or where we believe in good faith that disclosure is necessary to prevent imminent harm. Child sexual abuse material is reported to the appropriate authorities without exception.
• In a corporate transaction — a merger, acquisition or asset sale — in which case we will tell you before your data becomes subject to a different privacy policy.

Abuse reports are handled so that they cannot be used against the person being reported or the person reporting. We never tell a reporter who owns a link, and we never tell a link owner who reported them.

Depending on where you live you have some or all of the following rights. We honour them for everyone, not only where they are legally required.

• Access — ask what personal data we hold about you and why.
• Export — get a copy in a machine-readable format. Analytics can be exported as CSV from the dashboard on plans that include export; for anything else, ask us.
• Correction — fix anything inaccurate. Most of it you can edit yourself in account settings.
• Deletion — delete your account from settings, which removes your links, Bio Pages and analytics. Ask us if you want confirmation once backups have rotated.
• Objection and restriction — object to processing we carry out on the basis of legitimate interests, or ask us to restrict it while a dispute is resolved.
• Withdraw consent — for optional cookies, from the Cookie Policy page at any time.

Write to [email protected] to exercise any of these. We will respond within 30 days. We may need to verify that you control the account before acting, because a request to export or delete someone else’s data is exactly what an attacker would send.

If you are in the EEA or the UK and you are not satisfied with our response, you may complain to your local data protection supervisory authority.

Every cookie we set is first-party. There are no advertising cookies, no cross-site trackers, no fingerprinting scripts and no third-party tag managers.

The redirect path sets no cookie at all. When a visitor follows one of your short links, the response is a redirect — nothing is written to their browser, no script runs, and no identifier is planted that another site could read. The single exception is a link you have password-protected: unlocking one sets a signed, HttpOnly cookie scoped to that specific link so the visitor is not asked again for twelve hours.

The full list, with names and lifetimes, is in the Cookie Policy.

Paddek is not directed at children. You must be at least 16 to hold an account, or older where local law sets a higher age, as set out in the Terms of Service.

We do not knowingly collect personal data from children below that age. If you believe a child has given us personal data, write to [email protected] and we will delete the account and its data.

Our infrastructure and our providers may be located in countries other than yours, so operating the service involves transferring data across borders.

Where personal data leaves the EEA or the UK, we rely on an adequacy decision covering the destination country, or on Standard Contractual Clauses with the provider, together with the technical measures described under Data Storage and Security. The analytics pipeline in particular carries no IP addresses and no stable identifiers, which materially reduces what any transfer actually exposes.

We update this policy when the service changes. The date at the top of the page shows the last revision.

If a change materially affects how we handle your personal data, we will tell you before it takes effect — by email to the address on your account, or in the product — and where consent is required, we will ask for it again rather than assume the old answer still applies.

Privacy questions and rights requests: [email protected]

Security reports: [email protected]

The data controller is [Your registered company name], at [Your registered business address].