Privacy Policy

The Link Club (“we”, “us”) provides shoppable link-in-bio storefronts for creators. This policy explains what we collect when creators use their account and when visitors view a storefront or tap a product link. It works alongside our Terms of Service.

When you create and run a storefront, we store:

• Account details: your email address, username and a securely hashed version of your password. We never store your password in plain text.
• Profile: display name, bio, avatar, accent colour, social handles, website and affiliate disclosure text.
• Storefront content: posts, cover images, captions, categories, links to your original posts, and products with their titles, links, images, prices and coupon codes.
• Sessions: a record of your signed-in sessions so you stay logged in, stored as a one-way hash of the session token with an expiry date.

When you paste a product link, our server visits that page to suggest a title, image and price, and saves a resized copy of the image with your product.

When someone views a storefront or taps a Shop button, we record an event so the creator can see how their page performs. Each event contains only:

• Which storefront, post or product was viewed or clicked, and when.
• A hashed daily visitor ID. We combine the visitor's IP address and browser user agent with a secret key and the current date, run it through a one-way hash (SHA-256) and keep only the result. It lets us count unique visitors for a day, cannot be turned back into an IP address, and changes every day, so it can't be used to follow someone over time.
• Device type: mobile, tablet or desktop, worked out from the user agent.
• Referrer host: just the name of the website that sent the visitor, such as instagram.com, never the full address of the page.

We do not store raw IP addresses or full user agents with analytics, and we ignore known bots and link-preview crawlers. To protect the service from abuse, IP addresses are used briefly in memory for rate limiting and are not written to our database. Like most websites, our hosting infrastructure may keep short-lived technical logs, which can include IP addresses, for security and troubleshooting.

We use one essential cookie, tlc_session, to keep creators signed in. It is set only when you log in, is not readable by scripts, and expires after 30 days without activity. We don't use advertising or cross-site tracking cookies, and visitors browsing a storefront don't receive any cookies from us.

• To run your account and publish your storefront.
• To show creators analytics about their own storefront.
• To keep the service secure, prevent spam, fraud and fake clicks, and fix problems.
• To reply when you contact us and to send important notices about your account.
• To meet legal obligations.

We don't sell personal data, and we don't use it for advertising.

• Public by design: your storefront, including your username, display name, avatar, bio, social links, disclosure, published posts and products, can be seen by anyone with the link and may be indexed by search engines. Unpublished posts stay private. Your email address is never shown.
• Creators see aggregate analytics for their own storefront only, never the identity of individual visitors.
• Service providers such as our hosting provider process data on our behalf to run the service, under confidentiality obligations.
• Legal reasons: we may disclose information if required by law, or to protect the rights, safety and security of our users and the public.
• Business changes: if The Link Club is merged or sold, data may transfer to the new owner, who must continue to protect it as described here.

Shop buttons take visitors to third-party stores such as Amazon or Flipkart. Those sites, and any affiliate networks involved, may set their own cookies and collect information under their own privacy policies. We don't control them, so please review their policies before you buy.

• Account, profile and storefront content: until you edit it or delete your account.
• Analytics events: while your account is active, so you can see trends over time. They are deleted with your account.
• Sessions: until you log out, or automatically once they expire.
• Where backups exist, deleted content may remain in them for a short period before it is overwritten.

Passwords are hashed with Argon2, session tokens are stored only as hashes, cookies are HTTP-only, and the site is served over HTTPS. Links are checked before our server fetches them. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect a problem.

You can view and update your profile and storefront at any time from your dashboard, and delete your account from Settings. Depending on where you live, including under India's Digital Personal Data Protection Act, 2023 and the EU and UK GDPR, you may also have the right to access, correct, erase or port your personal data, to withdraw consent, and to complain to a data protection authority.

Visitors: because analytics use a daily-changing hashed ID rather than names, emails or IP addresses, we generally cannot link analytics events to you. Contact us if you have a question or request and we will help where we can.

Creator accounts are for adults. The Link Club is not directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

If we change how we handle data, we will update this page and the “Last updated” date. For significant changes, we will make reasonable efforts to let creators know in advance.

Questions, requests or concerns about privacy? Email support@qkap.app and we'll get back to you.