Privacy Policy

Everylink (“we”, “us”) is the controller of the personal data described here. For profile statistics, the creator who owns a profile decides to collect them; we process that visitor data to provide the service. Contact us at support@everyl.ink.

If you have an account

• Email address and name — to create your account and send you sign-in links. Sign-in links are single-use, expire after 24 hours and are stored only as a hash.
• Session data — when you sign in we store a session record (including the IP address and browser user agent of the sign-in) so you stay signed in for up to 60 days.
• Your profiles and content — names, bios, images, links and other blocks you publish, plus custom domains you connect. Published profiles are public. If you turn on the showcase setting, your page's name, bio, avatar and link may be shown on our homepage; you can turn it off anytime.
• API keys — we store only a hash and a short prefix of each key, never the full key.
• Billing — Stripe handles payments. We store your Stripe customer and subscription IDs and subscription status. We never see or store your card number.
• Agency access and referrals — which accounts you've granted access to your profiles, and, if you joined through or share a referral link, who referred whom and the reward status.
• Messages — anything you send us by email.

If you report a profile

• Abuse reports — when you use the “Report” link on a profile we store the profile address, the reason you chose, the details you write, your email address if you give one, and the country your request came from. We don't store your IP address. The report is emailed to our team so we can review it.

If you visit a profile

• Statistics — after you've viewed a page for about 10 seconds, and when you click a block, the page sends an event with: the page address (including campaign parameters), the referring site, your browser language, time zone, screen and window size, and a random session ID kept in your browser tab. Our analytics service derives your approximate location (country, region, city) and device type from the request. It doesn't use cookies or a persistent visitor ID; visits are grouped with a server-side identifier that rotates daily.
• Location-based content — a creator can show or hide blocks by country or device. We decide this per request from the location Cloudflare derives from your IP address and your browser's user agent; we don't store that decision.
• Embedded content — a profile may embed maps (loaded from unpkg.com and OpenStreetMap) or videos (YouTube's privacy-enhanced mode, Vimeo, Loom). Those providers receive your IP address when the embed loads and apply their own policies.

On our website and dashboard

• Site statistics — our marketing pages (such as the home, pricing and legal pages) use the same cookieless analytics to count visits.
• Error and performance monitoring — if something breaks we send error reports to Sentry (from our website, dashboard, API and public profile pages), which can include your IP address, browser details and the page you were on. Inside the signed-in dashboard only, for a sample of sessions (and sessions where an error occurs) Sentry records a session replay with all text masked and media blocked.
• Fonts — our marketing pages serve their fonts from our own domain. Only the sign-in and onboarding pages load a typeface from Google Fonts, which receives your IP address.
• Server logs — our hosting provider processes IP addresses and request details to deliver the service and protect it from abuse.

• To provide the service you signed up for (contract): your account, sign-in, profiles, publishing, custom domains, API keys, agency access, billing.
• Legitimate interests: keeping the service secure and working (error monitoring, logs, abuse screening and handling abuse reports), showing creators aggregate statistics about their pages, and running the referral programme.
• Legal obligations: tax and accounting records, and responding to lawful requests.
• Consent: where the law requires it; you can withdraw consent at any time.

We don't sell personal data. We share it only with service providers that help us run Everylink:

• Cloudflare — hosting, database, file storage (including your uploaded images), edge delivery, custom domains, and email delivery (sign-in links and abuse report notifications).
• Stripe — payments, invoices and the billing portal.
• Sentry — error and performance monitoring.
• Our analytics service — collects and aggregates the visit statistics described above.
• Google Safe Browsing — links you add to profiles are checked against Google's list of unsafe sites.
• Our hosting provider — runs the referral service.
• Google Fonts — serves a typeface on the sign-in and onboarding pages.

People you grant agency access to can see and edit that profile and its statistics. We may also disclose data if the law requires it or to protect people from harm.

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where the law requires, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses offered by these providers.

• Account data: while your account exists, then deleted when you delete your account (see below).
• Abuse reports: while the reported profile exists; they are deleted with it.
• Profiles and their blocks, images and custom domains: until you delete the profile, which removes them (cached copies expire shortly after).
• Sign-in sessions: up to 60 days after your last activity, or until you sign out.
• Billing records: as long as tax and accounting law requires.
• Visit statistics and error reports: kept by our analytics and monitoring providers for their configured retention periods, then deleted.

Depending on where you live, you can ask to access, correct, delete or export your data, and to object to or restrict how we use it. You can edit or delete your profiles and revoke API keys yourself in the dashboard; for anything else, email support@everyl.ink. We'll answer within one month.

Deleting your account

You can permanently delete your account from Account settings. This immediately cancels your subscription, deletes every profile you own (including its blocks, uploaded media and published page), and removes your API keys, sessions, sign-in links and billing record. Profiles you manage for clients stay with the client, and billing for them goes back to the client. Your referral activity is erased too; if a referral reward was already earned or paid, we keep that financial record with your identity removed. Stripe keeps its own payment records as the law requires. Your account on our separate analytics product is not removed automatically yet — email support@everyl.ink to have it deleted.

If you're unhappy with how we handle your data, you can also complain to your local data protection authority.

Everylink isn't directed at children under 16 and they may not create an account. If you believe a child has given us personal data, email support@everyl.ink and we'll delete it.

We'll update this policy when our practices change, change the “Last updated” date above and, for material changes, email account holders.

For privacy questions or requests, email support@everyl.ink.