Privacy Policy
Last updated: July 19, 2026
1. Information We Collect
Account information: username, email address, and password (hashed with PBKDF2-SHA256 — never stored in plain text). Usage data: dashboards, cards, sections, and links you create. Technical data: IP address, browser type, and login timestamps — collected strictly for security and abuse prevention. Payment data: payments are processed by Stripe — your card details go directly to Stripe, and we never see or store your card number or CVV.
2. How We Use Your Information
To provide and operate the Service. To send transactional emails (password reset, subscription receipts, renewal reminders). To detect and prevent fraud, abuse, and unauthorized access. To improve the reliability and performance of the Service. We do not use your data for advertising, profiling, or any purpose unrelated to operating LinkTuck.
3. Data Storage and Security
Your data is stored on secure servers hosted by Render.com in the United States. Uploaded files (background images, feedback screenshots) are stored on Cloudflare R2. All data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed using PBKDF2-SHA256 with automatic salting. Database backups are encrypted at rest. We follow industry-standard security practices, but no system is 100% secure — we encourage you to use a strong, unique password. If a data breach affects your personal data, we will notify affected users and, where required, the relevant supervisory authority within the legally required timeframe (72 hours under GDPR, where applicable).
4. Data Sharing
We do not sell, rent, or trade your personal data. We do not share your data with advertisers. We share data only with the following service providers, solely to operate the Service: Stripe (payment processing), Render.com (hosting infrastructure), Cloudflare (CDN and file storage), Resend (transactional email delivery), and Sentry (error monitoring). We may also disclose data if required by law or to protect the rights, safety, or property of VGliese Corp, our users, or the public.
5. Analytics and Tracking
LinkTuck does not use Google Analytics, Facebook Pixel, or any third-party advertising, analytics, or tracking scripts. We do not build advertising profiles. The only usage data we collect is server-side: login timestamps, IP addresses, and activity logs — all used exclusively for security, abuse prevention, and service reliability. We use Sentry to capture application errors so we can fix bugs; error reports may include technical details such as browser type and the actions that led to the error, but are never used for advertising, profiling, or tracking you across other websites.
Do Not Track. LinkTuck does not track you across other websites, and no third parties collect information about your activity on other sites through the Service — so there is nothing for a "Do Not Track" browser signal to disable. We do not change our behavior in response to DNT signals because we do not track you in the first place.
6. Your Rights
You have the right to access your data at any time by using the built-in export feature. You have the right to correct inaccurate data from your Account page. You have the right to delete your account and all associated data. Upon account deletion, your data is permanently removed within 30 days. To exercise any of these rights, email [email protected].
7. EEA and GDPR Rights
If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR). These include the right to request access to your personal data, the right to rectification, the right to erasure ("right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object to processing. Our legal basis for processing your data is contractual necessity (to provide the Service you signed up for) and legitimate interest (security and abuse prevention). To exercise your GDPR rights, email [email protected]. We will respond within 30 days.
International transfers. Our servers are located in the United States, so if you use LinkTuck from the EEA or UK, your data is transferred to and processed in the United States. These transfers rely on appropriate safeguards, including [TODO(owner): verify and name each provider's transfer mechanism — Standard Contractual Clauses and/or the EU-US Data Privacy Framework; Stripe, Render, Cloudflare, Resend, and Sentry each publish theirs in their DPAs].
Complaints. If you believe our processing of your data violates the GDPR, you have the right to lodge a complaint with your local data protection supervisory authority.
8. Data Retention
We retain your data for as long as your account is active. Login attempt logs are retained for 30 days. Activity logs are retained for 90 days. Deleted items are kept in the restore archive for 90 days, then permanently removed. After account deletion, all data — including dashboards, cards, links, and uploaded files — is permanently deleted within 30 days.
9. Cookies
LinkTuck uses only essential cookies required for authentication (session tokens and JWT storage). We do not use advertising cookies, tracking cookies, or any third-party cookie-based services.
10. Children's Privacy
LinkTuck is not directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If you believe a child under 16 has created an account, please contact us at [email protected] and we will promptly delete the account and all associated data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users of significant changes via email at least 14 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes acceptance.
12. Contact
The data controller responsible for your personal data is VGliese Corp, United States [TODO(owner): add registered business address]. Questions about this Privacy Policy? Email us at [email protected].