Privacy policy
Who we are
Link Biscuit operates this website and service. This policy describes how we collect, use, and share personal data when you use Link Biscuit. For questions about this policy, contact us at [email protected].
What we collect
Account data. Authentication is handled by Clerk. We receive a stable user identifier from Clerk and rely on Clerk to process sign-in data (such as email and profile details) according to Clerk's privacy policy and your Clerk project configuration.
Content you create. We store short codes, destination URLs, titles, optional internal notes, Open Graph fields, password protection settings (hashed), expiry, and configuration for static pages in our database (PostgreSQL). HTML you upload may be stored in Vercel Blob and served from your short link after sanitization and security headers.
Short-link analytics. When someone requests a short URL, we may record an event including: timestamp; approximate country/region when provided by the hosting platform (e.g. Vercel x-vercel-ip-country); user agent string; HTTP referrer when sent by the client; and a heuristic flag indicating whether the request looks like a bot or crawler. We do not use this data to sell personal profiles or for third-party advertising.
Operational logs. Our hosting and error-monitoring providers may process IP addresses, request metadata, and error reports to run and secure the service.
How we use data
We use the information above to provide the service, show analytics in your dashboard, enforce quotas and rate limits, detect and prevent abuse, troubleshoot failures, and improve reliability and security.
Legal bases (EEA, UK, and similar)
Where GDPR or UK GDPR applies: for registered users we process account- related and link data as necessary to perform our contract with you. We rely on legitimate interests to operate security, anti-abuse measures, and aggregated or pseudonymous analytics, balancing those interests against your rights. Where required, we will obtain consent (for example for non-essential cookies or marketing) before processing.
Retention
Account and link metadata are kept while your account exists and you keep those links, unless you delete them or we suspend the service for legal or safety reasons.
Raw short-link click records are retained for up to twelve (12) months unless a shorter period is configured for your deployment or applicable law requires otherwise. Older records may be deleted or aggregated. Deleting a link removes its associated click history from our database.
Subprocessors
We use service providers that process data on our behalf, including (depending on your deployment): Clerk (auth), Vercel (hosting, Blob, optional analytics headers), Neon or your Postgres provider (database), OpenAI (optional AI HTML generation), Upstash (optional rate limiting). Their processing is governed by their terms and privacy notices.
Your rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. You may lodge a complaint with a supervisory authority. To exercise rights related to data we control, email [email protected]. For data held only by Clerk, use Clerk's account tools or contact Clerk as described in their policies.
International transfers
Our providers may process data in the United States and other countries. We use contractual safeguards (such as Standard Contractual Clauses) where required for transfers from the EEA, UK, or Switzerland.
Children
Link Biscuit is not directed at children under 16, and we do not knowingly collect their personal information.
Changes
We may update this policy. We will post the revised version here and update the "Last updated" date. Material changes may require additional notice where required by law.
Contact
Privacy requests: [email protected]. To report abusive links, use our abuse report form.