Privacy Policy

Linklist is run by Quexo Limited, a company registered in England and Wales (company number 16313649), whose registered address is 3rd Floor 86-90 Paul Street, London, United Kingdom, EC2A 4NE. We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Contact us about privacy at [email protected].

• Account details: your name, username, email address and password (stored only as a one-way hash).
• Security data: your two-factor secret and recovery codes (encrypted), the public keys of any passkeys you register, and, if you sign in with Google, GitHub, Facebook or LinkedIn, the account id and basic profile that provider shares with us.
• Your page: everything you choose to publish, such as your display name, bio, photo, links and theme. This is public by design.
• Billing: if you buy a paid feature, Paddle gives us your customer id, subscription status, plan and country. We never see or store your card details.
• Visits to pages: when someone views a Linklist page or clicks a link on it, we record the time, the page and link, the website they came from, their device type and an anonymised code that changes every day. We use no cookies for this and store no IP addresses. Page owners see the totals.
• Signup forms: an email address left on a page's signup form is collected for that page's owner, who decides how to use it. We store it and make it available to them. To be removed, ask the page owner or contact us.
• Team invitations: when someone invites you to help run a page, we store your email address to send the invitation, and delete it once you accept or it is cancelled.
• Reports: if you report a page, we keep what you tell us and, if you give it, your email address so we can follow up.
• Technical data: your IP address, browser and device type, kept with your sign-in sessions and in short-lived server logs, to keep accounts secure and fix problems.

• To provide Linklist (performing our contract with you): running your account and page, signing you in, and providing paid features.
• To keep it safe (legitimate interests): preventing fraud, abuse, phishing and account takeover.
• To talk to you (contract and legitimate interests): security alerts, receipts, and important changes to the service or these policies. We will only send marketing email if you opt in, and you can opt out at any time.
• To meet legal duties (legal obligation): for example keeping records required for tax.

We don't sell your personal data or share it for advertising. We share it only with providers who help us run Linklist, under contracts that require them to protect it:

• Paddle.com, our reseller and Merchant of Record, which processes payments, tax and invoices. Paddle is an independent controller of the data you give it at checkout; see Paddle's privacy notice.
• Resend, which delivers our emails, such as sign-in and verification messages.
• Our hosting and database providers.
• Google, GitHub, Facebook or LinkedIn, only if you choose to sign in with them.

We may also disclose data if the law requires it, or to protect people from harm.

Some of our providers process data outside the UK. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement (or Addendum to the EU Standard Contractual Clauses) to keep it protected.

We keep your account data while your account is open. When you delete your account, we delete your profile and personal data within 30 days, except for backups (overwritten within a further 30 days) and records we must keep by law, such as billing records, which are kept for up to 7 years.

We only use cookies that Linklist needs to work, so we don't ask for consent to them:

• a session cookie and a security token, to keep you signed in and protect forms;
• an optional "remember me" cookie, if you tick it when signing in;
• preference cookies for light/dark mode and the sidebar.

Paddle's checkout, which loads only when you choose to buy something, sets its own cookies for payment and fraud prevention.

You can ask to access, correct, delete or export your data, and to object to or restrict how we use it. You can change most details, or delete your account, yourself from Settings. For anything else email [email protected]; we will reply within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local data protection authority.

Every account is protected by two-factor authentication. Passwords are hashed, secrets are encrypted, and all traffic uses HTTPS. If a breach affects your data, we will tell you and the ICO as the law requires.

Linklist is not for anyone under 16. If you believe a child has created an account, contact us and we will delete it.

If we change this policy in a way that matters, we will email you before the change takes effect. The date at the top shows when it was last updated.