Privacy policy
This policy explains what personal data Linkonda processes when you open a short link, visit linkonda.com, shorten links, or use an account, the browser extension or the MCP server: why we process it, who receives it, how long we keep it, and what rights you have.
1. Who is responsible
The controller under the GDPR is Verano, a sole proprietorship (Einzelunternehmen) in Mainz, Germany. Our postal address is in the imprint. For any question about your data, or to use your rights, email support@linkonda.com.
2. When you open a short link
When you open a short link on lnko.eu, or on a custom domain its owner has set up, our server looks up the link's destination and redirects you to it. If the request comes from a person rather than a link preview or a crawler, the link's click count goes up by one. We tell the two apart from the request's headers at that moment and store none of them. If the link's owner has turned on webhook notices, the first click on a link also sends them the link's slug, its click count and the time of that click, which we keep with the event. It contains nothing about you. Apart from that notice, and the error record described below if our server fails to answer, we store nothing about the visit: not your IP address, browser, device, referrer or location, not the time of your click, and no record of the individual click.
Short links set no cookies.
Our server writes a log line for each request to our API with the method, the path, the response status, the time taken and when it was made. It contains no IP address. Other requests, short-link redirects included, are logged only when our server fails to answer them, and such a failure is also recorded as an error (section 12). Microsoft Azure, which runs our server, processes your IP address to deliver the request. Once you reach the destination, its operator's privacy policy applies; we don't control what that site collects.
3. When you visit linkonda.com
The website is served by Azure Static Web Apps, which processes your IP address to deliver the pages from Microsoft locations around the world, usually one near you. The website's calls to our API, for example when you shorten a link or sign in, are logged as described in section 2. We measure page views and a small set of actions, such as a link being created or a checkout being started, with Umami Cloud, an analytics service that sets no cookies. For each page view, Umami receives the page's address without its query string or fragment, the page title, the referring site, your screen size and language, and, from your browser's request, your IP address and browser details, from which it determines your browser, operating system, device type and country. Umami states that "no personally identifiable information is stored" and that it identifies visitors "with an anonymous session identifier and no cookies". The actions we record carry only details such as which page or button was used, a plan name or a number; never your email address, your account id, a short link's slug, a destination URL, an API key, a webhook URL, a custom domain or anything you typed. QR codes are drawn in your browser, from the short URL on the result card, or from the address you enter on the QR code generator; neither the image nor that address is sent to us. The calendar reminder the result card offers is made in your browser too: the file holds the short URL, its expiry date and a link to this website, and it isn't sent to us. We count clicks on it and visits from its link, with no detail.
The website keeps a few items in your browser's storage, which it never sends to analytics:
- the ids of up to 25 links you shortened while signed out, so they can be added to your account (section 6), and, for the newest 10, their short address and expiry date, so the home page can list them with their click counts. The ids are kept for 30 days after you last shortened a link (ids waiting for you to confirm your email address after registering or signing in here, kept with your account id, for 7 days), and each address and date until that link expires; after that, the website removes them the next time you open any of its pages in this browser. The list also goes when its links are added to an account, when you sign out, or when you choose 'Forget these links'. To show the click counts, the website asks our server for each listed link's total, sending only that link's short address and id, with no cookie;
- the paid plan you picked before signing in, so checkout can open once you are signed in. It is used for up to 48 hours and removed when checkout opens, or the next time the website reads it after those 48 hours;
- the number of links just added to your account, until your dashboard has shown it;
- while you sign in with Google, a note in that browser tab that the sign-in started there, removed when you return to the website or close the tab, so that links are added only to an account that signed in from this browser.
4. Cookies
When you sign in, our API sets a cookie named linkonda_session that keeps you signed in for up to 30 days. It holds a random session id. If you sign in with Google, a cookie named linkonda_google_oauth protects the sign-in against forgery. It is deleted when the sign-in completes, and expires after 10 minutes at the latest. These two cookies are the only cookies Linkonda sets. We use no advertising or tracking cookies.
5. When you shorten a link
When you shorten a link, we store its destination URL, the short link's slug, when and how it was created (for example on the website, through the API or from the browser extension), its expiry date and its click count. For an A/B split link, we also store each destination's URL, weight and click count.
If you are not signed in, we also store a one-way hash of your network address with each link, so that we can limit how many active links one network creates without an account. The hash is computed with a secret key, from your IPv4 address or, for IPv6, from the first half of the address (the /64 network your internet provider assigns to your connection). The address itself is never stored. We delete the hash from a link when the link is added to an account (section 6), and within a day after the link expires or is deleted. The link itself is kept, as described below. To limit abuse, our server also counts requests per network address, in its memory only, for a few minutes. These counts are never written to disk.
Once destination checking is switched on, we will send each link's destination URL, before the link is saved, to Google Web Risk, a Google Cloud service that checks addresses against Google's lists of malware, phishing and unwanted software. This will happen whenever a destination is created or changed, including every URL in a batch and every destination of an A/B split link, whether it comes from the website, the API, the browser extension or the MCP server. Google will receive the URL as it is, but nothing about who submitted it. We may then also send destinations that are already stored to the same check, to find links that point to harmful sites. A destination that Google lists as unsafe will then be refused automatically. If you think a refusal is wrong, email support@linkonda.com.
We never delete a short link's record, so that a published short URL can never start pointing somewhere else. An expired link stops redirecting, and a link you delete stops working and leaves your account, but its record, including the destination, stays in our database.
6. Adding links you made while signed out to your account
If you shortened links while signed out and then create an account, sign in or verify your email address, the website sends their ids to our server. The server adds to your account those links that are still active and were created from the network you are using now. The browser extension passes its links' ids to the website in the part of the address after the #, which browsers don't send to any server. When a link is added to your account, we delete the network-address hash from it.
7. Accounts
You don't need an account to shorten links. To create one, you need an email address; without it we can't open an account, send you sign-in emails or bill you. For an account we store your email address, a hash of your password (if you set one), your Google account id (if you sign in with Google), your plan, whether and when you verified your email address, whether you unsubscribed from the emails about getting started that we used to send, when you created the account, and when you last used it (updated at most about once an hour). Signing out deletes your session from our server; otherwise a session stops working after 30 days. API keys are stored only as a keyed hash, with the name you gave them, their first characters and when they were created, last used and revoked; we can't show a key again after it is created. If you set up webhooks, we store the endpoint URL and a signing secret, send the events you chose to that URL, and keep each event with its delivery status. If you add a custom domain, we store its hostname and look up its DNS records to verify it. If you remove it after links used it, we keep its hostname with your account, so that its short links are never reused.
8. Signing in with Google
You can create an account or sign in with Google instead of a password. If you do, Google learns that you are signing in to Linkonda, and sends us your Google account id, your email address and whether Google has verified it. The standard sign-in also gives us access to your basic Google profile, but we don't store your name or picture. If a Linkonda account with the same email address exists, your Google sign-in is linked to it. Google processes your sign-in as the provider of your Google account, under Google's privacy policy.
9. Email
We send email through Resend, which receives the recipient's address, the subject and the message. We don't track whether you open our emails or click their links. We send only the messages the service needs: to verify your email address and to reset your password. A message waiting to be sent is deleted once it is sent or when its delivery deadline passes. We keep only a record of which messages we sent you, without their content.
10. Payments
Payments are handled by Stripe. When you start a checkout, we send Stripe your email address (or your existing Stripe customer id), your Linkonda account id and the plan you chose. You enter your card and billing address on Stripe's page; we never see your card details. From Stripe we keep your customer and subscription ids, your subscription's status and renewal date, and, for each invoice, Stripe's invoice id, its status, amount, currency, payment date and a link to it. Stripe also processes payment data as a controller, under Stripe's privacy policy.
11. Browser extension and MCP server
The browser extension reads the address of the current tab only when you click its icon, and sends that address to our API to shorten it. Your recent links (up to 25) stay on your device. The MCP server runs on your own computer and sends requests only to our API: with your API key if you set one; without one, links are made as when you're signed out (section 5).
12. Error monitoring
When something goes wrong in our server, Microsoft Azure Application Insights records it so that we can find and fix it: an error in our code, a request to our API that fails with an error on our side, or a failed call from our server to another service, such as our database or our email provider. A record holds what failed and when, with the request's method and its path without the query string, or the name of the service that was called. It contains no IP address, location, browser details, cookies, request headers or request bodies. Requests that succeed and short-link redirects are not recorded; if our server fails while handling a short link, only the error and the link's slug are.
13. Who receives data
These providers receive data from us. Google (for sign-in) and Stripe also act as controllers (sections 8 and 10).
- Microsoft Azure: our database, in Germany (region Germany West Central); our server, in the Netherlands (region West Europe); our error records in Application Insights (section 12), in the EU; and our website, from Microsoft locations worldwide. Azure holds or receives everything this policy says we store or receive.
- Resend (Plus Five Five, Inc., USA): the emails we send you (section 9). Resend sends them from the EU (Ireland) and stores email metadata and logs in the United States.
- Umami Cloud (Umami Software, Inc., USA): website analytics (section 3). Data may be stored in the United States.
- Stripe (Stripe Payments Europe, Limited, Ireland): payments (section 10). Data may be processed in the United States.
- Google: sign-in with Google (section 8) and, once it is switched on, Google Web Risk, a Google Cloud service, for checking destinations (section 5). Data may be processed in the United States.
We don't sell personal data and don't use it for advertising.
14. Transfers outside the EU
Resend, Umami, Stripe and Google are based in the United States or may process data there. Microsoft stores our data in the EU regions named above, but belongs to a group based in the United States. Microsoft, Google and Resend are certified under the EU–US Data Privacy Framework and also use the EU Standard Contractual Clauses; Umami relies on the EU Standard Contractual Clauses; Stripe relies on the Data Privacy Framework and, where it does not apply, the Standard Contractual Clauses. To get a copy of these safeguards, email support@linkonda.com.
15. Legal bases
Redirecting short links, shortening links, accounts, adding links to your account, the emails the service needs, payments and the browser extension: performing our contract with you, or steps you ask for before one (Art. 6(1)(b) GDPR). For visitors of short links: our and the link owner's legitimate interest in delivering the link (Art. 6(1)(f) GDPR). Checking destinations, the limit on links without an account, rate limits, server logs and error records: our legitimate interest in keeping the service secure and free of abuse (Art. 6(1)(f) GDPR). Website analytics: our legitimate interest in understanding how the site is used, without cookies or profiles (Art. 6(1)(f) GDPR). Invoice records: our obligations under tax law (Art. 6(1)(c) GDPR). The session and Google sign-in cookies are strictly necessary to provide a service you explicitly requested (§ 25(2) no. 2 TDDDG), and the items in section 3 kept in your browser's storage are needed for the features they name (§ 25(2) no. 2 TDDDG).
16. How long we keep data
Short links: kept, as section 5 explains, so that a short URL never changes meaning. The network-address hash on a link made without an account: until the link is added to an account, and no longer than a day after the link expires or is deleted. Account data: for as long as the account exists. Invoice records: 8 years, as German tax law requires for accounting records. Rate-limit counts: a few minutes, in our server's memory only. Server logs and error records: 90 days at most. To delete your account, email support@linkonda.com. We delete your account data, except the invoice records we must keep and the short-link records described in section 5. Our database also keeps automatic backups for 7 days, so data we delete is gone from them 7 days later.
17. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest (Art. 15–18, 20 and 21 GDPR). To use these rights, email support@linkonda.com. Because nothing we store identifies visitors of short links, we can't tell which visit was yours, so we hold no data about you as a visitor that we could give you. You can also complain to a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz. When this policy changes, we update the date at the top of this page.