Privacy Policy

LinksWatch ("we", "us", or "our") is a product of Numlock Studio, a business registered in New Zealand. Numlock Studio is the data controller for your personal information. This Privacy Policy explains how we collect, use, and protect your information when you use our service at linkswatch.io.

1. Information we collect

We collect the minimum information needed to provide the service:

• Account data — your email address and a hashed password when you sign up.
• Link data — destination URLs, short codes, tags, and QR customisation settings you provide.
• Click data — each time one of your short links is visited we record a timestamp and basic request metadata: approximate country and city, device type, browser, operating system, and referrer. This metadata is recorded on all plans; the full analytics dashboards and CSV export that surface it are a paid-plan feature. We do not store raw IP addresses; however, we derive and store a pseudonymous visitor identifier (a one-way hash of IP address and browser user-agent string) to count unique visitors. This hash cannot be reversed to recover the original IP address but is retained with click records.
• Website analytics — on our public marketing pages (homepage, landing pages, documentation) we collect anonymised page view data, scroll and click patterns, and session recordings to understand how visitors use our website. This data is not collected on authenticated pages (your dashboard, settings, or any page behind login). See section 3 for the tools we use and how to opt out.
• Check data — HTTP status codes and response times recorded during automated uptime checks.
• Billing data — your subscription plan and status. Payment card details are processed by our payment provider and are never stored on our servers.
• Notification preferences — email and Slack alert settings you configure in your account.

2. How we use your information

• To operate and improve the LinksWatch service.
• To send uptime alerts and recovery notifications you have opted in to.
• To enforce plan limits and feature access.
• To respond to support requests.
• To comply with legal obligations.

We do not sell your personal information to third parties. We do not use your data for advertising.

3. Cookies, local storage, and analytics tools

We use cookies and browser local storage to maintain your authenticated session. On our public marketing pages we also use the following analytics tools:

• Microsoft Clarity — records page visits, clicks, scroll depth, and session recordings on marketing pages only. Clarity may set its own cookies. No personally identifiable information (PII) is intentionally sent to Clarity. Data is processed by Microsoft under their privacy statement. You can opt out via Microsoft's Clarity opt-out.
• Mixpanel — tracks page view events (URL, page title, referrer) on marketing pages only. Mixpanel data is stored in browser localStorage, not cookies. We do not identify or link analytics events to your LinksWatch account. Mixpanel respects the Do Not Track browser setting — if DNT is enabled, no Mixpanel data is collected. You can also opt out via Mixpanel's opt-out page.

Neither tool is loaded on authenticated pages. No analytics cookies are set after you log in.

4. Data sharing and sub-processors

We share data with the following sub-processors to run the service:

• Supabase — database and authentication (AWS us-east-1).
• Vercel — application hosting and edge functions.
• Stripe — payment processing. Card details are entered directly on Stripe's servers and are never stored by us.
• Resend — transactional email delivery.
• Slack — if you configure a Slack webhook, alert payloads are sent to Slack's servers.
• Microsoft Clarity — website behavioural analytics on public marketing pages (see section 3).
• Mixpanel — website event analytics on public marketing pages (see section 3).

We do not share your data with any other parties unless required by law.

5. Data retention

Your account data and link data are retained for as long as your account is active. Click events older than 12 months may be aggregated and the raw records removed to control database size. You may request deletion of your account and all associated data at any time by emailing our contact form.

6. Security

All data is transmitted over TLS. Account passwords (used to log in to LinksWatch) are hashed using bcrypt via Supabase Auth. Link passwords (optional password-protection on individual short links) are stored using HMAC-SHA256 with a random per-link salt. We do not log request bodies that contain passwords. Access to production infrastructure is restricted to authorised personnel only.

7. Your rights

Depending on your location you may have rights to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Export your data in a machine-readable format (CSV export available in the Analytics page).
• Object to or restrict processing.

To exercise any of these rights, email us at our contact form.

8. New Zealand Privacy Act 2020

Numlock Studio is based in New Zealand and complies with the New Zealand Privacy Act 2020. As a New Zealand agency, we adhere to the Information Privacy Principles (IPPs) set out in the Act. These principles govern how we collect, store, use, and disclose your personal information.

Privacy Officer: Our Privacy Officer is responsible for ensuring compliance with the Privacy Act 2020. You can contact our Privacy Officer via our contact form for any privacy-related queries or requests.

Cross-border disclosure: Some of your personal information is processed by sub-processors located outside New Zealand (see Section 4). In accordance with IPP 12, we take reasonable steps to ensure that overseas recipients are subject to comparable privacy protections. Where required, we use contractual safeguards (such as Standard Contractual Clauses) to protect your information.

Complaints: If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Office of the Privacy Commissioner (Te Mana Mātāpono Matatapu).

9. Children

LinksWatch is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or via a notice in the dashboard. Continued use of the service after the effective date constitutes acceptance of the updated policy.

11. Contact

Questions about this policy? Email us at our contact form or write to:
Numlock Studio, New Zealand.