Who we are
CloakingURL ("CloakingURL", "we", "us") provides a link management service: branded short links, smart routing, link protection, PWA install pages, deep links, QR codes, analytics, an API and webhooks (the "Service"). You can reach us at [email protected].
Customers and link visitors
We handle two kinds of personal information, in two different roles:
- Customer data — information about people who create an account and use the dashboard or API. For this data we decide how it is used and are responsible for it.
- Visitor data — information about people who click a short link, open a link-in-bio page or install a PWA that one of our customers published. We process this data on behalf of that customer, who decides why it is collected. If you clicked a link and have a question about your data, please contact the owner of the link first; we will help them respond.
Information we collect
Information you give us
- Account details: email address, name, password (stored only as a one-way hash), and, if you turn it on, a multi-factor authentication secret.
- Google Sign-In: if you sign in with Google, we receive your Google account ID, email address, whether Google has verified that email, and your name. See Google user data.
- Project content: the links, destinations, routing rules, domains, teams, link-in-bio pages, PWA settings, tags and other content you create, and the email addresses of people you invite.
- Payment details: for crypto payments, the network, token, deposit address, transaction hash, sending address and amount of each invoice. We do not collect card numbers or bank details.
- Affiliate program: if you join, your affiliate code, the USDT (TRC20) wallet address you give us for payouts, and the commissions and payouts on your account.
- Support messages: what you send us when you contact us.
Information collected automatically
- Service logs: IP address, browser type, request times and errors when you use the dashboard or API, used to run and secure the Service.
- API and webhook activity: API key usage, request counts, and webhook delivery results.
- Affiliate link clicks: when someone opens an affiliate link, a one-way hash of their IP address and browser (to count unique visitors; the IP itself is not stored for this), their country, and the time. If they then sign up, their account is marked as referred by that affiliate, who sees a masked version of the email address (for example a***@example.com).
Visitor data (collected for our customers)
When someone opens a short link, link-in-bio page or PWA install page hosted on a customer's domain, the Service records:
- IP address, and the approximate location derived from it (country, region, city);
- device type, operating system and browser, derived from the user agent;
- referring page, UTM parameters, the link and variant served, and the time of the click;
- a pseudonymous visitor identifier (a hash of IP address and user agent), used to count unique visitors;
- for PWA pages, install prompt and install events with a pseudonymous device identifier;
- conversion events (such as a purchase value) that the customer sends to us from their own systems;
- signals used to tell automated traffic from people, when the customer turns on bot filtering.
How we use information
- to provide the Service: create and route links, show analytics, deliver webhooks, and keep your account signed in;
- to authenticate you, including with Google Sign-In and multi-factor authentication;
- to meter usage against your plan and process payments;
- to protect the Service and its users: detect abuse, spam, phishing and malware links, and block harmful destinations;
- to send service messages, such as security notices and changes to these terms;
- to fix problems and improve the Service, using aggregated information where we can;
- to comply with law and enforce our Terms of Service.
We do not sell or rent personal information, and we never use your project content or the data of people who visit your links for advertising. Measurement tags on our own website and dashboard are described under Cookies and local storage.
Google user data
CloakingURL's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- What we access: only the basic profile scopes of Google Sign-In —
openid,emailandprofile: your Google account ID, email address, email verification status and name. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google data. - How we use it: to create your account or sign you in, to link Google Sign-In to an existing account with the same verified email address, and to show your name in the dashboard. Nothing else.
- What we do not do: we do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as needed to run the Service or required by law, and do not allow people to read it except with your permission, for security reasons, or to comply with law.
- Storage and deletion: the Google account ID is stored with your account and deleted with it. You can also remove our access at any time from your Google Account's security settings (Third-party apps with account access).
Data retention
- Account and project data is kept while your account is active. When a project is deleted, its links, teams, API keys and webhooks are deleted with it.
- Click and conversion analytics are kept for the data retention period of the project's plan (30 days on Free, 90 days on Starter, 1 year on Pro, 2 years on Business, or as agreed on Enterprise).
- Invoices and payment records are kept as long as needed for accounting and legal obligations.
- Service logs are kept for a short period for security and troubleshooting.
To delete your account, email [email protected] from the address on the account.
Security
We protect information with encryption in transit (HTTPS), hashed passwords and API keys, role-based access control, optional multi-factor authentication, signed webhooks and access logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; please keep your password and API keys confidential and tell us at once if you suspect unauthorised access.
International transfers
We and our service providers may process information in countries other than yours, including where our servers and Cloudflare's network are located. Where the law requires it, we use appropriate safeguards for such transfers.
Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy;
- correct information that is wrong, and update most of it yourself in the dashboard;
- delete your account and personal information;
- object to or restrict certain processing, and withdraw consent where we rely on it;
- complain to your local data protection authority.
To use these rights, email [email protected]. We may need to verify your identity first. If you are a link visitor, we will forward your request to the customer who owns the link, since they control that data.
Children
The Service is meant for businesses and is not directed to children. You must be at least 16 years old, or the age of majority where you live if higher, to create an account. We do not knowingly collect information from children; if you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. We will post the new version on this page and change the date at the top; for material changes we will also notify account holders by email or in the dashboard before they take effect.
Contact us
Questions or requests about privacy: [email protected].