Privacy Notice

Data controller

Linkiva is an individual project. The data controller is Serdar Şahin. For requests about your personal data, reports of unlawful content and any other question, write to hello@linkiva.space.

What we record about profile visitors

When a profile is viewed or a link is clicked we record: the event type (view or click), the time, country and city as estimated by our hosting provider from the connection, device class, operating system and browser family, only the domain of the site you came from (for example instagram.com), and a utm_source value if the address has one.

We don't store IP addresses for statistics. To count unique visitors, the IP address, browser details and profile id are hashed one-way with a secret key that changes every day. The hash changes the next day; the same person cannot be linked across days or across profiles.

We put no cookies or similar identifiers on visitors. Bots, link previews (WhatsApp, Telegram, X…), browser prefetches and the profile owner's own visits are not counted.

The profile owner only sees totals (how many views, from which countries, on which devices). A single visitor's activity is never shown and is not used to identify anyone.

To prevent abuse, your IP address is used as the key of a rate-limit counter that lasts a few minutes and is deleted when it expires.

Embedded content and outside links

If a profile has a YouTube video, its thumbnail loads straight from YouTube's servers when the page opens, so your browser sends YouTube your IP address and browser details. The player itself (YouTube, Spotify, SoundCloud) doesn't load until you press play. Once it does, that service's own privacy policy applies. YouTube opens in its no-cookie mode (youtube-nocookie.com).

When you tap a link we count the tap and send you on to the destination. That site is responsible for how it handles your data.

Email collection

If you enter your email in a profile's subscribe form, the address is added only to that profile owner's list. The owner is the controller of that list; we store it on their behalf. The owner can see, export and delete entries. To leave a list, write to the owner or to us.

What we process about account holders

• Identity and contact: your email address and display name. If you sign in with Google we receive your name, email address, the address of your profile photo and the sign-in tokens Google issues.
• Security: a one-way hash of your password (never the password itself); in session records, the IP address and browser details of the device you signed in on (listed under Settings → sessions); your encrypted key and backup codes if two-step verification is on; rate-limit counters for sign-in and sign-up attempts.
• Your page: your username and past usernames, name, bio, social accounts, blocks, uploaded images, theme and appearance settings, language and time zone.
• Service records: your notification preferences, the daily check results of your links and your custom domain if you connected one.

The IBAN, phone number and contact details you put in Support, WhatsApp and Contact blocks are published on your page for everyone. Only you add them, and you can remove them at any time.

Purposes and legal bases

• Opening your account, publishing your page and showing your statistics: entering into and performing the contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Account security and abuse prevention (rate limits, two-step verification, security emails): legitimate interest (Art. 5/2-f; GDPR Art. 6(1)(f)) and the data security duty (KVKK Art. 12).
• Transactional email (verification, password reset, security notices), the daily check of your links and the weekly summary you can turn off: performing the contract.
• Aggregate statistics of profile visits: legitimate interest, by a method that doesn't identify anyone.
• Reviewing reports of unlawful content and answering authorities: legal obligation (Art. 5/2-ç; GDPR Art. 6(1)(c)) and establishing, exercising or defending a right (Art. 5/2-e).

Nothing we process relies on your explicit consent. We don't send marketing email.

How we collect data

Data comes from what you type into sign-up and editing forms, Google sign-in, the technical details a browser sends when it visits a profile and the location our hosting provider estimates from the connection, by automated or partly automated means.

Our server makes requests to outside addresses on your behalf only in these cases:

• When you ask for a link preview card or an import: the link's page, your linktr.ee page or your public GitHub repositories are read once, at that moment.
• Daily link check: each published link's address is requested at most once a day. The page's content isn't read, only whether it opens. If a link fails two days in a row we send you one email.
• Latest video: a YouTube channel's public feed is read once an hour to show its newest video.

Who we share data with

We use these providers to run the service. They store and transmit your data only on our behalf; they don't sell it or use it for ads.

• Vercel: the infrastructure the app runs on and the files you upload (Vercel Blob). App servers run in Frankfurt, Germany. If you connect a custom domain, the domain name is passed to Vercel.
• Supabase: the database, in its Frankfurt (Germany) data centre.
• Resend: sending email.
• Upstash: rate-limit counters that last a few minutes, to prevent abuse.
• Google: sign-in, only if you use Google to sign in. Email you send to hello@linkiva.space is forwarded through ImprovMX and stored in Google's email service (Gmail).
• GitHub: only if you import from GitHub, the username you give is looked up on GitHub.
• Public authorities: only when the law requires it.

These providers are based outside Turkey (mostly in the United States), so your personal data is transferred abroad. Transfers are limited to what running the service needs.

How long we keep it

• Account and page data, statistics and your subscriber list: until you delete your account. Deleting it permanently removes all of it, together with the files you uploaded.
• Session records (with IP address and browser details): for security, until you delete your account. You can end your open sessions under Settings at any time; the record of a session you end is deleted.
• Past usernames: they redirect to your new address for 90 days, then they are deleted and the name becomes free.
• Rate-limit counters: from a few minutes up to one day, then they are deleted automatically.
• Email verification and password reset links: invalid once expired, deleted within a day.

Deleted data also drops out of our infrastructure providers' automatic backups shortly afterwards.

Cookies

Profile pages put no cookies on visitors. The site and dashboard only use cookies they need to work or that remember a setting you chose:

• Session cookies: to keep you signed in, up to 30 days.
• "Don't ask on this device" (two-step verification): only if you tick it, 30 days.
• Theme and language preference: to remember your choice, 1 year.

We use no advertising, analytics or tracking cookies.

We don't sell your data

We process the data of profile owners and visitors only to run the service. We never sell it or share it with ad networks, and pages carry no ads or third-party tracking scripts.

We don't use your data to train AI models and don't send it to any AI provider. The insight sentences in your statistics come from simple calculations, not AI.

Security

All connections are encrypted (HTTPS). Passwords are stored only as one-way hashes and two-step verification keys are stored encrypted. Every change is checked on the server against who owns the record. Only the data controller can access the database.

Children

Linkiva is not meant for children under 13. If you notice that someone under 13 has an account, write to hello@linkiva.space and we'll delete it.

Your rights

Under Article 11 of the KVKK (and the GDPR, if it applies to you) you have the right to:

• learn whether your personal data is processed and request information about it,
• learn the purpose of the processing and whether the data is used accordingly,
• know the third parties it is transferred to, in Turkey or abroad,
• have incomplete or inaccurate data corrected, have it erased when the legal conditions are met, and have those changes passed on to the third parties it was shared with,
• object to a result against you that comes solely from automated analysis,
• claim compensation if unlawful processing caused you damage.

You can view, correct and download your data as JSON, and delete your account, under Settings. For anything else, write to hello@linkiva.space from the address registered to your account. We answer free of charge within 30 days. If you are not satisfied with our answer you can complain to Turkey's Personal Data Protection Board; if you live in the EU, to your own country's data protection authority.

Changes

We update this notice as the service changes and announce important changes by email or in the dashboard. The current date is at the top.

If the Turkish and English versions of this notice differ, the Turkish version prevails.