Privacy Policy
In case of divergence, the Portuguese version prevails.
This Privacy Policy explains how Allinks ("Allinks", "we") collects, uses, shares and protects your personal data when you create an account, build your link-in-bio pages and publish them on allinks.me. We process data under the Brazilian General Data Protection Law (Law No. 13.709/2018 — "LGPD").
By using Allinks you agree to the practices described here. If you do not agree, please do not use the service.
1. Who the controller is
Allinks is the controller of the personal data processed through the platform. To exercise your rights or ask about this policy, contact our data protection officer at [email protected].
2. Data we collect
- Account data. Name, email and password (stored only as a hash, never in plain text) provided when you sign up. If you sign in with Google or Facebook, no password is created and we receive from the provider the data described in section 7.
- Content you publish. Titles, links, text, images, themes and the address (slug) of the pages you create. This content is public by nature — it is what your visitors see.
- Usage and analytics data. Visits and clicks on your public pages. To measure audience without identifying the visitor, we do not store the IP address in plain text: it is turned into a scrambled identifier (a hash) using a secret that rotates daily, which prevents both reconstructing the IP and following the same person across days.
- Technical data. The minimum information needed to operate the service and prevent abuse, such as access logs and the device/browser type.
3. How we use your data
- Create and maintain your account and authenticate your sign-ins.
- Publish and serve the link-in-bio pages you build.
- Produce visit and click reports for the page owner.
- Send essential service messages (such as email verification and password recovery).
- Ensure security, prevent fraud and abuse, and comply with legal obligations.
4. Legal bases
We process personal data on the basis of performance of the contract (to deliver the service you signed up for), legitimate interest (security and product improvement, always respecting your rights), compliance with legal obligations and, where applicable, your consent.
5. Cookies and similar technologies
We use strictly necessary cookies to keep your session authenticated and to protect forms (CSRF token). Public pages are designed not to hand data to third parties without your action: embedded videos, for example, only load after you explicitly click them. On the home page, a notice lets you accept or reject behaviour measurement by embedded third-party services; your choice is stored in your browser.
6. Bot protection
The public forms on Allinks — sign-up, sign-in, password recovery and reset, and the address claim on the home page — are protected by Cloudflare Turnstile, a challenge that runs silently and almost never asks anything of you. It exists to tell people from bots and to stop mass account creation, automated password guessing and speculative address claiming.
To do that, Cloudflare receives from your browser the IP address, the TLS fingerprint, the User-Agent header and the widget public key along with the site it sits on. Per Cloudflare's policy, these signals are used solely to detect and block bots — not to identify, profile or target anyone with advertising — and Cloudflare states it cannot identify individuals from them.
Being a security measure required to operate the service, Turnstile is not subject to the consent notice: without it, the forms would be open to automated abuse. The legal basis is our legitimate interest in protecting the platform and the accounts on it. The processing involves an international data transfer, as Cloudflare operates outside Brazil.
The full terms are in the Cloudflare Turnstile Privacy Policy.
7. Sign-in with Google and Facebook
You can create your account or sign in to Allinks with your Google or Facebook account instead of an email and password. Authentication happens on the provider's own side, under its privacy policy; Allinks never sees or receives your Google or Facebook password.
What we receive. We request only the basic
identification permissions — on Google, openid,
email and profile; on Facebook,
email and public_profile. With them we
receive your name, your email address
and whether the provider has verified it, the
URL of your profile picture and your
account identifier at the provider. We do not access
contacts, friends, posts, files, calendar or any other data in your
account, and we never post on your behalf.
What we use it for. Solely to create your account, authenticate your sign-ins and link the social sign-in to an existing Allinks account with the same email — which we only do when the provider confirms the email is verified. The legal basis is the performance of the contract.
What we store. Name and email live in your account, as with any sign-up. From the provider we keep only the link: which provider, your account identifier there, and the email and picture URL it reported on your last sign-in. We do not keep the provider's access token after sign-in. The link is deleted together with your account.
What we do not do. We do not sell, rent or share this data with third parties, we do not use it for advertising and we do not use it to train artificial intelligence models. Allinks' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How to revoke. You can remove Allinks' access at any time in your Google Account connections or in Facebook Settings → Apps and websites. Revoking access does not delete your Allinks account: to sign in again, use another provider or set a password through "Forgot your password". To delete your account and the linked data, write to [email protected].
8. Sign-in and account activity logs
To protect your account and help with support when something goes wrong, we record every sign-in to the platform, including failed attempts: date and time, the method used (password, Google, Facebook or an already open session), the IP address and the user agent (browser and device type).
During the session we also keep the pages visited in the signed-in area (the path, the time and the response status). We do not store form contents, typed passwords or URL parameters; one-time codes and links are replaced with a placeholder. On failed sign-in attempts, the email typed is not stored.
The legal basis is our legitimate interest in keeping the account and the platform secure (section 4). These records are kept for 30 days and then deleted automatically. Access is restricted to platform administrators.
9. Data sharing
We do not sell your personal data. We share data only with providers who help us operate the service (such as hosting and transactional email), who process it under our instructions, and when required by law or by an order from a competent authority.
10. Retention
We keep your data while your account is active and for as long as needed to meet legal obligations. You may request deletion of your account; aggregate report data that does not identify individuals may be kept.
11. Security
We apply technical and organisational measures to protect your data — hashed passwords, isolation between accounts and restricted access. No system is 100% secure, but we work continuously to reduce risk.
12. Your rights as a data subject
The LGPD grants you, among others, the right to confirm that processing exists, access your data, correct incomplete or outdated data, request anonymisation or deletion, port your data and withdraw consent. To exercise them, write to [email protected].
13. Children and adolescents
Allinks is not intended for people under 18 without the proper assistance or authorisation of their guardians. We do not knowingly collect data from children.
14. Changes to this policy
We may update this policy to reflect changes in the service or in the law. When that happens, we will revise the "Last updated" date at the top of this page. Material changes will be announced through the appropriate channels.
15. Contact
Questions about privacy? Write to [email protected]. See also our Terms of Use.