Privacy Policy

Introduction

Ziglink ("we", "our", or "us") operates ziglink.app, zig.link, and viaqr.io (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

Information We Collect

Account Information

When you create an account, we collect:

• Your GitHub or Google username and profile information (via OAuth)
• Your email address (from your GitHub or Google account)
• Account creation date and subscription tier

Link Data

When you create and manage links, we collect:

• Original destination URLs and short link codes
• Routing rules you configure (geo-location, device, time-based, custom rules)
• Link metadata (titles, descriptions, Open Graph tags)
• QR code generation data
• Password hashes (if you enable password protection)
• Expiration dates and settings

Analytics Data

When someone clicks your short links, we record, per click:

• Click timestamp - When the link was clicked
• IP address - Used at the edge to resolve location and for fraud/abuse detection. Not shown anywhere in your dashboard.
• Location - Country, region, city, postal code, and approximate coordinates, derived from the IP address. Only country-level data is currently shown in your dashboard; the rest is stored but not displayed.
• Device fingerprint - A technical identifier derived from browser and network characteristics (TLS configuration, network provider, user agent, language, and platform) — not from cookies or your IP address. Used to estimate unique visitors.
• Device type and browser - Mobile, tablet, or desktop; Chrome, Safari, Firefox, etc.
• Referrer - Where the click came from (if available)
• Flow execution data - Which path through the routing flow matched (if any)
• QR code flag - Whether the click came from viaqr.io (QR code) or zig.link (regular link)

Legal basis: legitimate interest under GDPR Art. 6(1)(f). This data is necessary to provide the core function of the product — routing each click correctly and showing you where your traffic comes from. It is not sold, not shared with advertisers, and not used for cross-site tracking or ad profiling.

We do NOT: sell this data, share it with advertisers, use it for cross-site tracking or ad profiling, or set a cookie for people who click your links.

Payment Information

We use Stripe for payment processing. We do NOT store your credit card information. Stripe collects and processes:

• Billing name and address
• Payment method details
• Transaction history

Please review Stripe's Privacy Policy for details on how they handle your payment data.

Usage Data

We automatically collect certain information when you use the Service:

• Pages visited and features used
• Session duration and frequency
• Errors and performance metrics

How We Use Your Information

To Provide the Service

• Create and manage your account
• Generate and route short links based on your routing flows
• Track analytics for your links
• Process payments and manage subscriptions
• Provide customer support

To Improve the Service

• Analyze usage patterns to improve features
• Monitor performance and fix bugs
• Develop new features based on user needs

To Communicate with You

• Send service-related notifications (e.g., quota warnings, billing issues)
• Respond to your support requests
• Send product updates and feature announcements (you can opt out)

Data Sharing and Disclosure

We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes. Period.

Service Providers

We share data with trusted third-party service providers who help us operate:

• Cloudflare - Infrastructure and edge computing (hosting, DNS, CDN)
• Stripe - Payment processing
• GitHub & Google - Authentication (OAuth)
• Self-hosted Umami - Product analytics (cookieless, IP-anonymised) that runs on infrastructure we control, no data shared with Umami's vendor
• Self-hosted Bug Sink - Server- and client-side error monitoring (Sentry envelope protocol) that runs on infrastructure we control, no data shared with Bug Sink's vendor

These providers are contractually obligated to protect your data and may only use it to provide services to us.

Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoena, court order, search warrant)
• Requests from law enforcement or government authorities
• Protection of our rights, property, or safety
• Prevention of fraud or abuse

Business Transfers

If Ziglink is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or prominent notice on our Service before your data is transferred and becomes subject to a different privacy policy.

Data Retention

Account Data

We retain your account and workspace information for as long as the workspace is active. There is currently no self-service "delete my account" action; deleting a workspace (Settings → Delete Workspace) immediately and permanently deletes it and everything in it. To have your user login identity itself deleted, contact privacy@ziglink.app and we will process the request manually, except where we're legally required to retain certain data.

Analytics Data

• Active or archived links: Analytics data is kept for as long as the workspace exists. There is currently no automatic expiry beyond what your plan's retention window lets you view in the dashboard (see "Analytics Retention" in our FAQ).
• Permanently deleted links: Deleting a link permanently (from Archived Links) deletes its analytics data immediately, in the same action — not on a delay.
• Deleted workspaces: Deleting a workspace immediately and permanently deletes all of its links, rules, and analytics data.

Backup Data

Data in backups may persist for up to 90 days after deletion but is not accessible or used except for disaster recovery.

Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data transmitted over HTTPS/TLS
• Encryption at rest: Sensitive data (passwords, session tokens) is encrypted
• Access controls: Limited employee access with role-based permissions
• Regular security audits: Monitoring and vulnerability scanning
• Edge infrastructure: DDoS protection and automatic failover

However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your Rights and Choices

Access and Portability

You can access and download your data anytime through your dashboard. For a complete data export, contact support@ziglink.app.

Correction and Deletion

• Update your profile information in account settings
• Delete individual links through the dashboard
• Delete an entire workspace and everything in it (Settings → Delete Workspace); to delete your user login identity itself, contact privacy@ziglink.app

Marketing Communications

You can opt out of marketing emails by clicking "Unsubscribe" in any marketing email. You will still receive essential service notifications (billing, security alerts).

Do Not Track

We do not track end users who click your links across other websites or services — there is no cross-site profile. The data described under "Analytics Data" above is recorded per click on your links and is not linked to activity anywhere else.

Cookies and Tracking Technologies

Essential Cookies

We use cookies strictly necessary for the Service to function:

• better-auth.session_token: Session authentication token (required to stay logged in)
• oauth_return_to: Temporary cookie during OAuth login (deleted after use)
• link_password: Password-protected link access (if you enable password protection)

No Third-Party Tracking

We do NOT use third-party tracking cookies, ad-tech analytics, or advertising cookies. End users who click your links are not cookied, and are not tracked by any third-party ad-tech service. See "Analytics Data" above for what we record ourselves, server-side, about each click.

Product Analytics (Self-hosted Umami)

We use a self-hosted instance of Umami running on infrastructure we control to understand how the dashboard is used (page views, referrers, device class). Umami is configured to be cookieless, store no personal identifiers, and anonymise IP addresses before they reach our database. We use it only on Ziglink's own pages, never on your short links, and rely on it for product improvement and capacity planning. Legal basis: legitimate interest under GDPR Art. 6(1)(f); we balance this against your rights and do not use the data for profiling or advertising.

Error Monitoring (Self-hosted Bug Sink)

We use a self-hosted instance of Bug Sink (Sentry-envelope-compatible) running on infrastructure we control to detect and diagnose application errors. When an error occurs, the report includes the error message and stack trace, the URL where it happened, your browser's user-agent string, and the route id. We do not attach session tokens, request bodies, or PII. Reports are retained no longer than 90 days. Legal basis: legitimate interest under GDPR Art. 6(1)(f), operating a stable, secure service.

Children's Privacy

Our Service is not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately at privacy@ziglink.app.

International Data Transfers

Ziglink operates globally using Cloudflare's edge network. Your data may be processed in countries outside your residence, including the United States and European Union. We ensure appropriate safeguards are in place for international transfers in compliance with GDPR and other data protection laws.

GDPR Compliance (EU Users)

If you are in the European Economic Area (EEA), you have additional rights:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Delete your data ("right to be forgotten")
• Right to restriction: Limit how we use your data
• Right to portability: Receive your data in a machine-readable format
• Right to object: Object to processing for certain purposes
• Right to withdraw consent: Withdraw consent at any time (doesn't affect prior processing)

To exercise these rights, contact privacy@ziglink.app. We will respond within 30 days.

California Privacy Rights (CCPA)

California residents have the right to:

• Know what personal information we collect, use, and share
• Request deletion of personal information
• Opt out of sale of personal information (we don't sell data)
• Non-discrimination for exercising your rights

Contact privacy@ziglink.app to exercise these rights.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify you via email or prominent notice in the Service.

Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have questions or concerns about this Privacy Policy, contact us:

• Email: privacy@ziglink.app
• Support: support@ziglink.app
• Website: ziglink.app/contact