Privacy policy

Who is responsible

The controller for everything described on this page, within the meaning of Art. 4(7) GDPR, is:

hello@linkoria.io

This website

The site you are reading now runs no analytics, sets no cookies, and embeds nothing from anyone else. Its fonts are served from our own domain rather than from Google Fonts, so reading this page sends your IP address to no third party. Two things are still recorded or stored:

• Our hosting provider writes an ordinary server log for each request — IP address, date and time, the path requested, the referring page and your browser’s user agent. It exists to keep the site up and to spot attacks, and entries are deleted after 7 days.
• If you switch between the light and dark theme, that choice is saved in your browser’s local storage. It stays on your device, we never receive it, and clearing your browser data removes it.

Legal bases: Art. 6(1)(f) GDPR for the log, our legitimate interest being a site that stays online and unattacked. The display preference is storage strictly necessary for a function you asked for, § 25(2) no. 2 TDDDG, which is also why there is no cookie banner on this site.

Your account

Creating an account at app.linkoria.io stores:

• your email address;
• the name you give;
• a hash of your password, never the password itself, if you sign up with an email address;
• or, if you use “Continue with Google”, the account identifier, email address, name and profile picture address that Google sends us;
• the date the account was created, and for email signups a one-time activation code that expires.

Legal basis: Art. 6(1)(b) GDPR. This is the data the account is made of — there is no account without it.

Signing in with Google

Choosing “Continue with Google” sends you to Google to log in. Google then tells us your account identifier, email address, name and profile picture address, and we create or open your Linkoria account with them. In that exchange Google decides for itself what it does with the fact that you logged in; we have no part in it and no access to it. If you would rather Google were not involved at all, sign up with an email address and a password instead — the account is identical.

Legal basis: Art. 6(1)(b) GDPR. Google Ireland Limited acts as its own controller here, not as our processor.

The sites you scan

Everything Linkoria reads is public web content, requested the way any visitor’s browser requests it. For each project we store:

• the domain or page address you enter, and the name you give the project;
• the addresses of the pages found through your sitemaps;
• the outbound links on those pages: every redirect each one passes through, the address it finally reaches, and the HTTP status of each step;
• which affiliate network we recognise a link as belonging to, and what changed about it since the previous scan;
• the spreadsheet exports you generate, until they pass the retention period below.

The crawler does not log in, submit forms, or execute JavaScript, and it does not set out to extract names, contact details or other personal information from the pages it reads. What it stores is link addresses and the metadata a scan is made of — but an address can itself carry something about an identifiable person, a profile page or a name in a path, and where it does we process it only as part of the link. Legal bases: Art. 6(1)(b) GDPR for the projects you create and the scans you ask for; Art. 6(1)(f) GDPR where an address met during a scan incidentally contains data about a third party — our legitimate interest being to provide the link monitoring you requested, on no more of the data than that requires.

About LinkoriaBot →

Email we send you

Three kinds, and no others: the confirmation email that activates a new account, password reset emails when you ask for one, and a report for each finished scan. Scan reports can be switched off in the app. The two account emails cannot, because they are how the account works. There is no newsletter and no marketing email.

Messages are queued in our own database and handed to Resend for delivery, which means Resend processes the recipient address and the message. Legal basis: Art. 6(1)(b) GDPR.

When you write to us

If you email us, or use the contact form inside the app, we keep your message and your address for as long as it takes to deal with the matter, and after that only where a statutory retention obligation applies to that particular correspondence, for as long as that obligation runs. The form is rate-limited per IP address so it cannot be used to send mail in bulk.

Legal bases: Art. 6(1)(b) GDPR where the message concerns your account, otherwise Art. 6(1)(f) — our legitimate interest in answering people who write to us, and in a contact form that cannot be abused.

Cookies

None on this site. Two in the application at app.linkoria.io:

• A session cookie named “sid”, set on your first visit rather than when you log in. It carries a signed session identifier and the language you are being shown, nothing else, is restricted to same-site requests, and expires after seven days. It is what keeps you logged in once you are, and what remembers your language before you are.
• A short-lived state cookie set while a Google sign-in is in progress, which exists to stop that sign-in being forged, and is spent as soon as you come back.

Both are strictly necessary under § 25(2) no. 2 TDDDG and need no consent. The light/dark theme is kept in your browser’s local storage in the application as well, and reaches us no more there than it does here. We set no analytics, advertising or tracking cookies anywhere, which is the entire reason you were not asked to accept anything.

Which language you are shown

The application picks your language in this order: a “lang” parameter in the address, if there is one; then the choice already held in your session; then the Accept-Language header your browser sends with every request it makes to any website; and English if none of those settles it. Whatever it lands on is written back to the session cookie, so the next page comes in the same language and the header is not consulted again.

We read that header, we do not store it, and we keep nothing about your language outside the session cookie. This marketing site does nothing of the kind: German lives under /de/, everything else is English, and the language switch is an ordinary link to the other address. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in showing you a page in a language you read.

Who else touches your data

These providers process data on our behalf, each under a data processing agreement as required by Art. 28 GDPR:

• Fly.io, Inc. — hosting for this marketing site, for the application and for the database, in Amsterdam.
• Tigris Data, Inc. — object storage for spreadsheet exports and database backups, in Amsterdam.
• Resend, Inc. — delivery of the emails described above.

Google Ireland Limited is not in this list because it is not our processor: it receives a sign-in only if you choose one, and acts as its own controller when it does. We do not sell data, and we pass it to no one for advertising.

Data leaving the EU

Your data is stored in the Netherlands, and every server that holds it is in the European Union. The three providers above are nevertheless companies incorporated in the United States, and their staff can in principle reach data they host while providing support. Those transfers rest on the European Commission’s standard contractual clauses in each provider’s data processing agreement, and, where the provider is certified, on the EU–US Data Privacy Framework.

How long we keep it

• Scans, their links and their exports: 30 days during early access. A background job deletes anything older, automatically and without being asked. Later plans will state their own periods, and this page will state them too.
• Account data: for as long as the account exists.
• When an account is deleted, its projects, scans, links and exports are deleted from the live systems with it.
• Backups: copies of deleted data can survive in encrypted backups until those expire, 14 days after they are taken. A backup is never read except to recover from a failure.
• Messages you send us: as described above.
• Delivery records at Resend: 30 days.
• Server logs: 7 days.

Your rights

Depending on the circumstances, the GDPR gives you the following rights, at any time and free of charge:

• access to the data we hold about you (Art. 15);
• correction of anything wrong (Art. 16);
• deletion (Art. 17) — there is no self-service delete button yet, so email us and we will do it and confirm when it is done;
• restriction of processing (Art. 18);
• a copy in a portable, machine-readable form (Art. 20);
• and you may object to any processing we base on legitimate interest (Art. 21).

Email is enough; we answer within one month. You can also complain to a supervisory authority. Ours is:

hello@linkoria.io

Supervisory authority

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

You may equally complain to the authority where you live or work.

ldi.nrw.de

What we do not do

• No profiling, and no automated decision with legal effect on you (Art. 22 GDPR). Linkoria classifies links, not people.
• No payment data: Linkoria is free during early access and there is nothing to buy, so none is processed. When paid plans arrive, this page will gain a section naming the payment provider before the first charge.
• No tracking of you across other websites, and no advertising of any kind.

Changes to this policy

We will update this page when what we do changes, and the date at the top will change with it. If a change materially affects data we already hold about you, we will tell you by email rather than leave you to notice it.