YOUR INFORMATION

Privacy Policy

1. About this policy

This policy explains what information UndoLink processes when you use the website, create temporary links, use an account, or contact support.

2. Information we process

Information you provide: account email and password; support form name (if provided), email, subject and message; destination URLs and link settings such as custom slug, expiry, scheduled start, click limit, and optional link password.

Information created through use: link slugs, creation and expiry times, click counts and status; click timestamps; account session records; email-verification and password-reset token hashes; password salts and hashes; hashed IP values used for rate limiting; limited technical diagnostics when account creation encounters an error; and records that a new account accepted a particular Terms of Service version, including the account ID, terms version, and acceptance time.

Link-click records support click counts and recent activity. The current application records click timestamps and does not display a visitor's identity to link owners.

3. Browser storage and cookies

For guest links, UndoLink stores link details and the private management key in your browser's local storage so you can manage those links on that device. Anyone with access to that browser profile may be able to access them.

For signed-in users, the website uses an undolink_session cookie configured as HttpOnly, Secure, and SameSite=Lax, with a maximum lifetime of 30 days. The server stores a hash of the session token.

4. How information is used

• Create, redirect, manage, pause, and expire temporary links.
• Apply click limits, scheduled starts, and optional password protection.
• Provide registration, sign-in, email verification, password recovery, and session management.
• Display link activity to the link manager.
• Reply to support requests, apply rate limits, prevent abuse, protect the service, and troubleshoot errors.

5. Service providers

UndoLink relies on Cloudflare to host the website, Worker application, and D1 database; Resend to send account emails; Google Apps Script and Gmail to receive and deliver support requests; Google Fonts for website fonts; and cdnjs for the QR-code library. These providers may process technical information as needed to deliver their services. Provider infrastructure may process or store information in countries other than yours.

6. Sharing and disclosure

We do not sell personal information. We share information with the providers listed above as needed to operate UndoLink. We may disclose information when required by law or reasonably necessary to protect the service, users, or others from fraud, abuse, or security threats.

A temporary link may reveal its destination to anyone who can access the redirect or destination. Anyone with a private management key may be able to manage that link. Anyone who receives a password-protected link and its password may be able to open it.

7. Retention and deletion

We keep information for as long as needed to operate the service, maintain accounts and links, provide support, and address security or legal needs. You can delete individual links using available controls.

The current website does not provide automatic self-service account deletion. To request account or personal-information deletion, contact us through the support page. We will review the request and handle it where appropriate and technically possible, subject to applicable requirements and information we need to retain. Support messages may remain in the support inbox until deleted. The service does not currently publish a fixed retention schedule for all database, diagnostic, or provider-side records.

8. Security

UndoLink uses measures such as password hashing, hashed session tokens, secure session cookies, rate limiting, and access controls for link management. No online service can be guaranteed completely secure. Keep your account password and management keys private and contact support if you suspect unauthorized access.

9. Your choices

You can use guest mode or create an account, choose whether to provide an optional name in the support form, delete links through available controls, and contact support to ask about information associated with your account or request deletion. Clearing browser local storage may remove guest link records and management keys from that device, but does not delete records held by the service.

10. Third-party websites

UndoLink redirects to destination websites chosen by users. Those websites have their own privacy practices; this policy does not cover them. Check their policies before providing information.

11. Changes

We may update this policy as UndoLink changes. The updated date will appear on this page. For important changes, we will take reasonable steps to make them noticeable.

12. Contact

For privacy questions or requests, email undolink.support@gmail.com or use the UndoLink support page.