Privacy Policy

We collect information in these categories:

• Account data - email address and authentication identifiers via Supabase Auth when you sign up or log in.
• Product data - videos you tag, tracked links you create, short URLs, placements, and click events generated through your account.
• Click metadata - timestamp, referrer, approximate country (resolved from IP address via a GeoIP lookup), device type (from user agent), and which link or video placement was clicked. We do not store the raw IP address itself. See our Short Links Privacy Notice for what this means if you're someone who clicked a short link rather than a GoloLink account holder.
• Bio Link page-view data - similar metadata (timestamp, referrer, approximate country, device type) recorded when someone views a creator's public Bio Link page. See our Bio Link Privacy Notice for details.
• Billing data - subscription status, plan, and your customer identifier with Stripe or Polar (whichever processor you were billed through). Payment card details are processed by Stripe/Polar directly and are not stored by us.
• Channel scan data - YouTube URLs you submit on the marketing homepage and public channel or video metadata retrieved from the YouTube Data API.
• Product usage data - which GoloLink pages you visit and which features you use (for example "created a link" or "opened billing"), tied to a pseudonymous ID rather than your name or email. See Cookies and Product analytics in the app below.

We use collected information to:

• Provide click attribution, analytics, and short-link redirect services.
• Authenticate users and maintain account security.
• Process subscriptions and enforce plan limits.
• Improve product performance, reliability, and user experience.
• Detect abuse, fraud, and violations of our Terms of Service.
• Respond to support requests and legal obligations.

We do not sell your personal information.

Where required by law (such as GDPR), we process personal data on these bases:

• Contract - providing the Service you signed up for: your account, links, click attribution, and billing.
• Consent - optional analytics and advertising cookies on this device (Google Analytics, the X ads pixel, and PostHog's cookies). Nothing optional loads until you choose, and you can withdraw consent anytime (see Cookies).
• Legitimate interests - security and abuse prevention, and improving GoloLink through pseudonymous product analytics: usage events inside the app and business events our servers record (such as finishing onboarding or starting a subscription). These carry an account ID, never your email or link content. You can object at any time under Settings → Account → Product analytics, which stops both.

You may withdraw consent for optional communications at any time by contacting us.

We rely on trusted processors to operate GoloLink, including:

• Supabase - authentication and database hosting
• Stripe and Polar - payment processing
• DigitalOcean App Platform - application hosting
• Upstash - Redis caching and rate limiting
• MaxMind - GeoIP country lookup for click analytics
• Google - YouTube Data API (public channel scan on the homepage), Google Sign-In, and Google Analytics (if enabled)
• X (Twitter) - conversion-tracking pixel for ad campaigns (if enabled)
• PostHog Inc. (US cloud) - product analytics; requests are proxied through gololink.com/ingest

Each provider has its own privacy policy governing how they handle data. We share only what is necessary for them to perform their services.

Nothing optional loads until you make a choice in the cookie banner. We use:

• Essential - a session cookie set by Supabase Auth to keep you signed in, and a record of your cookie choice. Required for the Service to work; cannot be disabled.
• Optional analytics & advertising - only if you choose Accept: PostHog cookies and local storage (named ph_*) to measure how the site is used, Google Analytics, and the X (Twitter) ads pixel to measure ad campaigns.

If you choose Reject, Google Analytics and the X pixel stay off. PostHog then only counts visits anonymously, without cookies or storing anything on your device (besides remembering your choice), using a privacy-preserving server-side hash instead of an identifier. Until you choose, nothing is counted at all.

Creators' public pages (Bio Link pages, Smart Pick pages, and creators' own domains) load none of these tools, whatever you chose.

You can change your choice anytime: from the banner, from Cookie Preferences in the page footer, or in the app under Settings → Account. Your choice is stored in this browser only, so set it on each device you use - or clear site data for this domain to be asked again.

When you're signed in, we record which features you use so we can see what works and fix what doesn't. These events are pseudonymous: they're tied to your account ID and a few account facts (your plan, whether you've finished setup, when you signed up) - never your email, name, link destinations or other content. Text and links on app pages are not recorded, and we strip personal details such as emails from page addresses before anything is sent.

In your browser, these events follow your cookie choice above: with cookies accepted they're linked to your account; with cookies rejected they're only counted anonymously. Our servers also record a small number of business events for your account (such as signing up, finishing onboarding, or a subscription starting or ending) on the basis of legitimate interest.

To object, turn off Share how I use GoloLink under Settings → Account → Product analytics. That stops product analytics in every browser where you're signed in and the server-side events for your account (allow a few minutes for every server to pick it up).

We retain account and click data while your account is active. You may delete links, videos, and placements within the app. If you request account deletion, we will remove or anonymize your personal data within a reasonable period, except where retention is required by law or for legitimate business purposes such as billing records.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability where applicable

To exercise these rights, contact us using the information below. California residents may have additional rights under the CCPA.

We use industry-standard measures to protect data in transit and at rest, including encrypted connections and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

Privacy questions or data requests? Email us at support@gololink.com or use our contact form.