Privacy Policy
⚠️ DRAFT — pending legal review. Professional advice required for GDPR + Albanian data protection compliance. The Albanian version is canonical.
This text has been reviewed against what the code actually does. It describes current behaviour, not intended behaviour.
1. Data We Collect
Identification (from you): name, email address, and a password stored as a bcrypt hash. If you sign in with Google, we receive your Google identifier and email address.
Content you upload: profile title, description, blocks, images and settings. Image metadata — including GPS coordinates — is stripped during re-encoding; it is never stored and never served.
Access data for sessions and security:
- Active sessions store the raw IP address and user agent, which is what lets you see and revoke your own devices.
- The audit log stores the raw IP address and user agent for security actions (email change, data export, account ban, session revocation).
Public profile statistics (when someone visits your public profile):
- The visitor's IP address and user agent are stored as a one-way HMAC-SHA256 fingerprint under a dedicated key, never as readable text.
- Device type (desktop / mobile / tablet), derived from the user agent.
- The referring page without its query string — campaign parameters and tokens are removed before storage.
- Clicks and contact saves are recorded in full; page views are sampled 1 in 5 to keep volume manageable.
- Share events are recorded with the same IP fingerprint.
Slug change history: the old and new slug, the date, plus IP and user-agent fingerprints under the same HMAC key.
Payments: when payments are enabled, they are processed by Stripe or PayPal. We do not store card numbers. We keep transaction identifiers, amount, currency and status.
Two-factor authentication: if enabled for privileged accounts, we store passkey metadata (name, last used) — never the credential material itself.
A note on anonymity. HMAC fingerprints cannot be reversed without the key, but we hold the key. Under GDPR these are pseudonymous data, not anonymous, and we treat them as personal data.
2. Legal Basis
- Contract: to deliver the service you requested.
- Legitimate interest: security, abuse prevention, and public profile statistics.
- Legal obligation: for financial records and the audit trail.
3. Your Rights (GDPR)
Access, correction, deletion, portability, and objection to processing.
The data export (/account/export) covers: your account and roles, profiles with blocks and media, subscriptions, payments, slugs, slug change history, security events from the audit log, and passkey metadata. Statistics are provided as summary counts, not individual rows — those rows are fingerprints of other people's visits, not yours.
Exporting data and changing your email address both require re-entering your password. Google-only accounts have no password and are exempt from that step.
To exercise these rights, email info@1link.al.
4. Third Parties
| Party | What it receives | Where |
|---|---|---|
| Hostinger | application and database hosting | EU (Germany) |
| Stripe | payment data, when payments are enabled | US (SCC) |
| PayPal | payment data, when payments are enabled | US (SCC) |
| only if you choose Google sign-in | US (SCC) | |
| S3-compatible storage | encrypted backup copies; we hold the key | per operator configuration |
| Telegram | backup status messages only — no user data | US |
5. Cookies
We use only essential cookies: the session cookie, the CSRF token, the language preference cookie (app_locale), and — if you choose "remember me" — the recaller cookie together with an absolute session deadline cookie.
We use no analytics cookies and set no third-party cookies. Fonts are served from our own server, so viewing a public profile sends no request to any third party at all.
6. Retention
| Data | Kept |
|---|---|
| Active accounts | Until you delete them. We do not automatically delete inactive accounts. |
| Unverified registrations | Marked deleted after 30 days |
| Deleted accounts | Permanently removed with cascade after 90 days; accounts with financial history are retained for accounting obligations |
| Uploaded files after deletion | Removed by a daily sweep, up to ~24 hours after the rows go |
| Raw clicks and views | 90 days |
| Aggregated daily statistics | Indefinitely |
| Audit log — routine records | 90 days |
| Audit log — security events | Indefinitely. Email changes, exports, bans, session revocations and financial records are kept because they are investigative evidence |
| Sessions | Removed when they expire |
| Share and webhook events | Currently never deleted automatically. The mechanism exists but is disabled |
7. Security
Passwords are stored with bcrypt (12 rounds), must be at least 12 characters, and are rejected if known to appear in a breach corpus. Sensitive actions require password re-confirmation. Sessions carry an absolute deadline and can be revoked per device.
Uploaded media is served only through an authorised proxy that re-checks permissions on every request; SVG files are refused.
In production the server requires HTTPS and sessions are encrypted. The Content Security Policy is currently in report-only mode, not enforcing.
Administrator access to your account. A superadministrator can open a support session inside your account to fix something you cannot fix yourself. Such a session is limited to 30 minutes and ends on its own; it displays a permanent banner while it is running; and it cannot read or change your password, change your billing, export your data, or delete your account. Every session is recorded — who opened it, whose account, when, how long it lasted, and any restricted action attempted — and those records are kept indefinitely rather than pruned. A superadministrator cannot open a session inside another superadministrator’s account.
8. International Transfers
The server and database are in the EU (Germany). Stripe, PayPal, Google and Telegram are US processors under Standard Contractual Clauses (SCC). Backup storage location depends on operator configuration; backups are encrypted before they leave the server.
9. Changes
Updates posted here with change date. Active users notified by email for material changes.
10. Contact
Data controller: 1link.al, Tirana, Albania. Email: info@1link.al.