Privacy policy

Last updated 17 October 2026

This policy explains what Linkrail collects, why, and for how long. It covers our website and dashboard (linkrail.io), our short-link domain (lkrl.ink) and customers’ custom short-link domains (together, the link lane), and our click-tracking domains (lrlclk.com, lkrlclk.com) (the tracking lane).

Who we are

Linkrail is operated by HNK Limited, Unit 1411, 14/F, Cosco Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong. Contact us about privacy at contact@linkrail.io.

People who click links

When someone opens a short link or a tracking link, we record one click with:

  • the time, and which link was clicked;
  • approximate location (country, region, city) provided by our network provider, Cloudflare, from the IP address;
  • device type, operating system and browser, worked out from the browser’s user-agent string;
  • the referring website’s domain name only (for example www.facebook.com), never the full page address;
  • whether the request looks automated (a bot or link preview), so bots can be left out of statistics;
  • a visitor hash: a one-way SHA-256 hash of the IP address, the user-agent and a secret value that changes every day. It lets us count unique visitors within a day. It cannot be reversed to an IP address, and hashes from different days cannot be linked to each other.

We never store IP addresses. The IP address is used in memory, for the duration of the request, to deliver the redirect, look up the approximate location and compute the visitor hash, and then discarded.

Redirect domains set no cookies, run no scripts, and do no fingerprinting or cross-site tracking. We don’t sell click data or use it for advertising.

Google Ads tracking-template clicks

Advertisers can put one of our tracking links in Google Ads as a tracking template. When someone clicks such an ad, Google sends a request to our tracking domain, usually in the background (“parallel tracking”) while the visitor goes straight to the advertiser’s page. For these clicks we record the same information as above, marked as a Google Ads click, plus:

  • the Google click identifier (gclid) if one is present in the request;
  • if the advertiser has turned it on, a random click ID that we add to the destination as trk_cid, so the advertiser can match the click with their own analytics.

Our tracking domains always redirect to exactly the destination shown in the link’s url parameter and never add any other parameters.

Who sees click data

The account that owns a link sees statistics for it and can export click records (without visitor hashes). That account decides why it shares the link and is responsible for telling its own audience about it where the law requires.

Account holders

  • Account: email address and name; your profile picture if you sign in with Google.
  • Content: your links, domains, tags, folders, workspace members and settings.
  • Billing: handled by Stripe. We store your Stripe customer ID and plan, never card details.
  • API keys: stored only as hashes.
  • Security: sign-in sessions; to limit abuse we count requests per IP for short periods, keeping only a keyed hash of the IP.

Why we use data

  • To run the service you signed up for: redirects, analytics, billing and support (performance of a contract).
  • To show link owners statistics about their links, and to protect people from phishing, malware and spam (our legitimate interests).
  • To meet legal obligations, such as tax records for payments.

How long we keep it

  • Individual click records: 24 months, then deleted automatically. Monthly totals used for plan limits are kept while the account exists.
  • Account data and links: while your account is active. When a workspace is deleted, its links and click records are deleted.
  • Abuse reports: as long as needed to handle them and prevent repeat abuse.
  • Billing records: as long as tax law requires.

Service providers

We use these providers to run the service. They process data on our behalf, only for that purpose:

  • Cloudflare: network, redirects, caching and queues (link and tracking lanes).
  • Vercel: hosting for the website and dashboard.
  • Supabase: database.
  • Resend: sign-in and invitation emails.
  • Stripe: payments.
  • Google: Web Risk checks of link destinations (only the destination URL is sent), and Google sign-in if you choose it.

Some of these providers process data outside your country, under appropriate safeguards such as standard contractual clauses.

Cookies

Only the dashboard uses cookies, and only essential ones: a session cookie to keep you signed in, and one that remembers which workspace you last opened. We use no analytics or advertising cookies. Redirect and tracking domains set none.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and complain to your data protection authority. Email contact@linkrail.io. Because we don’t store IP addresses or cookies for people who click links, we usually can’t identify an individual visitor’s clicks.

Changes

We’ll post changes here and update the date above. For significant changes we’ll notify account holders by email. See also our terms and acceptable use policy.