# Privacy Policy

> What data Klyk processes, why, for how long, with whom, and how to exercise your rights — for account holders and link visitors alike.

- Web page: <https://getklyk.io/en/legal/privacy>
- Breadcrumb: [Klyk](https://getklyk.io/en) › [Legal](https://getklyk.io/en/legal) › Privacy
- Version française: <https://getklyk.io/legal/privacy.md>

Klyk is built to measure links without watching the people who follow them. This policy says exactly what we process, and what we do not.

In effect since November 15, 2026 · Version 2026-11-15 · This is a translation of the French version, which prevails.

## In short

- Your links’ visitors get **no cookie**, and their IP address is **never stored**: it is used for an instant to derive a country and a pseudonymous fingerprint.
- Visit details are deleted after **90 days**; only daily totals are kept after that.
- Our servers are hosted in the European Union. A few providers — carrying the site’s traffic and anti-bot checks, email delivery, Google, GitHub or GitLab sign-in, destination checks — are based in the United States.
- We sell no data and show no advertising.
- You can **export your data** and **delete your account** at any time, from the Account page.

This summary helps you read the text; it does not replace it.

## 1. Who we are

Klyk is published by **Klybase Labs LLC**, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States (“we”, “us”).

For any question about your data, or to exercise your rights: [privacy@getklyk.io](mailto:privacy@getklyk.io).

## 2. Two roles, depending on who you are

- **You have a Klyk account**: we are the controller of your account data (section 3).
- **You followed a Klyk link or viewed a Klyk page**: your visit is measured on behalf of the link’s owner, who is the controller; we act as their processor (section 4). We remain the controller of the processing we carry out to keep the Service safe, such as checking destinations and handling reports.

## 3. Account holders’ data

| Data | Purpose | Legal basis | Retention |
| --- | --- | --- | --- |
| Email address, password (hashed with bcrypt, never stored in clear), display name, avatar | Create and manage your account, authenticate you | Performance of the contract | Until the account is deleted |
| On email sign-up: IP address, browser and technical signals about the connection, sent to Cloudflare Turnstile | Check that the sign-up is made by a person and not a bot | Legitimate interest (preventing abuse) | Not kept by Klyk: only the result of the check reaches us |
| If you sign in with Google, GitHub or GitLab: your identifier with that provider, email address, name, and the access token it issues (stored encrypted) | Sign you in without a password | Performance of the contract | Until the account is deleted |
| Your links and their destinations, rules, variants, pages, domains, tags, images, QR code settings | Provide the Service | Performance of the contract | Until they or the account are deleted |
| Sessions: browser, pseudonymous fingerprint of the IP address, dates | Keep you signed in; let you see and end your sessions | Performance of the contract; legitimate interest (security) | Until they expire (30 days at most) or you sign out |
| Sign-in history: date, sign-in method, success or failure, browser, operating system, country, pseudonymous fingerprint of the IP address | Account security; show you recent activity | Legitimate interest (security) | 180 days |
| Sign-in codes, email confirmation and password reset links | Verify your address, sign you in, reset your password | Performance of the contract | Until used or expired (10 minutes to 24 hours) |
| Version of the Terms accepted and date of acceptance | Keep proof of our agreement | Performance of the contract; defence of our rights | Until the account is deleted |
| Service emails: address confirmation, codes, security and moderation alerts | Inform you about your account and your links | Performance of the contract; legal obligations | Removed from our sending queue within a few days of sending at most |
| Weekly report by email | Summarise your links’ activity | Legitimate interest — switch it off in one click from the email or the Account page | Removed from our sending queue within a few days of sending at most |
| Tips and reminders by email: which email, when, in which language, whether its button was used and whether the step it was about was taken (address confirmed, first link, domain connected…) | Help you finish what you started, and measure — against a small group of accounts that does not get them — whether these emails help | Legitimate interest — switch them off in one click from the email or the Account page | 12 months |
| Klyk’s notes (tips, guides, what’s new): which note, when, in which language, which version of its subject, whether its button was used and whether what it suggested was done within 7 days; the hour you usually open Klyk, read from the last 90 days | Send you what helps, at your hour and your pace; measure — against a small group of accounts that does not get it — whether a note helps, and retire the ones that do not | Legitimate interest — each kind of note switches off in one click from the email, its preference page or the Account page | 12 months; the usual hour, until the account is deleted |
| Set-aside addresses: a fingerprint (hash) of an address that permanently refused an email, or reported one as spam | Stop sending optional emails to that address | Legitimate interest; respecting your objection | As long as the address must stay set aside |
| Use of dashboard features: the name of the action (for example “QR downloaded as PNG” or “CSV export”), your account and the date — never an address, a search or the content of a link | Know which features are used, to improve the Service | Legitimate interest — measured by us alone, with no cookie and no third-party tool | 90 days, then only daily totals that identify no one |
| How you found Klyk: the source of the visit at the end of which you created your account (for example “LinkedIn” or a campaign), the referring site’s domain and the first page viewed | Know which posts bring sign-ups | Legitimate interest — measured by us alone, with no cookie and no third-party tool | Until the account is deleted |
| Technical logs (failed requests, truncated IP address) | Diagnose incidents; security | Legitimate interest | 90 days |
| IP address of requests, to rate-limit them | Protect the Service from abuse | Legitimate interest | In memory, one hour at most |

## 4. Link and page visitors’ data

When you follow a Klyk link or view a Klyk page, we record a visit event containing:

- a **pseudonymous fingerprint**, computed with a secret key from your IP address and browser: it is used to count unique visitors and not to count the same click twice. It does not contain your IP address, but remains pseudonymised personal data;
- your **country** and continent, derived from your IP address: by Cloudflare, which carries getklyk.io’s traffic, when your visit goes through it, otherwise using a database installed on our servers; your address is sent to no other service for this;
- your **device type**, operating system and browser, derived from the `User-Agent` header, and your browser’s **primary language**;
- the **domain** of the site you came from — never the page’s full address — and any UTM parameters on the link;
- the date and time, the channel (direct, QR code, page) and, where relevant, the rule or variant that chose your destination;
- whether the visit appears to come from a bot.

**What we do not do**: your IP address is never written to a database; no cookie is set on visitors’ devices, and nothing is stored on them but the choices they make on a page (see “Cookies and local storage”); no advertising identifier is used; this data is neither sold nor used to profile you.

Your actions on the same link less than 30 minutes apart are grouped into one visit, using the fingerprint above, with no cookie. Visit details are **deleted after 90 days**; only daily totals, with no identifier, are kept after that. Unique-visitor counters, from which no fingerprint can be recovered, are kept for about 13 months for long-range statistics.

The link’s owner sees this information as statistics. They never see your IP address; the fingerprint is only shown to them cut down to a few characters, to tell two visits apart in the event feed.

**Shared statistics.** The link’s owner may publish these statistics, in **aggregated** form only, on a read-only page reached by a secret link — to show them to a client, for instance. That page holds no individual data: no visit on its own, no fingerprint, no destination address, and any value counting fewer than 3 clicks is grouped with others. This is a precaution, not a formal guarantee of anonymity. The page is not indexed by search engines, sets no cookie, and the owner can revoke it at any time. How many times it is opened is counted, with no IP address or identifier of whoever opens it.

If a link is password-protected, the password you type is used only to check it and is not kept.

To exercise your rights over this data, contact the link’s owner; if you do not know who they are, write to us at [privacy@getklyk.io](mailto:privacy@getklyk.io) and we will pass your request on. Because your IP address is not stored, it is generally not possible to find a specific person’s visits (Article 11 GDPR).

**Embedded players.** A page may hold a service’s player — YouTube, Spotify, SoundCloud, TikTok, Apple Music, Apple Podcasts or Deezer. It loads only when you ask for it: nothing is requested from that service before. Once the player is loaded, the service receives your IP address and may set cookies, under its own privacy policy. If you choose “Always on this page”, that choice is kept in your browser, and the page’s footer lets you take it back.

## 5. Audience measurement of our site

When you view Klyk’s public pages — home, sign-up, sign-in, legal pages, Behind the scenes — we record a page view containing:

- the page viewed, and the date and time;
- a **pseudonymous fingerprint**, computed with a secret key from your IP address and browser, separate from the one used for link visits: it is used only to count unique visitors and to group page views less than 30 minutes apart into one visit;
- the visit’s **source**: the UTM parameters on the address, or else the domain of the site you came from — never the page’s full address;
- your **country**, derived from your IP address by Cloudflare or, failing that, on our servers, and your **device type** (desktop, mobile, tablet).

**What we do not do**: no cookie is set and nothing is stored on your device; your IP address is never recorded; no third-party analytics tool is involved; bots are not recorded. These page views are not tied to any account.

Visits made with a Klyk session open are not counted: someone who already has an account is not an audience to win. To know it, the site sets the `klyk_no_stats` cookie on your browser when the session opens, and removes it when it ends; it holds no identifier. Visitors without an account receive none.

If you create an account, we find the visit under way at the moment you sign up and record with your account **its source only** — for example “LinkedIn” or a campaign name —, the domain of the referring site and the first page viewed. If that visit has no origin — a tab reopened after a break, for instance —, the same browser’s last arrival within 7 days is used, found the same way; failing that, no source is recorded. The fingerprint itself is not kept with your account.

The sign-up form also asks, optionally, how you heard about Klyk. Your answer — a choice from a list, and your own words if you choose “Other” — is recorded with your account, beside that source. Without an answer, nothing is recorded.

Legal basis: our legitimate interest in measuring our site’s audience and in knowing which posts bring sign-ups. Retention: **180 days** for each page view, then only daily totals that identify no one; the sign-up source and your answer, until the account is deleted.

## 6. Reports and moderation

If you report a link from its preview page, we record the reason you chose, any text you add, and a pseudonymous fingerprint of your IP address and browser, used only to count distinct reporters. If you write to us, we keep your message and contact details to handle the report.

The report form runs an anti-bot check, **Cloudflare Turnstile**: your browser completes a short test, for which Cloudflare receives your IP address, your browser and technical signals about the connection (see [Recipients](https://getklyk.io/en/legal/privacy#recipients)). We receive only its result.

The moderation log records every decision: the measure, its date, the person who took it, their note, and the link, site or account concerned.

When you delete a link or a page, we keep its address, destination, title, state and the dates it was created and deleted, and nothing of its visits: a deceptive link is often deleted before it is reported, and what it was must stay known.

We also watch the **volume of clicks** on each link — totals in five-minute slices, nothing about visitors — to spot the abnormal spikes that often come with a fraudulent send. A spike opens a record for moderation: the link, its volumes, what it usually does and a few aggregated indicators, such as the share of bots or the link’s age; never a visitor. It never leads to an automatic block. The record is kept for **90 days** after it closes, or **3 years** if it led to a moderation decision.

Legal basis: our legitimate interest in protecting people online and the Service, and our legal obligations, notably under the Digital Services Act. Retention: **3 years**, so that we can answer a challenge; reports about a link are deleted sooner if the account that owns the link is deleted. What remains of a deleted link is kept for **1 year** after its deletion, and erased sooner with your account.

## 7. Destination checks

When an account holder saves a destination — a link, rule, variant, page button or domain redirect — we send its full address to **Google Web Risk** (Google LLC) to check that it is not listed as dangerous, and again regularly for as long as a link leads to it. No data about visitors is sent in the process.

If a destination itself contains personal data (an email address in its parameters, for example), that data is sent to Google along with the address: avoid putting any in your destinations. Legal basis: our legitimate interest in protecting people online. The result of the check is kept for as long as a link, page or domain leads to that address.

Our servers also visit the destination page to read its title and icon. They do so on their own behalf: the destination site receives neither your IP address nor your visitors’.

## 8. Pages composed with AI

“Create with AI” composes a draft page from what you give. It is only for **your own page**, or for the page of someone who agreed to it: you confirm this at each creation, and nothing is read or searched without that confirmation.

### What is sent, and to whom

- To our artificial intelligence provider, **Anthropic, PBC** (United States): your name, what you say you do, the addresses you give, your wish for the look, the page’s language, and the text of the addresses you give, read by Klyk at each of them. The model can also read other pages of your own sites, but never those of services everyone shares (GitHub, Medium, social networks…): of your profiles, it receives only the text read at the exact address you give.
- **Your name is searched on the web only if you turn it on**: the option is off by default, and is chosen at each creation. Anthropic then has the searches run by a third-party search engine, its own processor, which receives only the query.
- Neither your e-mail address, nor your account’s identifier, nor your pictures are sent to the provider.

### What you check, and what is erased

- What is found — sources, facts, profiles, projects, pictures — is shown to you **before anything is used**, each fact with its sources: the model can be wrong, and you can check. What is “maybe” about you stays unticked until you tick it; what is about someone else with the same name is set aside.
- **What you untick is erased as soon as the page is composed**, along with pages about other people met during the search and the detail of the search itself. Pictures found are copied to our servers during the search; those you do not keep are then deleted.
- The research is conducted to leave out what has no place on a public page: home address, phone, family, health, religion, opinions, sex life, finances, legal proceedings, children. Nothing is published until you have reviewed it.

### Legal bases

- Performing the service you ask for, the web search included when you turn it on.
- For information about other people met during the search, namesakes for instance: our legitimate interest in showing you an accurate dossier. It is used only to be set aside and is erased as described above; anyone concerned can object by writing to [privacy@getklyk.io](mailto:privacy@getklyk.io).

### How long it is kept

- A creation carried to a proposal is erased **30 days** after it started. The content of one stopped before is erased after **7 days**, that of one you let go, at once: only a row with no content remains — not your name, nor your addresses, nor what was found —, erased in turn **30 days** after it started. The page you make of it is a page like any other.
- Beyond that, we keep only each day’s total cost, with no identifier.
- Anthropic acts on our behalf as a processor: it does not use this data to train its models, and keeps it only for a limited time — 30 days at most as of this policy —, longer only if a use against its rules is detected. The transfer to the United States is safeguarded as described in the section [“Transfers outside the European Union”](#transfers).

## 9. Cookies and local storage

On the visitor side, no cookie is set on visitors’ devices, and nothing is stored on them but the choices they make on a page (see “Cookies and local storage”). On the site itself, we use only the items below, all necessary for the Service to work or for a choice you make: they do not require your consent, and we use no analytics or advertising cookies.

| Name | Type | Purpose | Duration |
| --- | --- | --- | --- |
| `klyk_rt` | Cookie, not readable by scripts | Keep you signed in | 30 days at most, renewed with use; deleted when you sign out |
| `oauth_state` | Cookie | Protect Google, GitHub or GitLab sign-in against request forgery | 10 minutes |
| `KLYK_LOCALE` | Cookie | Remember the language you chose | 1 year; set only when you choose a language |
| `klyk_theme` | Local storage | Remember the light or dark theme | Until you clear it |
| `kly-sheet-width:…` | Local storage | Remember the width of dashboard panels | Until you clear it |
| `klyk_chunk_reload` | Session storage | Prevent a reload loop after the site is updated | Until the tab is closed |
| `klyk_no_stats` | Cookie | Leave out of the site’s audience measurement the visits made with a Klyk session open, and those of Klyk administrators — set when a session opens and removed when it ends; kept afterwards on administrators’ browsers | 30 days, renewed with the session; 1 year for administrators |

On a Klyk page, only the choices you make there are kept in your browser, so you are not asked again. They are needed for what you asked for and never leave your device:

| Name | Type | Purpose | Duration |
| --- | --- | --- | --- |
| `klyk:audience:…` | Local storage | Your answer to a page’s audience measurement (Google Analytics, Meta), when its owner added one | Until you clear it; “Audience measurement”, in the page’s footer, lets you answer again |
| `klyk:players:…` | Local storage | The services whose players you let load on a page (“Always on this page”) | Until you take it back (“Stop loading players”, in the page’s footer) or clear it |

## 10. Recipients and providers

Your data is accessible only to the people at Klybase Labs who need it, and to the providers below, limited to what each of them needs:

| Provider | Role | Data concerned | Location |
| --- | --- | --- | --- |
| Contabo GmbH | Hosting of servers and databases | All Service data | European Union |
| Cloudflare, Inc. | Carrying and protecting getklyk.io’s traffic; visitors’ country | IP address and requests made to the site (address requested, browser headers, content exchanged) | United States; data centres worldwide |
| Cloudflare, Inc. | Anti-bot check (Turnstile) on sign-up and reports | IP address, browser, technical signals about the connection | United States |
| Resend, Inc. | Email delivery | Email address, email content | United States |
| Google LLC | Destination checks (Web Risk) | Destination addresses | United States |
| Anthropic, PBC | Creating pages with AI: research and composition | What you give for the page; the public content of your sites and, if you turn the search on, what is found about you | United States |

If you choose to sign in with **Google**, **GitHub** or **GitLab**, that provider sends us your identity; it then acts as an independent controller, and its own privacy policy applies.

For **Turnstile**, Cloudflare also uses these signals to improve its bot detection; it then acts as an independent controller, and its [Turnstile privacy policy](https://www.cloudflare.com/turnstile-privacy-policy/) applies.

We disclose data to the authorities where the law requires it. We sell no data, and share none for advertising purposes.

## 11. Transfers outside the European Union

Klybase Labs is a US company, and some of the providers above are based in the United States. These transfers are governed by the standard contractual clauses adopted by the European Commission and, where the provider is certified, by the EU–US Data Privacy Framework. You can obtain a copy by writing to [privacy@getklyk.io](mailto:privacy@getklyk.io).

Cloudflare’s network handles each request in the data centre closest to the person making it, which may be outside the European Union. Cloudflare is certified under the Data Privacy Framework, and its data processing agreement incorporates the standard contractual clauses.

## 12. Retention periods

| Data | Duration |
| --- | --- |
| Account, links, pages, domains, files | Until the account is deleted |
| Visit details | 90 days |
| Daily totals, with no identifier | Until the account is deleted |
| Unique-visitor counters | About 13 months |
| Sign-in history | 180 days |
| Sessions | 30 days at most |
| Verification codes and links | 10 minutes to 24 hours |
| Technical logs | 90 days |
| Feature use, per account | 90 days |
| Daily usage totals, with no identifier | No limit: they identify no one |
| Page views of our site | 180 days |
| Daily site audience totals, with no identifier | No limit: they identify no one |
| Sign-up source | Until the account is deleted |
| Tips and reminders sent | 12 months |
| Klyk’s notes sent | 12 months |
| Account whose address was never confirmed, with no link | 30 days, then retired; erased 30 days later |
| Reports and moderation log | 3 years |
| Traffic spike records | 90 days after they close; 3 years if they led to a block |
| What remains of a deleted link | 1 year after its deletion |
| Creation with AI carried to a proposal (what you gave and kept, the proposals) | 30 days after it started |
| Creation with AI stopped before a proposal | Its content 7 days after it started; the row with no content left of it, 30 days after |
| What you set aside at the review; the content of a creation you let go | Erased at once |
| Daily cost of creations with AI, with no identifier | No limit: it identifies no one |
| Destination check results | As long as a link, page or domain leads there |

When you delete your account, your links, pages, domains, tags, files and statistics, and the reports about your links, are erased immediately, and your short addresses become available again. One exception: a moderation decision concerning you stays in the moderation log, with your account’s identifier, until its retention period ends.

An account whose address was never confirmed and that has no link is **retired** after 30 days, as is an unconfirmed account the owner of the address reports as created without their knowledge (“This wasn’t me”). Retired means hidden, its sessions ended and its address freed at once; it can be restored for **30 days**, its original address kept encrypted for that purpose alone, and is then **erased for good**.

## 13. Security

- Encrypted connections (HTTPS).
- Passwords hashed with bcrypt; sensitive data, such as sign-in providers’ tokens, encrypted with AES-256-GCM.
- Short-lived sessions, renewed with a single-use token and revocable from the Account page.
- Visitors’ IP addresses never stored; IP addresses truncated in logs.
- Access to data limited to the people who need it.

If a data breach is likely to result in a high risk to your rights, we will inform you, as the law requires.

## 14. Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object. If you live in France, you may also give instructions on what happens to your data after your death.

From the **Account** page, you can yourself edit your profile, **download all your data** as a JSON file, end your sessions, switch off the weekly report, the tips and reminders or Klyk’s notes, choose their pace, and **delete your account**.

For anything else, write to [privacy@getklyk.io](mailto:privacy@getklyk.io). We answer within one month, which may be extended by two months if the request is complex; we may ask you to prove your identity.

You may lodge a complaint with a supervisory authority — in France, the [CNIL](https://www.cnil.fr/fr/plaintes) — in particular the one of the country where you live.

## 15. Children

The Service is not intended for people under 16, who may not create an account. If you think a child has given us data, write to [privacy@getklyk.io](mailto:privacy@getklyk.io) and we will delete it.

## 16. Changes

We may update this policy. The date of the version in force is shown at the top of the page; for a significant change, we notify you by email or in the Service.

## A question about this document?

Write to us: a person will answer. [privacy@getklyk.io](mailto:privacy@getklyk.io)