X-Links
Privacy policy
What we collect about you and about the people who click your links, why we need it, who else handles it, and how to have it deleted.
Who we are
X-Links (x-links.ca) is a link shortener operated by X-Links in Canada. We're responsible for the personal information described here. For anything about your data, use the contact form or email [email protected].
What we collect
If you have an account
- Account details: your name, email address and a one-way hash of your password (we never store the password itself).
- Your links: titles, descriptions, destinations, slugs, dates, UTM tags and tracking pixel IDs you add.
- Sign-in records: the time and IP address of your current and previous sign-in, and the number of sign-ins, used to protect your account.
- Billing: your plan and the IDs Stripe gives your customer record and subscription. Your card details go straight to Stripe; we never see or store them.
- API token: only a SHA-256 fingerprint of it.
If you contact us
The name (optional), email address and message you send through the contact form, linked to your account if you're signed in. We use them only to answer you.
If you click an X-Links short link
Each click records the time, your IP address, the approximate country and city worked out from that IP address, your browser, operating system and device type (from your browser's user agent), and the page that sent you (the referrer). The owner of the link sees this information. On the Business plan, the owner can export it, including IP addresses.
If the link's owner added a Meta Pixel or Google Analytics ID, the short page you see before being redirected loads it, and Meta or Google may set cookies and collect data under their own policies. See the cookie notice.
Why we use it
- To run the service: create and resolve your links, show your QR codes and statistics.
- To give link owners the click statistics their plan includes.
- To bill paid plans and send account and payment emails (confirmation, password resets, failed payments).
- To keep the service safe: rate limits, stopping abuse such as phishing links, and protecting accounts from break-ins.
We don't sell personal information, show ads, or use it to build advertising profiles.
Who else handles it
- Stripe processes payments and manages subscriptions.
- Mailgun sends our emails.
- Heroku (Salesforce) hosts the app and its database.
- An IP geolocation service (ipinfo.io) receives a visitor's IP address to return an approximate location.
- cdnjs (Cloudflare) and jsDelivr serve an icon set and a script library on signed-in pages, and see your IP address when they do. Our fonts are served from our own server, not Google.
These providers process data on our behalf and are located in, or store data in, the United States, so your information may be accessed under US law. We may also disclose information when the law requires it.
How long we keep it
- Account details and links: until you delete your account.
- Click records: until the link or the account it belongs to is deleted.
- Contact messages: until the request is resolved, then deleted 12 months later.
- Billing records: Stripe keeps them as tax and financial law requires, even after your account is deleted.
- Server logs: kept briefly by our hosting provider for operations and security.
Your choices and rights
- See and correct: your account details and links are on your account page. You can also ask us for a copy of what we hold.
- Delete: deleting your account from the account page permanently removes your account, every link and every click record, and cancels any subscription first. Deleting a single link removes its click records too.
- Visitors: if you clicked someone's link and want your click record removed, tell us the link and the approximate time and we'll remove it.
- Complaints: contact us first. You can also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.
Security
Everything is served over HTTPS. Passwords are hashed with bcrypt, API tokens are stored only as fingerprints, sign-in attempts are rate-limited, and accounts lock after repeated wrong passwords. No system is perfectly secure; if a breach puts your information at risk, we'll tell you and the regulator as the law requires.
Children
X-Links isn't meant for children under 16, and we don't knowingly collect their information.
Changes
If we change this policy, we'll update the date at the top. For a significant change, we'll email account holders before it takes effect.
Contact
Questions or requests: the contact form or [email protected].