Back to LinkitNow
LinkitNow
DPDP Act 2023 & GDPR Aligned

Privacy Policy

Effective Date: November 6, 2026 • Last Updated: November 6, 2026

LinkitNow (“we”, “our”, or “us”) is built on privacy-by-design principles. This Privacy Policy explains what information we collect, how we secure your account and UPI payments, how we anonymize visitor analytics, and how you can exercise your data rights at any time.

No Raw IP Storage

Visitor IPs are irreversibly hashed with a daily rotating secret salt and immediately discarded.

Zero Banking Storage

Payments run strictly via NPCI UPI. We never see or store UPI PINs, bank accounts, or cards.

1-Click Data Control

Export all your data as JSON or permanently erase your account from your Settings page.

1. Information We Collect

We collect only the minimum information necessary to operate your LinkitNow page and short links:

  • Account Information: Your name, email address, chosen username, and a bcrypt-hashed password (using cost factor 12) or Google OAuth identifier if you sign in with Google.
  • Public Bio Page Content: Links, titles, bios, theme preferences, avatar images, and custom background wallpapers that you explicitly add to your public profile.
  • Anonymous Click Telemetry: When a visitor clicks one of your links, we record the timestamp, referring domain, coarse device/browser family, country header (if provided by the edge network), and a daily-salted SHA-256 visitor hash to count unique daily clicks without tracking individuals across days or websites.

2. Privacy-Preserving Analytics (No Raw IP Logging)

Unlike traditional link shorteners that log permanent visitor IP addresses, LinkitNow computes a one-way cryptographic digest:

visitorHash = SHA-256(clientIP + userAgent + UTC_Date + VISITOR_HASH_SECRET)

The raw IP address is never written to our database or analytics tables. Because the date forms part of the hash input, visitor hashes rotate automatically every 24 hours at midnight UTC and cannot be correlated across days.

3. UPI-Only Payment Security & Financial Privacy

Paid subscriptions on LinkitNow are processed exclusively via UPI (Unified Payments Interface) through Razorpay, a PCI-DSS Level 1 certified and RBI-authorized payment aggregator.

  • UPI-Only Enforcement: Our checkout and server verification layer accept only UPI instruments (UPI QR, UPI Intent apps such as Google Pay, PhonePe, Paytm, BHIM, and `@upi` Virtual Payment Addresses). Credit cards, debit cards, netbanking, and wallets are disabled.
  • Zero Sensitive Credential Storage: LinkitNow never collects, processes, or stores your UPI PIN, bank account number, IFSC code, or card details.
  • Cryptographic Order Verification: Every transaction is verified server-side using HMAC-SHA256 signatures (`order_id|payment_id`) and cross-checked directly against the payment gateway's API for exact paise amount, INR currency, and `upi` payment method before plan activation.
  • Audit & Tax Records: We retain only the Razorpay Order ID, Payment ID, masked UPI VPA handle (if returned by the gateway), INR amount, and timestamp as required under Indian tax and accounting laws.

4. Cookies, Session Security & Application Defense

We use strictly necessary first-party `HttpOnly`, `SameSite=Lax` encrypted session cookies to keep you signed in. We do not use third-party advertising cookies, cross-site tracking pixels, or behavioral fingerprinting scripts.

All traffic is protected by strict HTTP security headers (`Content-Security-Policy`, `X-Frame-Options: DENY`, `Strict-Transport-Security`, `X-Content-Type-Options: nosniff`), Cross-Site Request Forgery (CSRF) Origin verification, per-IP and per-account rate limiting, and server-side URL validation to block malicious schemes (`javascript:`, `data:`, `vbscript:`) and internal network SSRF targets.

5. Data Sharing & Third-Party Subprocessors

We never sell, rent, or trade your personal information. We share data only with essential infrastructure providers bound by strict data processing agreements:

  • Database & Hosting: Encrypted PostgreSQL storage and edge hosting infrastructure.
  • Razorpay (UPI Payment Gateway): Processes UPI order creation, payment capture, and webhook notifications.
  • Google OAuth (Optional): Used only if you explicitly choose “Continue with Google” on the login page.

6. Your Rights Under India DPDP Act 2023 & GDPR

You have full control over your personal data at all times:

  • Right to Access & Data Portability: You can download a complete machine-readable JSON archive of your account, bio page, blocks, short links, and payment receipts at any time from Dashboard → Settings → Export My Data.
  • Right to Correction: You can update your profile, username, password, and links instantaneously in your dashboard.
  • Right to Erasure (Account Deletion): You can permanently delete your account and all associated bio pages, links, API keys, and click telemetry from Dashboard → Settings → Delete Account.

7. Contact & Grievance Redressal Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (India), if you have questions about this Privacy Policy, data requests, or security concerns, please contact our Privacy & Grievance Officer at privacy@linkitnow.co.in or submit an abuse/safety report via our Link Safety Report Portal.