Privacy Policy

• Account data: your email address, a hash of your password (scrypt — never the password itself), and optionally your name and a Google account id if you sign in with Google.
• Profile content: your username, display name, bio, links, uploaded images and every block you add. This is content you intend to publish.
• Sessions: a hash of your session token, plus the browser user-agent and IP recorded at sign-in so you can review active sessions and spot anything unfamiliar.
• Custom domains: the hostname and DNS verification state, if you connect one.

When someone views a linkva.se page we record an event containing: the event type (view, click, share, QR scan, subscribe), a coarse device class (mobile, tablet or desktop), a two-letter country code where the hosting layer provides one, and the referring domain only.

We deliberately do not store:

• IP addresses of visitors.
• Full user-agent strings.
• Full referrer URLs, including query strings.
• Any cookie set for analytics purposes on a public page.
• Any identifier that works across profiles or across days.

Unique-visitor counting uses a salted hash of the IP, user-agent, the profile id and the current UTC date. Because the salt includes the date and the profile, the value cannot be used to follow a person between pages or between days — and it is one-way, so the original values cannot be recovered. Known bots are excluded entirely.

A profile owner can turn analytics off completely in Settings → Privacy, in which case nothing is recorded for that page.

• linkva_session — your sign-in session. HttpOnly, SameSite=Lax, 30 days.
• linkva_admin — a separate, 60-minute session for staff using the admin console.
• linkva_csrf — a cross-site request forgery token. Readable by the page so it can be echoed back on form submissions.

That is the complete list. There are no advertising, tracking or third-party analytics cookies, and public profile pages set no cookies at all unless the visitor signs in.

Embedded content you add — a YouTube video, a Spotify player, a SoundCloud track — is loaded from that provider, and their own terms and data practices apply to the embed. We use privacy-preferring endpoints where they exist (for example youtube-nocookie.com and Vimeo with do-not-track enabled) and every embed is sandboxed.

If you sign in with Google, Google tells us your account id, email address, name and profile picture URL. We store no Google access token beyond the moment of sign-in.

• Account and profile data: until you delete your account.
• Analytics events: kept as raw events plus daily aggregates; the aggregates are what power your dashboard.
• Sessions: until they expire, are revoked, or you sign out.
• Outbound email records: retained so you and we can audit what was sent.
• Moderation audit entries: retained after account deletion, because a record of enforcement decisions has to survive the account it concerned. These contain the action, the reason, and the email address involved — nothing more.

• Turn analytics collection off for your page at any time.
• Make your page unlisted (works by link, excluded from search and Explore) or private.
• Ask search engines not to index your page.
• Change your username; the old one redirects and stays reserved for you.
• Review and revoke every active session.
• Delete your account, which removes your profile, blocks, uploads, subscribers, domains and analytics events.

If you are in the EU, UK or another region with comparable law, these controls cover access, rectification, erasure and objection. For anything they don't cover, contact us and we will action it.

If you add a Newsletter block, the email addresses visitors submit belong to you and are stored against your profile. You are the controller of that list: only collect addresses you have a basis to contact, and use the consent notice field to say what people are signing up for. Deleting your account deletes the list.

Passwords are hashed with scrypt. Session tokens are random values stored only as SHA-256 hashes, so a database leak cannot be replayed as a valid login. Every state-changing request requires a CSRF token and a matching origin. Uploads are verified against their real file signature and SVG is refused. Outbound links are screened against a malicious-domain blocklist. Administrative actions require a separate, short-lived session with two-factor authentication.

Questions, requests or security reports: privacy@linkva.se. For abuse, use the report button on any page or see reporting abuse.

This instance is served from https://www.linkva.se. This document describes the software's behaviour; an operator running their own deployment should adapt it to their jurisdiction and hosting arrangements.