Privacy Policy

When you create a LinkStacked account, we collect:

• Name, email address, and username
• Password (stored as a bcrypt hash — never in plaintext)
• Profile photo (stored on AWS S3)
• If you sign in with Google or Apple: your OAuth identifier and email address from that provider

Everything you add to your public LinkStacked profile: bio, links (URLs, titles, metadata), social platform handles, custom domain settings, digital products, appearance and theme preferences, and QR code configuration.

• When you connect Stripe as a seller: your Stripe account ID and Connect onboarding data. We do not store raw card or bank account numbers — Stripe holds and processes those.
• When a visitor purchases your product or sends a tip: transaction ID, amount, currency, and anonymised buyer email (sufficient to send receipts).
• Download activity for digital products (timestamp, file served) for fraud prevention and seller reporting.

We operate our own first-party analytics infrastructure. When someone visits your public profile, we record:

• Page and link events (views, clicks, QR scans)
• Approximate geographic location (country/region, derived from IP address — the full IP is not stored)
• Device type, browser, and operating system
• Referrer URL (the page that linked to yours)

We also integrate with GA4 (Google Analytics Measurement Protocol) for aggregated website analytics. If you have enabled optional analytics cookies, GA4 may set additional cookies — see our Cookie Policy.

If you contact us by email or through the contact form, we store your name, email address, and the content of your message to respond and to track our support obligations.

If a report is submitted about your profile or a link (by you or a third party), we retain the report details — including the reason, any submitted evidence, and the reporter's email if provided — to investigate and document our enforcement decisions.

If you install the LinkStacked Universal Importer browser extension, additional data may be captured locally in your browser when you choose to scan a page. See Section 3 for the full description, your responsibilities, and when that data reaches our servers.

You may use the extension only if all of the following are true:

• The page you scan is your own public profile page (or a public page you control) — including your public LinkStacked profile — not a private dashboard, settings area, inbox, or logged-in account area
• You have the legal right to copy and reuse the display name, bio, links, embeds, and images you capture (typically because they are yours)
• You will review every field in LinkStacked’s design canvas before creating or publishing a profile — the extension never publishes or changes a live account on its own
• You accept that third-party sites (for example other link-in-bio or social platforms) may prohibit automated capture or tooling in their terms; complying with those terms is your obligation, not LinkStacked’s

After you accept consent in the side panel and start a scan (or navigation listening), the extension may read from the active public page and store a temporary import payload in your browser via chrome.storage.local, including:

• Source page URL and a coarse platform label (e.g. generic host name)
• Visible profile text such as display name and bio when detectable
• Link titles and destination URLs collected from the page and, if you leave listening on, from navigations you trigger by clicking profile controls
• Embed references (provider and source URL) when detectable
• A small number of candidate images (resized locally) that you may later choose as an avatar or ignore
• Timestamps for consent acceptance and capture

While navigation listening is active, the extension may observe navigation-related browser APIs on that tab in a log-only way (it does not block page navigation). Listening stops when you press Stop, clear consent, or end the session. Capture is intended for public profile pages only; the UI blocks common private/dashboard URL patterns, but you remain responsible for not using the tool on private or non-owned pages.

• We do not sell data captured by the extension
• We do not use the extension as a general browsing tracker, advertising ID, or analytics SDK across the web
• We do not silently upload your capture while you browse — data stays in your browser until you explicitly launch guided setup on LinkStacked
• We do not claim affiliation with, endorsement by, or official partnership with third-party link-in-bio or social platforms you may import from

Captured data remains on your device until you open LinkStacked (for example /design or /create-profile) and choose to launch guided setup. At that point the payload is applied to a local design draft in your browser session / staging flow so you can edit every field. If you then create an account or profile, the content you keep becomes ordinary profile content under this Privacy Policy (see Profile content above) and is processed to provide the service (contract / your instructions).

You can clear the local capture by clearing extension storage, revoking consent in the side panel, or uninstalling the extension. Drafts on LinkStacked can be discarded without creating a profile.

Depending on the build and Chrome’s permission model, the extension may use browser permissions such as storage, sidePanel, tabs / activeTab, scripting, and offscreen. A content script is installed automatically only on LinkStacked pages (to launch guided setup). On third-party sites, code is injected only after you click Scan and grant access for that site’s origin — not on every tab you browse. Optional host access is requested per site you choose to import from, so the extension can read that page and fetch images you select. These permissions exist solely to support the import workflow you initiate — not to monitor unrelated browsing.

Public pages you visit are controlled by third parties. Their terms of service, robots rules, and intellectual-property rights still apply to you. LinkStacked provides a convenience tool for migrating your public link list into our product; we do not grant you any licence to third-party trademarks, brand assets, or another person’s content. If you import material you do not have rights to, you must remove it and you are responsible for any resulting claims.

Creators may enable third-party advertising pixels (Meta/Facebook, Google Ads, TikTok, Snapchat, Pinterest, X/Twitter) on their public profile. When a visitor with marketing consent visits that profile, the corresponding pixel script is loaded — potentially setting cookies and sending event data to those platforms.

Creators who connect Mailchimp to their email-capture campaigns authorise LinkStacked to sync subscriber emails to their Mailchimp audience list. The creator controls which list is targeted and is responsible for their own email marketing compliance under applicable law.

When a creator uses a custom domain, that domain resolves through our infrastructure (AWS + Cloudflare). Visitor traffic data for those domains is processed identically to linkstacked.com traffic.