Privacy Policy
First published: May 28, 2026 · Effective date: October 10, 2026 · Last updated: October 12, 2026
In short. WarpLink is link infrastructure for mobile apps: deep linking, install attribution, and analytics. We are the controller of the data about our own customers, such as their accounts and billing. For the people who open our customers' links or use their apps, our customer is the controller and we process the data for them under our Data Processing Agreement. We store a keyed hash of each visitor's IP address, never the raw address, and our SDKs never collect advertising identifiers. Click data is kept for 90 days to 3 years depending on the customer's plan, then deleted automatically. Data is stored in the United States. We never sell personal data. Contact privacy@warplink.app with any privacy question or request.
1. Data We Collect
WarpLink collects the minimum data needed to redirect links, attribute app installs, and show analytics. It falls into three groups: account information you provide, click analytics from link visitors, and attribution signals from apps that embed our SDK. Some of the data we process from link visitors consists of pseudonymous identifiers, such as hashed values and device signatures, rather than information that directly identifies a person. We do not sell your data, and we do not share it with advertisers.
2. Click Analytics Data
When someone opens a WarpLink link, we record the link and organization, the time, an approximate location derived from the network (country, region, and city), the device type, operating system and version, and browser derived from the user agent, the referring URL, and any UTM campaign parameters in the link URL.
We also store a keyed hash (HMAC-SHA256) of the visitor's IP address, which we use to count unique clicks. The hash is computed with a secret key before the click is queued or stored. We do not store the raw IP address or the full user agent in our click records. A keyed hash is pseudonymous data, so we still treat it as personal data.
A referring URL or a link parameter can contain personal data that someone else put there. Our customers control the links they create.
3. Mobile SDK and Attribution Data
Apps that include the WarpLink SDK send signals that we use to match an app install or app open to the link click that led to it. Depending on the platform, the SDK sends:
- the platform, the app's bundle ID or package name, the SDK version, and whether the app was reinstalled;
- the device's preferred language and time zone;
- on iOS only, the Identifier for Vendor (IDFV); and
- on Android, the click identifier from the Google Play Install Referrer, when one is available. The Android SDK sends no device identifier.
From these signals and the request's IP address we compute a device match key, a keyed hash (HMAC-SHA256). The raw IP address is used in memory, to compute the match key and to note whether the address is IPv4, IPv6, or a shared carrier address, and is not stored in our records. Like every request to the SDK endpoints, it is also used for a few minutes as a rate-limit key by our rate-limiting provider. We store the match key, the IDFV where sent, the link and app, the time, the match method and confidence, and the link data returned to the app. We also record each match attempt, its result, and a diagnostic reason code.
We do not collect the Apple Identifier for Advertisers (IDFA), the Google Advertising ID, or the Android ID.
4. Account and Session Data
When you create an account, we collect your email address and, optionally, a display name. You can register using email and password, GitHub, or Google. Authentication and sessions are managed by Better Auth. A session record may include the IP address and browser user agent associated with your sign-in, which we use to maintain and secure your session.
6. How We Use Your Data
- Redirect links and provide deep linking
- Attribute app installs to the links that drove them
- Show aggregated click and install analytics in your dashboard
- Process subscription payments through Stripe
- Send transactional email such as verification, password resets, team invitations, and billing notifications through Resend
- Monitor errors and maintain reliability through Sentry
We never sell your data to third parties, and we never share it with advertisers.
7. Legal Basis for Processing
We are the controller of the personal data of our account holders, website visitors, and people who contact us. If you are in the European Economic Area, the United Kingdom, or Switzerland, we process it on these legal bases:
- Contract: operating your account and providing the service you signed up for.
- Legitimate interests: securing the service, preventing abuse, and improving our product.
- Legal obligation: meeting tax, accounting, and other legal requirements.
- Consent: optional analytics cookies, dashboard product analytics, and session replay. You can withdraw consent at any time.
For the data of people who open our customers' links or use their apps, our customer is the controller. The customer decides the legal basis and gives its users the required notices. We process that data only on the customer's instructions, under our Data Processing Agreement.
8. International Data Transfers
WarpLink is operated from Ontario, Canada. Our database is hosted in the United States (Northern Virginia). Link requests are handled at the edge location nearest to each visitor, anywhere in the world. Dashboard product analytics and session replay, which run only with consent, are processed in the European Union. Our Sub-processors page lists every provider and its location.
Data in the United States may be subject to access by US authorities under US law. For personal data transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on the adequacy findings for Canada, and for onward transfers on the EU Standard Contractual Clauses, the UK Addendum, or the EU-US Data Privacy Framework where a provider is certified. Our Data Processing Agreement sets out the transfer terms for our customers' end-user data.
9. Data Security
We protect data with encryption in transit, keyed hashing of IP addresses and device match keys, hashed passwords, API keys and SDK keys stored only as hashes, role-based access, optional and enforceable two-factor authentication, an organization audit log, and rate limits. Our database and edge key-value storage are encrypted at rest by the providers.
SDK keys work only on the three SDK endpoints, which resolve links, validate the key, and record install attribution, and they cannot change anything or read analytics. A key tied to one app additionally restricts which app it acts as, and we recommend tying every SDK key to its app. Keep API keys on your servers. Our Security page describes our controls in more detail and explains how to report a vulnerability.
10. Data Retention and Deletion
We keep account information for as long as your account is open. We keep billing records for as long as tax and accounting law requires.
The table below covers the data of people who open our customers' links or use their apps.
| Data | Purpose | Where stored | Retention | Deletion |
|---|---|---|---|---|
| Raw IP address | Compute the keyed hash, approximate location, and match key | Memory while the request is handled; edge request logs; our rate-limiting provider, as a rate-limit key | Not stored in click, install, or attribution records. Edge request logs: 3 days. Rate-limit key: a few minutes | Discarded after the request in our systems; the rate-limit key expires automatically within a few minutes at the provider; edge logs expire automatically |
| Keyed IP hash, time, location, device, browser, referrer, UTM parameters | Click analytics and unique-click counting | Click records and hourly click summaries in our database; event queue while in transit | The customer's plan: Free 90 days, Starter 180, Growth 365, Scale and Unlimited 1,095 | Daily automated deletion; deleting the link or the organization; individual request |
| Device match key, IDFV, Install Referrer click ID, match result | Install attribution | Install and attribution records in our database | Same as click records | Daily automated deletion; deleting the organization; individual request |
| Deferred matching entry (match key, link, and routing data) | Send a new app user to the content of the link they opened | Edge key-value store | Each tap can be matched only within the match window (6 hours by default, 24 hours at most). Pending entries are deleted automatically within 48 hours. | Automatic expiry |
| Clicks on a Free plan trial custom domain | Trial analytics | Our database | 30 days | Deleted every 30 days during the trial |
| Click export files | Customer downloads | Our database | 7 days | Automatic deletion |
The Free plan shows the last 30 days of analytics, although it keeps 90 days of data, so an upgrade shows the older data at once. When a Free organization reaches its monthly click allowance, its analytics freeze until the next 30-day period or an upgrade. Clicks after that point are still stored and redirects keep working. After a downgrade, data collected before the change keeps the earlier plan's longer retention period, unless the customer chose "refund and end now".
When an organization is deleted, all its records are deleted at once through a cascading deletion, and its cached link entries are removed. When you delete your account, every organization you own alone is deleted too.
11. Your Data Rights and How to Exercise Them
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent.
If you are a WarpLink customer or website visitor, you can export your link configurations and click analytics from the dashboard, and delete your organization or your account from the settings. For any other request, email privacy@warplink.app. We reply within the time the applicable law requires.
If you opened a link or used an app that uses WarpLink, the company behind that link or app controls your data. Contact that company first. It can ask us to find, export, or delete your records. You can also email privacy@warplink.app and we will pass your request to the right company.
To find one person's records, we need the organization and the app or link concerned, an approximate time range, and at least one identifier, such as the iOS Identifier for Vendor (IDFV) of the device or the public IP address it used. We use an IP address only to compute the same keyed hash that we store, so that we can find matching records, and then discard it. We act within 14 days after we have enough information. We delete records that match the app or link, the time range, and the identifier. Each tap can be matched only within the match window, which is 6 hours by default and never more than 24 hours, and pending entries are deleted automatically within 48 hours.
12. Canadian Privacy Rights
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws govern how we handle your personal information. You may request access to the personal information we hold about you, ask us to correct it, and withdraw consent. You may also direct a complaint to the Office of the Privacy Commissioner of Canada. Because our infrastructure is located in the United States, your information may be stored and processed there. To exercise your rights, email privacy@warplink.app.
13. California Privacy Rights
California residents have the right to know what personal information we collect, to access and delete it, to correct inaccurate information, and to opt out of the sale or sharing of personal information. WarpLink does not sell or share personal information as those terms are defined under California law. To exercise your rights, email privacy@warplink.app.
14. Children's Privacy
WarpLink is not directed to children. We do not knowingly collect personal data from children under 13, or under 16 in the European Economic Area. If you believe a child has provided us with personal data, contact privacy@warplink.app and we will delete it.
15. Do Not Track and Global Privacy Control
Our analytics measure aggregate usage on our own site and do not track individuals across third-party sites, so there is no cross-site profile to suppress. We do not sell or share personal data, so signals such as Global Privacy Control have nothing to act on. Because there is no industry standard for Do Not Track, we do not respond to it. Analytics runs only if you accept the cookie banner, and you can withdraw that choice at any time through the Cookie settings link, your browser's cookie settings, or the Google Analytics opt-out browser add-on.
16. Third-Party Sub-Processors
We use providers to run WarpLink: an edge network for redirects, a database, error monitoring, link safety checks, rate limiting, payments (Stripe), email (Resend), optional sign-in (GitHub and Google), website and dashboard analytics with consent (Google Analytics and PostHog), and contact forms (Formspree). Each receives only the data it needs for its job.
Our Sub-processors page names every provider, its purpose, the data it receives, its location, and whether it processes our customers' end-user data.
17. Data Controller and Processor Roles
WarpLink is operated by Stojanovski Industries Inc., a corporation located at Suite 603, 130 Spadina Avenue, Toronto, Ontario M5V 2L4, Canada. We are the controller of the personal data of our account holders, website visitors, and people who contact us. For the data of people who open our customers' links or use their apps, our customer is the controller and we are its processor under our Data Processing Agreement.
For privacy questions or to exercise your rights, contact us at privacy@warplink.app.
18. App Tracking Transparency and IDFV
WarpLink does not collect the Apple Identifier for Advertisers (IDFA). Our iOS SDK uses the Identifier for Vendors (IDFV), which does not require an App Tracking Transparency prompt under Apple's current guidelines. See the Mobile SDK and Attribution Data section above for the full list of signals we collect.
19. Contact and Changes to This Policy
We may update this Privacy Policy from time to time. We will post changes on this page and update the date shown above. Continued use of WarpLink after changes take effect constitutes acceptance of the revised policy. For privacy questions or data requests, contact us at privacy@warplink.app.