Privacy Policy

WarpLink collects the minimum data needed to redirect links, attribute app installs, and show analytics. It falls into three groups: account information you provide, click analytics from link visitors, and attribution signals from apps that embed our SDK. Some of the data we process from link visitors consists of pseudonymous identifiers, such as hashed values and device signatures, rather than information that directly identifies a person. We do not sell your data, and we do not share it with advertisers.

When someone clicks a WarpLink short link, we record the link identifier, a timestamp, approximate location derived from network information (country, region, and city), device type, operating system and version, browser, the referring URL, and any UTM campaign parameters on the link. We also store a keyed hash (HMAC-SHA256) of the visitor's IP address, which we use to count unique clicks. The hash is computed with a secret key, so it cannot be reversed to recover the IP address, and we do not store the raw IP address in our click records.

Apps that integrate the WarpLink SDK send signals we use to attribute an install to the link that drove it. Depending on the platform and configuration, these signals include a device identifier provided by the operating system (such as the iOS Identifier for Vendors), the device language, screen dimensions, and time zone offset.

From these signals and the request's IP address we compute a device fingerprint, a keyed hash (HMAC-SHA256) used to match an install to a recent click. We store the fingerprint and the device identifier, along with the match type and a confidence score. The raw IP address is used only momentarily in memory to compute the fingerprint and is not stored. We do not use the Apple Identifier for Advertisers (IDFA).

When you create an account, we collect your email address and, optionally, a display name. You can register using email and password, GitHub, or Google. Authentication and sessions are managed by Better Auth. A session record may include the IP address and browser user agent associated with your sign-in, which we use to maintain and secure your session.

WarpLink uses session cookies on the authenticated dashboard to keep you signed in. We do not use advertising cookies, and we do not place tracking cookies on link redirects. On our public marketing site and in the dashboard we use Google Analytics, which sets first-party analytics cookies (such as _ga) to measure aggregate usage, distinguish visitors, and count sessions. Analytics cookies load only after you accept them through the cookie banner, and your choice is stored in a wl_cookie_consent cookie for one year. You can change or withdraw your choice at any time using the Cookie settings link in the site footer or in dashboard settings, or through your browser's cookie settings or the Google Analytics opt-out browser add-on. We do not enable Google's advertising features or cross-site ad personalization.

• Redirect links and provide deep linking
• Attribute app installs to the links that drove them
• Show aggregated click and install analytics in your dashboard
• Process subscription payments through Stripe
• Send transactional email such as verification, password resets, team invitations, and billing notifications through Resend
• Monitor errors and maintain reliability through Sentry

We never sell your data to third parties, and we never share it with advertisers.

If you are in the European Economic Area or the United Kingdom, we process personal data under the following legal bases:

• Contract: operating your account and providing the service you signed up for.
• Legitimate interests: producing analytics, attributing installs, securing the service, and preventing abuse.
• Legal obligation: meeting tax, accounting, and other regulatory requirements.
• Consent: where you provide it. You can withdraw consent at any time.

WarpLink is operated from Canada, and our dashboard data and click analytics are stored in the United States. If you use WarpLink, your personal data may be processed and stored in the United States and may be subject to access by US authorities under applicable law. For personal data transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses or equivalent safeguards with the providers that process that data on our behalf.

We protect your data with encryption in transit, keyed hashing of IP addresses in our click records, hashed account passwords, scoped API keys, and access controls, and we monitor for errors and anomalies. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We retain click analytics according to your plan:

• Free: 90 days
• Starter: 180 days
• Growth: 365 days
• Scale: 3 years (1,095 days)
• Unlimited: 3 years (1,095 days)

A scheduled process permanently deletes click records older than your plan's retention window. We keep your account information for as long as your account is active. When you delete your organization or your account from your settings, the associated personal data is removed through a cascading deletion. Residual copies in routine backups are overwritten on our normal backup rotation cycle, and we retain certain records only where required by law.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent. You can exercise several of these directly: export your click analytics as CSV from your dashboard, or delete your organization or your entire account from your settings, which permanently removes the associated personal data. For any other request, email us at privacy@warplink.app and we will respond within the time required by applicable law.

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws govern how we handle your personal information. You may request access to the personal information we hold about you, ask us to correct it, and withdraw consent. You may also direct a complaint to the Office of the Privacy Commissioner of Canada. Because our infrastructure is located in the United States, your information may be stored and processed there. To exercise your rights, email privacy@warplink.app.

California residents have the right to know what personal information we collect, to access and delete it, to correct inaccurate information, and to opt out of the sale or sharing of personal information. WarpLink does not sell or share personal information as those terms are defined under California law. To exercise your rights, email privacy@warplink.app.

WarpLink is not directed to children. We do not knowingly collect personal data from children under 13, or under 16 in the European Economic Area. If you believe a child has provided us with personal data, contact privacy@warplink.app and we will delete it.

Our analytics measure aggregate usage on our own site and do not track individuals across third-party sites, so there is no cross-site profile to suppress. We do not sell or share personal data, so signals such as Global Privacy Control have nothing to act on. Because there is no industry standard for Do Not Track, we do not respond to it. Analytics runs only if you accept the cookie banner, and you can withdraw that choice at any time through the Cookie settings link, your browser's cookie settings, or the Google Analytics opt-out browser add-on.

We rely on the following providers to operate WarpLink. Each processes only the data needed for its function:

• A global edge network provider: link redirects and DNS, worldwide
• A US-based managed Postgres provider: dashboard data and click analytics, United States
• Stripe: payment processing
• Sentry: error monitoring
• Resend: transactional email delivery
• Google Analytics: aggregate usage analytics on our marketing site
• Formspree: contact form submissions

For the full register of named sub-processors, their locations, and whether they process customer end-user data, see our Sub-processor List.

WarpLink is a service operated by Stojanovski Industries Inc., a corporation located at Suite 603, 130 Spadina Avenue, Toronto, Ontario M5V 2L4, Canada, which is the data controller of the personal data described in this policy. For privacy questions or to exercise your rights, contact us at privacy@warplink.app.

WarpLink does not collect the Apple Identifier for Advertisers (IDFA). Our iOS SDK uses the Identifier for Vendors (IDFV), which does not require an App Tracking Transparency prompt under Apple's current guidelines. See the Mobile SDK and Attribution Data section above for the full list of signals we collect.

We may update this Privacy Policy from time to time. We will post changes on this page and update the date shown above. Continued use of WarpLink after changes take effect constitutes acceptance of the revised policy. For privacy questions or data requests, contact us at privacy@warplink.app.