Privacy Policy

Effective date: October 15, 2026

XynLink is a link-in-bio page service: one page that holds all your links, at one short address. This policy explains, in plain language, what information we collect when you use XynLink, what we do with it, and the choices you have. Questions any time: support@xynlink.com.

What we collect

Your account. When you sign up we collect your email address and a username. Your password is stored only as a one-way hash — a scrambled fingerprint we can check against but never reverse — so we never see or store your actual password. If you check out as a guest in a member's store, the password you set is stored the same way and is used to create or link your account when the purchase is fulfilled.

Your page content. The display name, bio, profile photo, links, social accounts, thumbnails, and tracking IDs you add to your page are stored so your page can be shown to visitors. Your published page content is public by design — it is the page you publish. Files you upload for store products are different: they are stored outside the public webroot and are delivered only through signed, expiring links after a paid order.

Contacts and leads. Members collect contacts through their pages, and those contacts are stored in the member's own account — the list belongs to the page owner, and we store and process it to run the feature. That includes: email addresses (and optional names) visitors type into a page's email capture block; booking details (below); and contacts a member saves with the card scanner. A member can view and search their list, add notes, export it as a CSV file, or save a contact as a vCard. For scanned paper cards, the reading happens on the member's own device and the card photo is not sent to us; only the details the member chooses to save — such as a name, phone number, email address, or website — are stored. If a scanned card has no email address, the contact can still be saved with the name, phone, or link that was read.

Bookings and appointments. If a page takes bookings, we store what the visitor enters to request a time: their name, email address, optional phone number and note, and the service, date, time, timezone, and request status. The page owner receives these details so they can confirm, change, or decline the request, and request and status emails are sent to the visitor and the page owner.

Payments. Subscriptions are processed by PayPal, or by Stripe if you pay by card. We never see or store your card or bank details — the payment processor handles those. We keep an order record of each subscription: your email, the plan, the amount, the processor, a subscription or session reference, its status, and the date you are paid through.

Store orders. When someone buys a digital product or course, we keep the order record needed to deliver it and to keep the seller's accounts straight: the buyer's email address, the member account if the buyer was signed in, the product, page and seller, the amount, the status, and the PayPal order reference. Access is delivered through an order access link; downloads use signed, expiring links. If a purchase arrives through a member's resale link or card, we record which member referred it so the seller-set commission can be posted to the right wallet. The seller can see the buyer email and order details for their own sales.

Analytics. So page owners can see how their page is doing, we record simple counts: page views per day, clicks per link, and the hostname of the website that referred a visitor (for example, a search engine or a social app) when one is provided. Views are counted once per visitor per day using a one-way hash of the visitor's IP address — the raw IP address itself is not kept for analytics. Short links keep a simple click count and last-click time. For the free Personal Development library, we keep only aggregate play and download counts by title, file, action, and day; those counters store no IP addresses and no personal information.

Tracking pixels and embeds on member pages. Some page owners can add their own Meta Pixel ID or Google Analytics (GA4) measurement ID to their public page, and members can embed players from supported services such as YouTube, Vimeo, TikTok, and Spotify. If a page uses them, those third-party services may receive page-view or playback information and may set or read their own cookies, under their own privacy policies. That tracking belongs to the page owner's setup — it is not XynLink selling your information, and we do not control third-party cookies.

Cookies

We use a small number of cookies, each with a job:

· A session cookie that keeps you signed in to your account.
· A referral cookie: if you arrive through a member's referral link, we set a cookie for 30 days so that, if you join, the member who sent you can receive their referral credit.
· A visitor cookie that helps us count page views without double-counting the same visitor.
· A language cookie: when you pick a language for the site, we set a cookie for 180 days so the site remembers your choice.

Some of our forms also ask a simple math question (a human check) to keep bots out. It is checked when you submit and is not used to track you. Third-party pixels or embeds a page owner adds may set their own cookies, as described above.

How we use information

We use the information above to run XynLink: to operate your account and your page, manage your subscription, deliver store purchases and course access, show you your page statistics, deliver contacts and booking requests to page owners, attribute referral and resale credits, and prevent fraud and abuse. We do not sell personal information. Not to advertisers, not to data brokers, not to anyone.

When we share information

We share information only where it is needed to run the service: with PayPal, to process PayPal subscription payments and store purchases; with Stripe, to process card subscription payments; with the page owner, for information a visitor submits to that owner's page (contacts, booking requests, and store buyer emails for that owner's sales); with third-party pixel or embed providers when a page owner has added them and a visitor loads or plays that content; and if we are required to disclose something by law. That is the whole list.

Your choices

Email us at support@xynlink.com and we will let you see the personal information we hold about you, correct it, or delete it. If you close your account, your profile content is removed. If you gave your information to a member's page, that member holds their own copy in their contacts, bookings, or sales records and may have exported it before any deletion — copies outside XynLink are outside our control. Billing and order records are kept only as long as tax and accounting rules require.

Security

We protect your information with ordinary care: passwords are stored only as one-way hashes, sign-ins and pages are served over encrypted (HTTPS) connections, store files are kept outside the public webroot and delivered only through signed, expiring links, and access to account data is limited to what running the service requires. No system is perfect, but we work to keep your information safe.

Children

XynLink is not directed to children under 13, and we do not knowingly collect information from them.

Changes to this policy

If this policy changes, we will post the updated version on this page with a new effective date.