Privacy Policy

What we collect

• Account: your email address, which doubles as your sign-in (we send you a magic link — no passwords to leak).
• Page content: everything you put on your event pages — names, dates, venues, schedules, stories, and settings.
• RSVP responses: when your guests RSVP, we store what they submit — name, attendance, party size, event choices, and any message. Guests don't need accounts.
• Photos: photos you upload and photos your guests share to your page. Photos a host approves appear in the page's gallery, visible to anyone with the link.
• Payments: when you upgrade a page, our payment processor Stripe handles your card. We receive confirmation that you paid — we never see or store card numbers.
• Technical basics: standard server logs (pages visited, timestamps) used for security and debugging.

How we use it

• To run the service: host your pages, record RSVPs, store photos.
• To sign you in and send transactional email (magic links, RSVP notifications).
• To occasionally email hosts about their own pages — for example, a reminder that last year’s birthday page is ready to roll forward. Every one of those emails carries an unsubscribe link.
• To process upgrades and prevent fraud.
• To understand, in aggregate, how the product is used so we can improve it — from our own server logs and from a self-hosted, cookie-free pageview counter that runs on every page, including guest pages.

We do not use your data — or your guests' — for advertising, and we never sell personal data to anyone.

Legal basis for processing

If you're in the European Economic Area or the UK, we process your personal data only on one of these legal bases under the GDPR:

• Contract — to provide the service you signed up for: hosting your pages, recording RSVPs, storing photos, and sending the transactional emails that make it work (magic links, RSVP notifications).
• Legitimate interests — to keep the service secure and running (server logs for security and debugging, fraud prevention) and to understand, in aggregate, how the product is used (the self-hosted, cookie-free pageview counter described above). The data involved is aggregate or technical — never sold, never used for advertising.
• Consent — for the occasional non-transactional emails about your own pages (like the birthday roll-forward reminder). Every one carries an unsubscribe link, and unsubscribing stops them.
• Legal obligation — to keep the payment records the law requires us to keep after an upgrade.

Who else touches your data

We use a small set of processors to operate linkfor.us, each only with the data it needs:

• Stripe — payment processing.
• Resend — transactional email (magic links, notifications).
• Neon — database hosting.
• Cloudflare R2 — photo storage.
• Vercel — website hosting.

One more thing runs on every page: a self-hosted, cookie-free pageview counter on our own analytics server (analytics.oddinks.com). It records aggregate visits — which page was viewed, the referring site, basic device and network details — and nothing that identifies you or your guests. There is no third-party analytics vendor in the picture: the data lives on infrastructure we operate, it never feeds advertising, and we don't share it with anyone else except when required by law or to protect the service from abuse.

International data transfers

linkfor.us is operated by ODDINKS LLC in the United States, and the processors listed above are US companies. If you use linkfor.us from the EU, the UK, or anywhere else outside the United States, your data is transferred to and processed in the United States — and, for some processors, in other countries where they operate — solely to provide the service described in this policy. We don't transfer your data anywhere else, and we never sell it.

Cookies

We use essential cookies only — the ones that keep you signed in and remember basic preferences. No advertising cookies, no third-party trackers, no cross-site profiling of your guests.

Your rights

You can ask us at any time to see, correct, or delete your personal data — email support@linkfor.us. Deleting your account removes your pages, RSVPs, and photos from our systems. We answer rights requests within a month.

If you're in the EU or UK, the GDPR also gives you the right to a copy of your data (portability), to restrict how we process it, and to object to processing based on our legitimate interests. If you're in California, the CCPA gives you the right to know what personal data we collect and why, to correct it, and to opt out of any sale or sharing of it — we don't sell or share personal data, so there's nothing to opt out of, and we never discriminate against anyone for exercising their rights. We honor these rights wherever you are.

How long we keep data

We keep your pages and their content for the hosting period described in our Terms — at least two years from your event date for paid pages. RSVP data belongs to your page and is deleted with it. Server logs are kept for up to 12 months for security purposes. The self-hosted pageview data is kept only in aggregate, on our own server, for as long as it helps us understand product usage — it is never tied to a name, email, or guest list.

Children

linkfor.us is built for adults planning events. If you're a host, you're responsible for the photos and information you and your guests upload — including any photos of minors. If you believe a child's data was posted without permission, contact us and we'll remove it promptly.

Security

We use industry-standard practices — encrypted connections (HTTPS), a managed database with access controls, and passwordless sign-in so there's no password database to breach. No system is perfect; if we ever discover a breach affecting your data, we'll tell you.

Changes to this policy

If we make material changes, we'll update the effective date above and, for significant changes, notify you by email. Continuing to use linkfor.us after changes take effect means you accept the updated policy.