Privacy Policy
Updated October 13, 2026
This policy explains the information Linktain uses for accounts, payments, visitor records and sponsored tasks, including what is sent to advertising partners when a locker requests offers.
1Who we are
Linktain operates linktain.com from the United States. Send anything about this policy to info@linktain.com, including a request to see, correct or delete what we hold about you. Telegram at @LinksWithAndrew and Discord at @andrewworks are faster for a question, but a formal request should go to the address so there is a record of when you asked.
2If you visit a locked link
You do not need an account to open a locked link. Our visit records contain a salted hash of your IP address, your browser's user agent, the referring page and approximate location. We use your IP address to determine which sponsored offers are available. When we request offers for a locker, we send the advertising partner your IP address, browser user agent, language preference and the public locker URL. This request can happen when the locker loads, before you open a task. The visitor records in our application database store the hash rather than the raw address.
3Why a hash instead of an address
The hash answers one question: is this the same visitor as an hour ago. That is what stops one person being paid for a hundred times, and it is the only reason the field exists. Storing the address would answer the same question and would also identify a person, which we have no use for. Same answer, less data, so we take the less.
4If you have a creator account
We store your email and name, and either a hash of your password or your Google or Telegram account id depending on how you sign in. We never see or store a Google or Telegram password. We record when you last signed in and by which method, so you can tell your own session from somebody else's. We keep your application answers: where your traffic comes from, your Telegram or Discord handle, and your own estimates of earnings and daily volume.
5If you request a payout
We store the method and destination you give us, a PayPal email, a wallet address or bank details. We need it to send money and we keep it as the record of where a payment went. It goes to nobody except the provider actually moving the funds.
6If you buy a pass
Stripe handles payment end to end. Your card number never reaches our servers and we could not store it if we tried. We keep your email, what you paid, which pass, and when it expires. The email is what lets you restore a pass after clearing your browser, which is why we ask for it before payment rather than after.
7What we do not do
We do not sell your personal information to data brokers. We do not use Google Analytics, a Facebook pixel or a tag manager, and we do not build advertising profiles. We share the information needed to select and track sponsored offers as described below. When you open a sponsored task, the lt_sid cookie lets Linktain recover your opened and completed steps in the same browser. It lasts up to 30 days; the cookie policy explains what it holds.
8The sponsored steps
We request suitable offers using the visitor information described in section 2. Opening a sponsored task then sends you to a partner's website, where that site's privacy policy applies. We pass a random click identifier and the public locker slug so a confirmed completion can unlock your step and credit the creator. We receive the offer identifier, completion information and payout. We do not receive your answers or the information you enter in the offer, and we cannot read the partner's cookies.
9Who else touches it
Stripe processes payments, Resend delivers email and netcup hosts Linktain. Advertising partners receive the offer-selection and click information described in sections 2 and 8. Their own policies explain how they handle data on their services. Contact us if you need the provider details relevant to your visit.
10Where it is stored
Our servers are in Vienna, Austria. We are a United States company, so data collected here is held in the European Union and accessed from the United States. If you are in the EU or UK, that transfer is covered by the standard contractual clauses our providers operate under.
11How long we keep it
Visit records are kept while they are needed to run and audit payments, in practice the current financial year and the one before it. Account data is kept while the account exists. Records of money that actually moved, payouts and conversions, are kept seven years because tax law requires it, and a deletion request cannot override that.
12Your rights
Wherever you live, you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to info@linktain.com and we answer within 30 days. We delete what we are not required to keep and tell you plainly what we kept and why. We will never charge you, deny you service, or pay you less for asking.
13California
Under the CCPA and CPRA you may request the categories and specific pieces of personal information we have collected, the sources, the purpose and who we shared it with. You may request deletion and correction. Contact us to exercise your rights or ask about the advertising partners that received information for your visit. Blocking lt_sid stops us from recovering task progress in that browser; it does not stop the offer-selection request described in section 2. You may use an authorised agent, and we will not discriminate against you for exercising these rights.
14Europe and the United Kingdom
If you are in the EEA or UK, the GDPR applies to you and you additionally have the right to object to processing, to restrict it, to data portability, and to complain to your national supervisory authority. Our lawful bases are: contract, for running your account and paying you; legitimate interest, for hashing addresses to prevent duplicate payment and fraud, which is the least identifying method we found; and legal obligation, for financial records.
15Children
Linktain is not for anyone under 18 and we do not knowingly collect information from children. If we learn that an account belongs to a child we close it and delete what we hold.
16Security
Passwords are hashed, never stored in a readable form. Sessions are signed and their cookies are HttpOnly and Secure. Traffic is encrypted in transit. No system is perfectly secure, and if a breach ever affects your data we will tell you rather than wait to be asked.
17Changes
If we change what we collect or why, this page changes and so does the date at the top. If the change is material we email account holders instead of expecting anybody to re-read a page they already read.