Privacy Policy

This policy applies to two groups of people:

• Creators — people who register for a Clikproof account to create and manage tracking campaigns.
• Link visitors — people who click a Clikproof tracking link (e.g. swivlink.co/abc123). No account is required.

For creators (account holders):

• Email address — used for authentication, managed by Supabase Auth.
• Profile information you choose to provide: display name, username, bio, niche, follower counts, and audience demographics (age range, gender, location). All optional.
• Campaign data: campaign names, destination URLs, and tracking short codes you create.

For every click on a Clikproof tracking link:

• Timestamp of the click.
• Country and city (derived from IP address via a local geolocation database — the raw IP is never stored).
• Device type (mobile, desktop, or tablet), operating system, and browser — derived from the User-Agent header.
• Referrer URL (the page the visitor came from), if present.
• A one-way SHA-256 hash of the IP address — used only to detect duplicate clicks. The hash cannot be reversed to obtain the original IP address.

We never store raw IP addresses. Geolocation is resolved in memory at the moment of the click, and the IP is then discarded.

• To provide creators with accurate click analytics for their campaigns.
• To generate shareable, verified campaign reports for brands.
• To deduplicate clicks — the hashed IP lets us detect when the same visitor clicks multiple times, without storing any personally identifiable information.
• To filter automated bot traffic from analytics.
• To authenticate creators and maintain account sessions.

We do not use any collected data for advertising, profiling, or sale to third parties.

We share data only in the following limited circumstances:

• Supabase — our database and authentication provider. Data is stored on Supabase infrastructure. See supabase.com/privacy.
• Campaign reports — creators can share a public report link with brands. This report shows aggregated click statistics (totals, countries, devices, etc.) but never raw IP data or individual visitor identities.

We do not sell, rent, or trade any personal data with third parties.

We use a single session cookie to keep creators logged in. This cookie is strictly necessary for the platform to function and is set only when you sign in to your account.

We do not use advertising cookies, third-party tracking pixels, or analytics cookies of any kind.

• Creator account data is retained for as long as your account is active.
• Click data is retained for as long as the associated campaign exists.
• Deleting a campaign removes all associated click data.
• Closing your account removes all campaigns, click data, and profile information.

If you are located in the European Economic Area, you have the following rights:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — request deletion of your account and all associated data.
• Right to restriction — ask us to limit how we process your data.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interests.

To exercise any of these rights, email contact@clikproof.com. We will respond within 30 days.

All data is transmitted over HTTPS. IP addresses are processed in-memory only and never written to disk or logs. Passwords are managed by Supabase Auth using industry-standard hashing. We apply the principle of minimal data collection throughout the platform.

We may update this policy as the platform evolves. If we make material changes, we will update the date at the top of this page. Continued use of Clikproof after changes constitutes acceptance of the updated policy.

For any privacy questions or requests, contact us at: contact@clikproof.com