This policy explains what information KeptLink (“KeptLink”, “we”, “us”) handles: on keptlink.com and its free generator, in the dashboard at app.keptlink.com, and when someone opens a KeptLink short link or scans a KeptLink dynamic QR code. KeptLink is operated by Vivek Kumar, a sole proprietor based in India. The short version: what you type into the free generator never leaves your browser, we never store the IP addresses of people who scan your codes, and we don't sell personal information.
The free QR code generator
The generator runs entirely in your web browser. The content you enter (website addresses, WiFi names and passwords, contact details, messages and any logo you upload) is used on your device to draw the code. It is not sent to our servers, and we cannot see it. The generator remembers only your last design settings (colors, styles) in your browser's local storage, never the content. Static codes send scanners straight to your content; those scans don't pass through KeptLink.
When you download a code, your browser sends KeptLink one short message saying only which kind of code it was and the file format (for example, “WiFi, PNG”). We use it to count how many codes the free generator makes, as daily totals. The message contains none of your content, no cookie and no identifier, and we keep only the totals. To stop abuse, our hosting provider briefly checks how many messages come from the same internet address; we don't store that address.
Your account
- Account details: your name, email address and a securely hashed password, or, if you sign in with Google, the name and email address of your Google account (and the address of your profile picture). Google also gives us a sign-in token, which we keep but don't use to access anything else in your Google account. We use these details to run your account and to send you service emails (verification, password resets, invitations, trial and billing notices).
- Two-step verification (optional): if you turn it on, we keep your authenticator app's secret key and your backup codes, both encrypted. Codes we email you are stored only as a one-way hash and expire after 10 minutes. We email you when two-step verification is turned on or off, when you create new backup codes, and when a backup code is used.
- What you create: your workspaces, team members and invitations, and your links: destinations, titles, tags, UTM settings and saved QR designs (including any logo, stored as an image). We keep the history of destination changes so you can see it.
- Support tickets: if you contact us through Support in the dashboard, we keep your messages and our replies, the topic, and the workspace or link you chose. Only you and KeptLink's administrators can see them, not other members of your workspace. Our staff may add internal notes to a ticket, which are kept with it. We email you when we reply.
- Activity records: we record important account and admin actions (for example a destination change, a member change or a safety block) for security and support, and keep them for 2 years.
- Sign-in cookie: the dashboard uses a strictly necessary cookie to keep you signed in, and, if you choose “Trust this device”, one that lets that device skip the two-step code for 30 days. We don't use advertising cookies, and the dashboard uses no analytics cookies.
People who scan your codes or open your links
When someone opens a KeptLink short link or scans a dynamic code, we record a visit so you can see your analytics:
- the time, and whether it came from a QR scan or a link
- an approximate location (country, region, city) that Cloudflare derives from the IP address
- the device type, operating system and browser, read from the browser's user-agent
- the referring website's domain, if the browser sends one
We never store the visitor's IP address. To count unique visitors, we combine the IP address and user-agent with a random value that changes every day and keep only the resulting one-way code (a hash). Each day's random value is deleted after 48 hours, so these codes can't be traced back to a person or linked from one day to the next. Individual visit records are kept for 90 days; after that, only daily totals remain. Known bots and link previews are filtered out and not counted.
You, as the workspace owner, decide what your links point to and who sees your analytics. Visitors who have questions about a specific code can contact the business that published it, or us.
Safety checks with Google Web Risk
To protect visitors from phishing and malware, the destination addresses of KeptLink links are sent to Google's Web Risk service to check them, when a link is created or changed and again from time to time. Google processes those addresses under its own terms and privacy policy. We never visit or download your destinations from our servers.
Payments
Paid plans are sold by Creem (creem.io), our payment provider acting as Merchant of Record, which collects your payment details, billing address and tax information and processes them under its own privacy policy. We never see or store your card number. We receive and keep the plan, the subscription status and dates, and the provider's customer and subscription IDs. Billing event records are deleted after 12 months.
Visiting our websites
- Hosting and security: KeptLink runs on Cloudflare, which processes technical information such as IP addresses to deliver the service and protect it from abuse. Sign-up and the abuse report form use Cloudflare Turnstile to tell people from bots.
- Page views: when a page of keptlink.com first appears on your screen, it sends one short message to our own page counter at count.bedrockproject.app, which runs on Cloudflare. It holds the address of the page (without anything after a ? or #), the name of the website that linked you to it, if any, and whether your browser reports that it is controlled by software. The counter adds one to that page's count for the day. It does not store your IP address or browser details, sets no cookie, gives you no ID and stores nothing in your browser. So that one visitor counts once a day for each page, it turns the date, the page, your IP address and your browser details into a one-way code made with a secret key, and keeps only that code. The code is deleted within three days, and the daily counts after 400 days. Known bots are not counted. It doesn't run on the dashboard or on your short links and QR codes.
Who we share information with
We don't sell or rent personal information, and we don't share it for advertising. We use these service providers to run KeptLink:
- Cloudflare: hosting, databases, storage, security and our page counter
- Google: Web Risk safety checks of destination addresses, and Google sign-in if you choose it
- Resend: sending service emails
- Creem: payments, as Merchant of Record
We may also disclose information when required by law, or to protect people from fraud, phishing or other harm.
How long we keep information
- Account and workspace data: while your account exists.
- Individual visit records: 90 days. Daily totals contain no visitor-level data and are kept indefinitely.
- Daily random values used for visitor hashing: 48 hours.
- Activity records: 2 years. Billing event records: 12 months.
- Support tickets: until 24 months after they're closed.
- Two-step verification data: until you turn it off or we reset it at your request. Emailed sign-in codes: 10 minutes. Trusted devices: 30 days.
- Backups: our weekly database backups are kept for 12 weeks.
Your choices and rights
You can see and change your account details and links in the dashboard, and export your links as a CSV file at any time. Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, or to object to how we use it. To make a request, including deleting your account, email hello@keptlink.com. We'll answer within 30 days. See also how to delete your data.
Security
We use encryption in transit, hashed passwords, optional two-step verification, access controls between workspaces and limited administrative access, with two-step verification required for administrators.
To protect an account, we may also sign it out on every device or lock its sign-in. If you lose access to your two-step verification, we can turn it off after confirming it's you. We email you when we do any of these.
No service can promise perfect security, and we'll tell affected users if a breach affects their information, as required by law.
Children
KeptLink is not directed at children under 13, and we don't knowingly collect personal information from them.
Changes to this policy
We'll update this page if our practices change. The date at the top shows when it was last updated.
Contact
Questions about this policy? Email hello@keptlink.com.