Privacy Policy
Effective 17 October 2026 · Version 2026-10-17
This policy covers two different groups of people:
- Account holders who sign up and build a page.
- Visitors to a public OnlyLink page, who never signed up. Section 4 is about you.
1. Who is responsible for your data
The data controller is Bilal Hameed, a sole proprietor trading as OnlyLink, of Chakwal (P.O 48800), Punjab, Pakistan.
For any privacy question, or to use any of the rights in section 9: contact@ghaznix.com · +92 316 5502120
There is no separate data protection officer. Mail to the address above reaches the person responsible.
2. Our position in one paragraph
We do not sell personal data, we do not run advertising networks on your page, and we do not embed third-party trackers in it. Analytics are counted on our own servers, and a visitor’s IP address is never written to our database. Section 4 explains how that works, because it is unusual enough to be worth describing rather than claiming.
3. Account holders
| What we hold | Why | Legal basis | How long |
|---|---|---|---|
| Email address | Sign-in, security notices, billing notices, password resets | Performance of a contract | Life of the account |
| Password, stored as an argon2id hash | Sign-in | Contract | Life of the account |
| Username | Your page address | Contract | Life of the account |
| Google account id and email, if you sign in with Google | Sign-in | Contract | Life of the account |
| Your page content: display name, bio, links, images, design | To publish the page you asked us to publish | Contract | Life of the account, or until you delete it |
| Settings: timezone, language, search-indexable flag | To make the product behave as you set it | Contract | Life of the account |
| Session records: the IP address and browser user agent of each sign-in | So you can see your active sessions and revoke one you do not recognise, and so we can spot account takeover | Legitimate interests (account security) | A session expires after 30 days and the record is deleted about a week later |
| Support email you send us | To answer you | Legitimate interests | Up to 2 years |
We do not hold your card number, billing address or tax details. Those go to Paddle, not to us. See section 6.
4. Visitors to a public page
When a page is viewed, or a link on it is clicked, the page sends us one event. Each event row holds:
- view or click, and which link was clicked
- the time
- a two-letter country code (for example
PK,DE) - device type and browser family (for example “mobile”, “Safari”)
- a referrer category (for example “instagram”, “direct”), not the full referring URL
- a daily visitor hash, described below
What we do not store: your IP address, the full user agent string, your precise location, any cookie or identifier that follows you, and anything that persists across days.
The daily visitor hash. To count unique visitors rather than raw hits, we take your IP address and user agent, combine them with a secret salt and today’s date, and store only the irreversible SHA-256 result. The raw IP is used in memory for that calculation and then discarded. Because the date is part of the input, the same visitor produces a different hash tomorrow, so the value cannot be used to follow anyone over time or across pages.
Country. Resolved from the IP address either from a header our hosting provider adds, or by looking it up in a database that is compiled into our own server binary. No visitor IP address is sent to a geolocation service.
Legal basis. Legitimate interests: a page owner needs to know whether anybody is reading their page, and this is the least intrusive way we know to tell them. The data is aggregated, contains no identifier that persists beyond the day, and is never used to build a profile or to target anything at you. If you object, see section 9.
Retention. Event rows are kept for the life of the account that owns the page, and are deleted along with everything else when that account is deleted. We do not currently prune them on a schedule, and we would rather say so than publish a retention window our software does not enforce.
5. Cookies and local storage
We use no advertising or analytics cookies, and no cookie banner, because we set nothing that needs consent.
| Name | Where | What it does | Lifetime |
|---|---|---|---|
ol_rt | The app, after you sign in | The session refresh token. HttpOnly, Secure, SameSite=Lax, scoped to /api/auth | 30 days |
localStorage | The app editor | Remembers which parts of your design the shuffle button should leave alone. No personal data | Until you clear your browser |
Public pages set no cookies at all. The analytics beacon in section 4 is a plain HTTP request with no cookie and no stored identifier.
6. Who else processes your data
These are the only processors and controllers involved. Each one is named, not described as a category.
| Who | What they do | What they see | Where |
|---|---|---|---|
| Paddle | Merchant of Record: takes payment, charges tax, sends invoices, handles billing support | Your name, email, billing address, card details, tax status | UK, US and EU |
| Railway | Hosting, Postgres database, Redis cache | Everything in sections 3 and 4, as the infrastructure it runs on | US and EU regions |
| Resend | Sends transactional email: verification, password reset, security notices | Your email address and the content of those messages | US |
| Optional “Sign in with Google” | Only if you choose it: your Google account id and email | Global |
Paddle is a separate controller, not our processor. Once you buy a subscription, Paddle is the Merchant of Record and decides for itself how to handle your payment and tax data, under its own privacy notice and buyer terms. If you want to know what is held about your payment, ask Paddle; if you ask us, we will tell you that and help you reach them.
We disclose data beyond this list only where the law requires it, and we will tell you unless we are forbidden from doing so.
7. International transfers
We operate from Pakistan and our providers operate in the United States, the United Kingdom and the European Union, so personal data leaves the EEA and the UK.
Where that happens, the transfer relies on the Standard Contractual Clauses adopted by the European Commission, and the UK Addendum to them, incorporated into our contracts with each provider named in section 6. You may ask us at contact@ghaznix.com for details of the mechanism relied on for any particular provider.
8. Security
Passwords are stored as argon2id hashes and never in plain text. Traffic to the app and to every public page is served over HTTPS. Your sign-in token is held in memory only and never written to browser storage, so a cross-site scripting bug cannot read it out. Refresh tokens are stored hashed, are rotated on every use, and a token used twice invalidates the whole session family. Access to the production database is limited to the operator.
No system is perfectly secure, and we do not claim otherwise.
9. Your rights
If you are in the EEA or the UK you have the rights below under the GDPR. We extend all of them to everyone, wherever you live, because keeping two standards is worse than keeping one.
- Access: a copy of what we hold about you.
- Rectification: correct anything wrong. Most of it is editable in the app.
- Erasure: delete your account and its data. Account settings, “Delete account”. This removes your page, your analytics events and your sessions.
- Portability: a machine-readable copy of your account and page content. We have no self-service export yet, so email us and we will send it within 30 days.
- Restriction: ask us to stop processing while a dispute is resolved.
- Objection: object to processing based on legitimate interests. For the analytics in section 4, email us from the page you visited, or ask the page owner; we can exclude a page from analytics collection on request.
- Withdraw consent: where we rely on consent, withdraw it at any time. Withdrawal does not undo processing already carried out.
- No automated decision-making: we do not profile you or make automated decisions with legal effect.
Email contact@ghaznix.com. We answer within 30 days, free of charge. We may ask you to confirm who you are before we act on a request about an account.
Complaints. You may complain to your local data protection authority. In the EU, find yours at edpb.europa.eu. In the UK, the ICO at ico.org.uk. We would rather you came to us first, but you do not have to.
10. Children
OnlyLink is not for children. You must be at least 16, or the age of digital consent in your country if that is higher, to hold an account. We do not knowingly collect data from anyone younger. If you believe a child holds an account, email contact@ghaznix.com and we will delete it.
11. If something goes wrong
If a breach puts your rights at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as Article 33 requires, and tell affected account holders without undue delay by email, describing what happened, what data was involved and what we are doing about it.
12. Changes
We will update this policy as the product changes. The version number and effective date at the top of the page change with it. For changes that materially affect your rights we will email account holders at least 30 days before they take effect.
13. Contact
Bilal Hameed, Chakwal (P.O 48800), Punjab, Pakistan Email contact@ghaznix.com · Phone +92 316 5502120