Privacy Policy

Who handles your data

Linka is operated by Toxicum Labs LLC, registered in Wyoming, United States. Send privacy questions or requests to [email protected].

Information we process

We process the following to provide accounts, connections and paid services:

• Account information: email, display name, account identifiers, language and timezone preferences, and password-verification data or passkey public keys.
• Sign-in and device information: session identifiers, sign-in times, source IP and browser information, and authorized device names, platforms, client versions and authorization status.
• Connections and usage: connection identifiers, start and end times, upload and download volumes, allowances and usage records, and selected service locations.
• Connection quality: the approximate region and network provider of your connection, success or failure, error categories, latency and speed, used to improve connection quality and service availability.
• Transactions and support: orders, payment amounts and assets, channel transaction identifiers, refund status, coupon use, and information you send to support.
• Website visits and preferences: visitor identifiers, campaign source, medium and campaign parameters, visits to purchase pages, and language, theme and timezone settings.

Communication and activity

Providing network connectivity requires transient processing of destination addresses and transmitted data. The current product does not create activity logs containing your browsing history, domain-query history or communication contents.

This is not a promise of zero logs: account information, traffic totals, connection states and diagnostic information are processed or retained. Service providers may also process necessary network metadata for security and operations. This policy does not mean that every system retains no information at all.

Analytics and diagnostic data

Clients send analytics and diagnostic data by default to help us improve the app and troubleshoot faults. This may include account and device identifiers, approximate location, network and DNS environment, device performance, application and operating-system versions, connection identifiers, failure categories and a limited timeline of connection events. Failed destination domains, IP addresses and ports may be included; we do not collect a continuous browsing or DNS-query history through this feature.

These reports are not anonymous. Source IP addresses may represent intermediate services or VPN connections rather than your actual location. Client observations are not automatically treated as verified facts. Reports exclude passwords, access tokens, private keys, web-page contents, packet payloads and complete URL query strings.

You can turn off “Send analytics and diagnostic data” in client Settings. Turning it off cancels pending uploads and clears queued report files; it does not withdraw reports already received. Uploaded reports and their indexes are retained for 30 days and are available only to authorized operators for support, reliability and abuse investigation.

Why we use information

We use information to verify accounts and devices, establish and maintain connections, record usage and orders, provide refunds and support, improve connection quality, troubleshoot faults, prevent attacks or abuse, understand how users find the service, and measure our advertising.

Processing is based on providing the contracted service, necessary security and operational interests, applicable legal obligations, and consent where required by law.

Cookies and browser storage

Sign-in cookies maintain your session. Cookies and browser storage also support language, theme, timezone and acquisition attribution.

The sign-in and purchase pages load X's advertising pixel to measure the ads we run on X, and keep the click identifier X adds to its ad links in your browser for 30 days. When you then finish registering or pay for an order, we report that conversion to X, with the amount and currency for a payment. We do not send X your email address, order number or other account details, and the pixel runs apart from the pages themselves, so it cannot read what you enter on them. X processes what its pixel collects under its own privacy policy. Blocking third-party scripts in your browser, or clearing its storage, stops the measurement and removes the stored click identifier.

The current acquisition-attribution window is 30 days, and the browser attribution identifier expires according to that window. Expiry of the window does not mean the server has deleted the corresponding record. You can clear browser storage, but may need to sign in again and reset preferences or attribution.

We use Google Analytics (GA4) to measure page visits and confirmed new account registrations using analytics cookies. Google receives technical connection information including your IP address when your browser contacts Google. We send a generic page location without query parameters or fragments and an email-OTP registration method, never your email, name, account ID or credentials. You can manage analytics cookies and block analytics requests through your browser controls. Existing Google cookies may remain until cleared in your browser. First-source acquisition attribution is recorded separately with a random visitor cookie for 30 days and bounded campaign tags; account attribution is immutable.

Retention

You can request account deletion from Account Settings or the account deletion page on our website (/account/delete), without installing the app. After sign-in and confirmation, account access is disabled and personal data is deleted within 30 days. Deleted accounts cannot be restored.

Deletion covers sign-in credentials, profile, device authorizations, diagnostic reports, notification contact information and personal information in associated records. Only records necessary for accounting, refunds, disputes, fraud prevention or legal obligations are retained with restricted access for the applicable retention period.

Deletion turns off automatic renewal but does not automatically issue a refund or erase balances or pending financial settlements. Backup copies expire under their existing retention schedule and remain subject to the deletion request. Contact [email protected] for data rights requests or questions about retained records.

Providers, disclosures and international processing

We use providers for hosting, network connectivity, file distribution, email, payments and advertising measurement. They may process the information needed to deliver their services. Payment channels apply their own policies to information they collect during payment.

We may disclose necessary information to meet valid legal obligations, handle security incidents, or protect users or the service. An ordinary third-party request does not itself provide access to account information.

Users and service resources operate across regions, so information may be processed in the United States and other countries where providers operate. We apply cross-border safeguards where applicable law requires them.

Security and your choices

We use encryption, restricted access and device authorization to protect information, but no online service can be guaranteed completely secure. Do not share passwords, verification codes or authorization tokens.

Manage device authorizations and available account preferences, or contact [email protected] to request access, correction or deletion. You may also exercise other rights available under applicable law. Requests may require identity verification and may be limited by accounting, security or legal retention requirements.

Policy updates

This page displays the policy’s update date. We will explain material changes to processing purposes or practices, and provide notice or obtain new consent where required by law.

Privacy and data-request contact: [email protected].