Privacy Policy

Last updated: June 2026

1. Introduction

LinkID ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use our service.

2. Information We Collect

We collect the following information:

  • Account Information: Username, display name, and password (stored as a secure hash)
  • Profile Data: Avatar image (optional, resized to a small static image, stored as base64)
  • Recovery Code: Stored as a secure hash, and additionally encrypted so it can be shown again to you from a trusted location
  • Two-Factor Data: If you enable two-factor authentication, your authenticator secret is stored encrypted
  • Password History: Hashes of previously set passwords, kept to help protect against account takeover (never stored in plain text)
  • Session Data: Login timestamps, session tokens, IP address, and device information (browser, OS, device type)
  • Geographic Data: Approximate location (country and city) derived from your IP address, used for security verification. The list of countries you have marked as trusted is stored on your account
  • Security Audit Log: A log of security-relevant events (such as sign-ins, password and 2FA changes, and administrative actions), including the IP address, approximate location, and device used
  • Application Data: Data stored by connected third-party applications, including profile content (bio, favorites, collections), messages (wall posts, replies), and uploaded images (avatars, banners)
  • Activity Data: Last application usage timestamp (for abandoned account detection)
  • Moderation Data: Ban reason, administrator notes, appeal messages, and appeal responses (if applicable)

3. What We Don't Collect

LinkID is designed with privacy in mind. We do not collect:

  • Email addresses
  • Phone numbers
  • Real names (unless you choose to use your real name as display name)
  • Payment information
  • Tracking cookies for advertising
  • Browsing history outside of LinkID

4. How We Use Your Information

Your information is used to:

  • Authenticate your identity and manage your account
  • Provide single sign-on services to connected applications
  • Protect your account through geographic verification
  • Display your profile information (avatar, display name) to connected applications
  • Moderate content and enforce our Community Guidelines
  • Process ban appeals and communicate moderation decisions
  • Detect security threats (such as privilege escalation attempts) and signs of account compromise, and apply protective measures
  • Detect inactive accounts (no sign-in for over 1 year), deactivate them and remove them after a further 30-day restore window
  • Improve and maintain the Service

5. Data Security

We implement industry-standard security measures to protect your data:

  • Passwords are hashed using bcrypt with a high cost factor (12+)
  • Recovery codes are stored as hashes (never in plain text)
  • Sensitive values such as recovery codes and two-factor secrets are additionally encrypted at rest (AES-256-GCM)
  • Optional two-factor authentication (TOTP) adds a second login factor
  • All connections are encrypted via HTTPS
  • Authentication tokens are stored in httpOnly cookies (not accessible to JavaScript)
  • Session tokens are securely generated UUIDs
  • Rate limiting and temporary IP lockouts prevent brute-force attacks (5 login attempts per minute, 3 registrations per hour)
  • Security-relevant events are recorded to an audit log to help detect and investigate abuse
  • Automatic threat detection blocks privilege escalation attempts

6. Content Moderation

To maintain a safe environment:

  • Uploaded images (avatars, banners) in connected applications may be reviewed by application administrators before becoming publicly visible
  • User-generated content (messages, profile information) may be reviewed by administrators if reported or flagged
  • Moderation data (ban reason, notes, appeals) is stored as part of your account and visible to administrators
  • If your account is suspended, you can view the reason and submit an appeal through the suspension page

7. Data Sharing

We do not sell your personal information. Data may be shared with:

  • Connected Applications: When you authorize an app, it receives your username, display name, and avatar. Applications may also access per-app data you create within them
  • Application Administrators: Administrators of connected applications may view your profile content and uploaded images for moderation purposes
  • Legal Requirements: If required by law or to protect our rights

Each connected application can only access data you explicitly authorize.

8. Data Retention

We retain your data as follows:

  • Active accounts: Data is retained while your account is active
  • Suspended accounts: All account data is preserved during suspension to allow appeals and potential reinstatement
  • Deleted accounts: Soft-deleted for 30 days (allowing recovery), then permanently deleted including all associated data
  • Inactive accounts: Accounts with no sign-in (neither on LinkID nor through any connected application) for 1 year are deactivated. Signing in within the next 30 days restores the account unchanged; after that it is permanently deleted with all associated data. Administrator accounts are exempt. Usernames of permanently deleted accounts are never reassigned.
  • Session data: Retained until you log out or terminate sessions. OAuth sessions are immediately terminated upon account suspension
  • Security audit log: Retained for approximately 1 year, then automatically deleted
  • Anti-abuse records: Failed-login counters and temporary IP blocks are kept only for their short active window
  • Application data: Retained until you delete it or delete your account

9. Your Rights (GDPR)

You have the right to:

  • Access: View your account information in your profile
  • Rectification: Update your username (every 30 days), display name, avatar, and password; manage two-factor authentication and your trusted locations
  • Erasure: Delete your account and all associated data at any time
  • Data Portability: View and manage data stored by connected applications
  • Withdraw Consent: Disconnect applications, delete application data, or delete your account
  • Object: You can terminate any active session, and remove trusted locations, from your profile

10. Cookies

We use essential cookies only:

  • Authentication cookie (named __Host-linkid_token in production): Stores your session token (httpOnly, secure, sameSite: lax). If you choose "don't keep me signed in" or "shared computer" at login, it is set as a session cookie that is cleared when you close your browser
  • Language preference (linkid_locale): Stores your selected language (localStorage)

We do not use tracking, analytics, or advertising cookies.

11. Third-Party Services

We use the following third-party services:

  • MaxMind GeoLite2: For geographic verification (IP to location lookup, processed locally on our server)
  • CDN / proxy provider: Incoming traffic passes through a content-delivery and security proxy, which processes connection metadata (including IP addresses) to deliver and protect the Service
  • Security alerting service: Security and error events from our audit log — which may include IP address, approximate location, and device information — are forwarded to a third-party messaging service used for operational monitoring

No personal data is sold or sent to advertising or analytics services. Some of the providers above may process limited data outside the European Union.

12. International Data

Your account data is stored on servers located in the European Union. If you access LinkID from outside the EU, your data will be transferred to and processed in the EU. Some operational providers (such as our CDN/proxy and security alerting service) may process limited technical data, such as IP addresses, outside the EU.

13. Children's Privacy

LinkID is not intended for children under 13. We do not knowingly collect information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the "Last updated" date. We recommend checking this page periodically.

15. Contact

For questions about this Privacy Policy, to exercise your GDPR rights, or to report a privacy concern, please contact us through the dejelnieks.lv website.

Back to home