Privacy

What Clink is

Clink lets you post life events ("posts") to people you have approved. There is no public profile, no directory, and no way for other users to find you except by an invite link you handed out or by looking up the exact phone number or email you have chosen to be discoverable by.

Conversations happen off Clink: each post offers Call and Text buttons that open your phone's own dialer or messaging app. Clink records that you tapped one (see "Reach-outs" below) but never sees the call or message.

What we collect, why, and for how long

We collect only what a feature needs. This is the complete list.

Identity — your phone number and email address (both required), display name, optional photo. Used for your account, exact-match lookup (if you allow it), and the Call/Text buttons. Kept for the life of your account; erased 14 days after you request deletion.

Contact channels — an optional WhatsApp number you enter yourself (we do not verify it), and any future messaging channels you add. Shown only to followers you have approved. Kept for the life of your account.

Appearance preference — your chosen theme and palette, so your devices match. Kept for the life of your account.

Credentials and sessions — passkeys you register, sign-in sessions (90 days idle, 1 year maximum), and short-lived verification codes (10 minutes).

Your graph — who you follow, who follows you, requests you have sent or received (including declined ones and history of past follows), topics you own or belong to, mutes, and invite links you create with a record of who used them. Used to decide who can see what. Kept for the life of your account.

Content — your posts, their photo, and every earlier version if you edited them. When you delete a post it disappears from every screen for everyone, including you, but we keep it internally until your account is purged or you make a legal deletion request; see "Deleting" below.

Inbox state — which posts you have received and read, so your inbox can empty. Authors never see this.

Devices and notification preferences — push tokens and which channels (push, SMS, email) you allow. Removed after 180 days unseen or when a token stops working.

Delivery records — a 30-day log of which notifications we tried to send, so we can retry and debug.

Security log — sign-ins, phone/email/passkey changes, deletion requests. Shown to you in the app; kept 90 days.

Reach-outs — when you tap Call, Text, or WhatsApp on a post, we record the post, you, the person, and which button. This is how we measure whether Clink works ("conversations started"). Kept for the life of the post; purged with your account.

Product analytics — first-party events about how the app is used (for example "post posted"). They are stored on our own servers only; raw events are deleted after 12 months, leaving daily totals with no user attached. No third-party analytics service ever receives your behaviour.

SMS opt-outs — if a number texts STOP to us, we record the number and when, and send it no more texts of any kind, sign-in codes included, until it texts START. The record belongs to the number, not to an account, so it is kept after your account is deleted; otherwise a STOP would stop being honoured.

Housekeeping — short-lived records for duplicate-request protection (24 hours), unsubscribe-link replay protection (45 days), verification codes and rate-limit counters (minutes to two days).

What we do not collect

Your address book (contact matching reads what you pick in the system picker, compares it, and discards it — nothing is stored), your location, your date of birth (we ask only that you confirm you are 13 or older), third-party analytics, or IP logs beyond what our hosting provider keeps by default.

Who can see your phone number

When you approve someone's follow request, or they accept your invite link, they can see your phone number and any contact channels you have enabled, so they can call or text you about what you post. The app says this at the moment you approve. Nobody else can see it.

Deleting

Deleting a post hides it everywhere, for everyone, immediately. We keep the record internally — it is fully erased when your account is purged, or on a verified legal deletion request (for example under the GDPR or CCPA), which we honour with the same purge mechanism.

Deleting your account starts a 14-day grace period during which signing in lets you cancel. After that, everything listed above is erased, including your posts, photos, follows, topics you created (co-owned topics pass to the successor you designated or to the most senior co-owner), notifications queued for you, and your security and analytics records. Apart from rate-limit counters that expire within two days, the one thing kept is an SMS opt-out: if your number texted STOP, we keep that record — the number and when — so we never text it again; texting START removes it.

What we cannot recall: text previews already delivered by SMS or email, and photo links that were still valid for up to 10 minutes after deletion.

Notifications

Product notifications (a new post, a follow request, a new follower, a topic co-ownership invitation) go to at most one channel per event, preferring push, then SMS, then email, subject to daily caps. Security notices about your account go to every verified channel you have not opted out of, with at most 5 texts an hour and 20 a day; past that, they still go by push and email if you have them. When you change your phone number or email address, the notice of the change also goes to the number or address it replaced. When you create an account, we send one welcome email to your address. It is sent only once, so it has no unsubscribe link. Reply STOP to any SMS to stop SMS entirely; every product email has an unsubscribe link (security emails cannot be unsubscribed, but you can change the address they go to in Settings).

Providers

We use a small number of infrastructure providers to send verification codes, SMS, email and push notifications, to store photos, and to host the service. Each receives only what that job needs (for example, your phone number to deliver a code). We do not sell data and we do not share it for advertising. The current providers are listed at the end of this page.

Advertising

Clink is free and shows no ads. If that ever changes, ads would never be tied to analytics about your behaviour in the app, and data would never be sold. We will update this page before any such change.

Children

Clink is for people 13 and older. We ask you to confirm this when you sign up and we do not collect a date of birth. If you believe a younger child has an account, contact us and we will delete it.

Your controls and rights

In the app you can: change whether people can find you by phone or email (both on by default), remove followers, manage contact channels, review and revoke sessions, review the security log, deactivate, and delete your account. A full data export is planned for the next release. To exercise a legal right (access, correction, deletion, portability), email hello@clink.la.

Changes

We will post changes here with a new date, and notify you in the app before any change that expands what we collect.

Contact

Clink · hello@clink.la

Current providers

• Hosting: Vercel (application) and Neon (database)
• Photo storage: Cloudflare R2
• Phone verification: Plivo Verify
• SMS: Telnyx
• Email: Amazon SES
• Push: Apple Push Notification service and Firebase Cloud Messaging (delivery only; no Firebase analytics)