Legal
Privacy Policy
Last Updated:
DeepLinkNow (“DLN”, “we”, “us”) helps apps send people to the right screen after they tap a link, including after they install the app. We collect only what that job needs, keep it briefly, and never use it for advertising or cross-app tracking.
Who is responsible
Our customers are the developers who integrate DLN into their apps (“Customers”). For data about the people who tap their links and use their apps (“end users”), the Customer is the data controller and DLN acts as a data processor on the Customer's behalf.
For our Customers' own account and billing data, and for visitors to deeplinknow.com, DLN is the controller.
End-user data we process
When someone opens a DLN link (on a *.deeplinknow.com subdomain or a Customer's custom domain), the landing page records a short-lived device description used to match the click to an app install:
- IP address (read by our server from the connection)
- User agent, platform, OS version, device model, screen size and pixel ratio, language and time zone, and a hash of these characteristics
- The link's path and query parameters, and the time of the click
We also keep a click record (time, link, IP address, user agent) so Customers can see operational counts such as clicks and installs.
On iOS, when the visitor taps the button to go to the App Store, the landing page copies the link to their clipboard. On the app's first launch the DLN SDK reads the clipboard once, on the device; if it holds one of the app's DLN links, the SDK returns it to the app. iOS 16 and later may ask the user to allow the paste. The clipboard content is not sent to DLN.
On Android, the landing page adds a reference to the click to the Google Play referrer, which the SDK reads after install.
When the app opens, the DLN SDK sends similar device details (user agent, OS version, device model, screen, language, time zone) and an app-scoped device identifier (the identifier for vendor on iOS, ANDROID_ID on Android) so the server can find and claim the matching click. The SDK initialization also lets us count monthly active devices for billing, which we store only as one-way hashes.
What we don't do
- We never read advertising identifiers (IDFA or Google advertising ID) and the SDKs don't require the App Tracking Transparency prompt.
- We don't load analytics, advertising or tracking scripts on link landing pages. The only script there that isn't our own is Vercel BotID's bot check, served from the link's own domain, which we use only to keep bots from creating links and recording clicks.
- We don't build profiles, link people across apps or Customers, or sell or share data with data brokers or ad networks.
- We don't use end-user data for anything other than delivering the Customer's deep links and the counts shown in their dashboard.
Data retention
- Matching window: a click can be matched to an app install for 1 hour. After that it is no longer offered as a fingerprint match.
- Fingerprints (including the IP address and link context) are deleted at most 30 days after the click. The longer window exists only so an exact Android Install Referrer lookup can still succeed after a slow install.
- Click records have their IP address, user agent and any location or referrer details removed after 30 days. Only aggregate counts are kept after that.
- Monthly active device counts are kept as one-way hashes, never as raw identifiers.
- Customer account data is kept while the account is active. Billing records are kept as long as tax and accounting law requires.
Customer account data
For Customers we process your email address (for passwordless sign-in and service email), your app configuration (bundle IDs, package names, domains and link settings), API keys (stored as hashes), usage counts, and subscription status. Payment card details are handled by Stripe and never reach our servers. Messages sent through the contact form are delivered to us by email.
Analytics on deeplinknow.com
On deeplinknow.com itself (the marketing site, docs, blog and dashboard), but never on Customers' link landing pages, we use Google Analytics, Vercel Analytics and Vercel Speed Insights to understand how the site is used and how fast it loads. These services may set cookies or collect your IP address, browser details and pages visited, under their own privacy policies.
We also set one first-party cookie of our own, dln_src, when you first arrive on deeplinknow.com from another site or a tagged link. It holds only the referring site's domain name, any campaign tags in the link, the page you landed on and the date, and expires after 90 days. If you sign up within a day, we store it with your account so we know which channels bring customers. It is never set on link landing pages and never shared.
Service providers
We use these service providers (sub-processors) to run DLN. Each receives only what it needs for the purpose listed.
| Provider | Purpose | Data |
|---|---|---|
| Vercel | Hosting, serverless functions and edge network, and Vercel BotID bot detection on link landing pages | All requests, including IP addresses, as part of serving the site, the landing pages and the API. BotID's check runs from the link's own domain and only decides whether a click came from a bot. |
| Supabase | Database hosting (Postgres) and app-icon storage. Sign-in runs in our own code on that database. | Account data and sign-in sessions, app and link configuration, fingerprints and click records, and uploaded app icons |
| Google and GitHub | Optional sign-in to the dashboard with a Google or GitHub account (OAuth) | When a customer chooses it: their name, email address, whether the provider has verified it, and profile picture. No end-user data. |
| Stripe | Payments for paid plans | Customer billing details. No end-user data. |
| Cloudflare | Custom domain provisioning and TLS (Cloudflare for SaaS) | Requests to customers' custom link domains, including IP addresses |
| Amazon Web Services (SES) | Transactional and contact-form email | Customer email addresses and messages sent through the contact form |
| Microsoft Azure Translator | Automatic translation of landing-page text (paid plans, opt-in) | The customer's landing-page copy. No end-user data. |
| Google Analytics, Vercel Analytics and Vercel Speed Insights | Usage and performance analytics for deeplinknow.com (marketing site and dashboard only) | Visitors to deeplinknow.com. Never loaded on customers' link landing pages. |
Customer responsibilities
As the controller for end-user data, each Customer is responsible for:
- Having a legal basis for processing, and obtaining consent where required
- Telling their users about DLN in their own privacy notice
- Not putting sensitive personal data in link paths or parameters
- Complying with the data protection laws that apply to their app
GDPR and your rights
We process end-user data only on Customers' instructions and only to provide the service, and we help Customers meet their obligations. A data processing agreement is available on request.
If you used an app that uses DLN and want to access or delete your data, contact that app's developer. Because we keep end-user data for at most 30 days and don't tie it to a name or account, it will usually already be gone. If you need help finding the right developer, email privacy@deeplinknow.com.
Security
- Encryption in transit (HTTPS) for every request
- Each Customer's data kept separate: every database query our servers run is limited to the Customer's own organization and apps, and browsers and SDKs never get direct database access. Row-level security stays on as a second layer
- API keys stored as one-way hashes
- Short retention, so there is little to protect in the first place
Changes to this policy
When this policy changes we update the “Last Updated” date above and, for material changes, email Customers before the change takes effect.
Contact
Questions about this policy or our data practices: privacy@deeplinknow.com.