Privacy Policy

Last updated: October 14, 2026

Who we are

Pinned ("we", "us") runs pinned.bio, a link-in-bio service. Contact: support@pinned.bio.

What we collect

• Account data: your email address, username, hashed password (never the password itself), display name, headline, location and note chips, bio, page time zone, links, tiles and content blocks, social profiles, your search title and description, the description (alt text) of your share picture, and your appearance choices. We also store when you accepted the terms and which version, your plan and billing references (see Payments), and the sign-up tag described below. If you sign in with Google, we store your Google account id and email, and the sign-in tokens Google returns. We keep those tokens but don't use them after you've signed in.
• Sign-up tag: when someone arrives from one of our ads or tagged links, the tag in the link (for example "meta") is passed through to the sign-up form and saved with the account if they sign up. Nothing is stored on their device. The tag is also sent to our analytics (PostHog) with the sign-up event. It holds no personal details.
• Emails we send you: we send account emails (confirming your address, password links, password changes, a notice when your page address changes, and account deletion) through Resend, our email provider, which receives your email address and the message.
• Help & feedback messages: when you send us a message from Help & feedback in the app, we store its type (support or feature request), your message and any screenshot you add, with your account. We email the message, with your username, email address and plan (not the screenshot), through Resend to our support inbox (forwarded by Cloudflare Email Routing).
• Visit and click statistics: when someone views a public page, or clicks a link or social icon on it, we record the time and the details described under Page analytics below. This applies to every creator's page, whatever their plan. Every creator can see how many times each of their links and social icons was clicked; only creators on the Max plan can see the other statistics. We do not store visitors' IP addresses with these statistics.
• Cookies and device storage: see the list below.

Cookies and device storage

We set these cookies, all for running the service:

• pinned_session keeps you signed in. It lasts 14 days.
• pinned_theme remembers the site theme you pick. It lasts 1 year.
• pinned_preview lets people we give a preview link see the site while it is closed to the public. It lasts 30 days.
• pinned_oauth_csrf checks that a Google sign-in is the one you started. It lasts 10 minutes.
• pinned_reset carries a password link through the password page. It lasts 15 minutes.
• pinned_goodbye holds the email address of an account you just deleted, so we can show the goodbye page. It lasts 10 minutes.
• Stripe's cookies: on the checkout page, Stripe's own script sets fraud-prevention cookies (__stripe_mid, about 1 year, and __stripe_sid, 30 minutes). Stripe's privacy policy applies to them.

The signed-in app also keeps interface preferences in your browser's local and session storage, such as whether the preview is open or a hint was dismissed. These stay on your device. Our analytics sets no cookies (see Analytics below), and creator pages set no cookies on their visitors.

Images

You can upload images for your page: a profile picture, a cover image, page backgrounds (including animated ones), a logo to each link, an image to each Featured tile, Image and Gallery blocks, custom video thumbnails and a share picture. We never keep the file you upload: we convert it into a new, resized image and store only that. The conversion removes all metadata, such as location (GPS), camera details and comments. For a share picture we also keep a larger copy (up to 2,400 pixels on the longest side), so you can re-crop it later. The images are stored with Cloudflare R2 and served from media.pinned.bio at public addresses, so anyone who has an image's address can view it, as with the rest of your public page. You can remove any of them at any time in your dashboard, and deleting a link removes its logo and its image. When an image is replaced or removed, we delete its file from storage; a copy may linger in the content-delivery network's cache for a short while afterwards (bounded to about an hour), but its address is no longer linked from your page.

Screenshots you add to a Help & feedback message are converted the same way. They are stored with Cloudflare R2 at an unguessable address that no public page links to and that we never show or email to anyone; only Pinned's team views them. We delete a screenshot when we close your message, or when you delete your account.

Video and music tiles

When you add a video or music tile (YouTube, Vimeo, TikTok, Spotify or SoundCloud), our server asks that platform's public lookup service for the item's title, creator name and cover image, sending it only the link you added. We do this when you add, replace or refresh the tile and about every 30 days afterwards, to keep the details current and to hide items that have been made private or removed. We store the title and label with your page and a resized copy of the cover image, as described under Images. Visitors' browsers never contact the platform when your page loads: only a visitor who taps the tile goes to the platform's site or app, where that platform's privacy policy applies.

Latest videos

When you add a Latest YouTube videos block, our server asks YouTube's public pages and channel feed for your channel's name and its newest videos (title, date and thumbnail), sending only the channel address you gave. We do this when you add or change the block, when you choose Refresh now, and about every 6 hours afterwards while the block is shown. We store the channel name and handle, the video titles and dates, and resized copies of the thumbnails, as described under Images. Visitors' browsers never contact YouTube when your page loads: only a visitor who taps a video goes to YouTube, where YouTube's privacy policy applies.

Payments

Payments are processed by Stripe. Paid plans are sold through Link, Stripe's merchant-of-record service (Stripe Managed Payments), so Link is the merchant of record for your purchase. Stripe and Link collect and process your payment details (card, Apple Pay, Google Pay or Link), billing address and tax information under their own privacy policies: Stripe's privacy policy and Link's privacy policy. We never see or store your card number or other payment credentials. We share with Stripe your account email and account id (to start checkout and match the payment to your account) and receive from it only what we need to run your plan: a customer and subscription reference, which paid plan you're on (Pro or Max), its status, billing interval and renewal date. We also use the country worked out from your IP address to show your region's prices and to set the price level of a new subscription. We store that price level with your subscription. Refunds and billing support go through Link support.

Hosting

Railway runs the app, so it receives every request to Pinned, including visitors' IP addresses. Our database is hosted by Neon. Images are served from media.pinned.bio through Cloudflare, which receives those requests, including visitors' IP addresses; pinned.bio itself is not proxied by Cloudflare.

Analytics

We use PostHog, a product-analytics service run by a US cloud processor, to understand how Pinned is used and to diagnose errors. It runs in cookieless mode: it sets no cookies, stores nothing on your device and does no session recording. What it receives:

• From your browser, on public pages, login, signup and the signed-in app: the page address (URL) and referrer, your IP address, and your browser, operating system and device type. PostHog uses the IP address only to make a visitor code that changes every day, then removes it; no location is worked out from it. PostHog's default settings also send your screen size, language and time zone, and an event when you leave a page, with the time on the page and how far you scrolled. Pages whose address can carry a secret (email verification, password reset, checkout success and reporting) load no analytics.
• From our servers, when you have an account: product and billing events (for example signing up, verifying your email, starting checkout, plan changes, changing your password, deleting your account, and creating or changing links, social icons, bio, picture or appearance), tied to your internal account id, with your username and plan as properties. Some carry more: the sign-up tag (as "source"), the price level of a checkout, and, when you delete your account, its age and how you signed in. We never send your email address, passwords or tokens.
• Public link and social-icon clicks (which link, and the page's username), without any visitor identity.
• Error reports and warning-level application logs.

We don't sell this data. PostHog keeps analytics events for up to 12 months and application logs for 14 days. You can ask us to delete your analytics profile at any time.

Page analytics

Pinned records every visit to a public page and every click on a link or social icon, whatever the plan of the creator whose page it is, and turns these records into aggregate statistics. Every creator can see the total number of clicks on each of their own links and social icons. Only creators on the Max plan can see the other statistics (visits, unique visitors, click-through rates and the breakdowns by source, country, device and link), and only for their own page. Visits from bots and link-preview crawlers, prefetch requests, and the page owner viewing their own page while signed in are not recorded. A click by one of them is recorded without any visitor details (no identifier, country or device): it adds to the link's click total but not to the Max statistics. We do not currently act on Do Not Track or Global Privacy Control signals for these statistics.

This uses no cookies and does not store IP addresses. Instead we compute a pseudonymous code from the visitor's connection details, using a secret that is replaced every day and deleted afterwards, so we can count unique visitors within a day but cannot recognise a visitor from one day to the next. We also record:

• The country, derived from the IP address at the time of the visit; the address itself is not kept.
• The device type (mobile, tablet or desktop) and the referring site or app, if any.

Individual records (page visits, and the visitor identifier, country and device of clicks) are kept for 90 days; after that only the click itself (its time and referring source) remains, until the link or social icon, or the account, is deleted. Daily totals (visits, unique visitors, clicks and their breakdowns by source, country, device and link) are kept for as long as the account exists and are deleted with it. Creators only see totals. On a page with very few visitors, a total can reflect a single visit. How we count views explains each number.

Country lookups use IP geolocation data by DB-IP (IP Geolocation by DB-IP, licensed under CC BY 4.0), or the country supplied by our network provider Cloudflare.

Search engines

Your Pinned page is public. Search engines such as Google and Bing may list it, starting 7 days after you sign up or change your username and once it has a link or social icon and a photo, name, headline or bio. You can stop this at any time in Account → Search engines; your page then tells search engines not to list it, and they drop it after they next visit, which can take a few weeks. When your page is shared, apps show a preview card with your name, username and photo, or the share picture you chose.

Reports

Anyone can report a public page or link through its "Report" link. A report includes the page or link concerned, a reason, an optional note and an optional contact email. We use the contact email only to follow up on your report.

How long we keep data

We keep account data while your account exists. You can delete your account at any time on the Account page. Deletion is immediate: we delete your profile, links, tiles, social icons, images, statistics, the reports about your page and your Help & feedback messages. Image files are deleted from storage at once; a cached copy can stay at the content-delivery network for up to about an hour. For 7 days after a deletion we keep your former username, so nobody else can take it straight away, with your internal account id and Stripe customer reference, so we can stop a payment that was still under way; within a day after those 7 days they are deleted too. When you change your username, we keep the former one with your internal account id for 7 days, to forward visitors to your page and stop anyone else from taking it; within a day after those 7 days it is deleted. A username you replace within 15 minutes to fix a typo isn't kept. Analytics events recorded before the change keep the username and page address they were recorded with. Billing records are kept by Stripe and Link as long as tax and accounting law requires, and we keep a log of payment notifications that holds no personal details. Reports (including any contact email you gave) are kept until the reported account is deleted. Reports you made about other pages are not linked to your account and follow the same rule. Help & feedback messages are kept while your account exists; their screenshots are deleted when we close the message. The copy emailed to our support inbox, and any replies, stay there like any other email you send us. Deleted data can remain in our database provider's restore history and backups for up to 7 days. Analytics events stay tied to your internal account id, never your email. We clear the username from your analytics profile, but events already recorded can keep your username and page address (link clicks carry the username, and page views carry the page address). An account whose email is never confirmed, or a Google sign-up that never picks a username, is kept until it is deleted; you can ask support@pinned.bio to delete it.

Your rights

You can view and edit your data in your dashboard, change your password and delete your account on the Account page, and ask us to export your data by contacting support@pinned.bio.

Children

Pinned isn't for anyone under 16. If we learn that an account belongs to someone under 16, we delete it.

Changes to this policy

We may update this policy; we'll say so on this page and, for material changes, by email.