Last updated 12 August 2026
Privacy
This policy names the actual fields in the actual database. If a sentence here is vague, treat that as a bug and tell us.
The short version
- We never store IP addresses, of creators or of visitors.
- We never store user agents.
- We never store full referrer URLs — only a seven-value category.
- There are no third-party scripts, ad networks or analytics tags on any page.
- Nothing we store can follow a person from one day to the next.
- There are no accounts, so there is no name, email or password to lose.
If you create a link
The row we write contains:
- The destination URL you entered, normalised.
- Your title, description, creator name and theme — as you typed them.
- Your steps: type, label, target URL, and for a code step a PBKDF2 hash and a random salt. Never the code itself.
- A SHA-256 hash of your management key. Never the key.
- Expiry, unlock cap, unlock count, created and updated timestamps.
- The registrable domain of your destination, stored separately so moderation can find every link pointing at a domain without scanning every URL.
- A creator hash: a salted digest of your IP address that also includes today's date. Explained below.
The creator hash, precisely
When you create a link we compute SHA-256(secret_salt + today's date + your IP), keep the first twelve characters, and store that. Your IP address exists in memory for the length of that one request and is never written anywhere.
It exists for one purpose: so moderation can see that two hundred links came from one source this morning, which is a spam operation and never a creator. Because the date is part of the input, the same person produces a different value tomorrow — the value is structurally incapable of following anyone across days, including by us.
If you open someone's link
We write an event to Cloudflare Analytics Engine — an append-only counting store, not a database of people. Each event contains:
- The event name (
locker_view,unlock_success, and so on). - The link's slug.
- Your country, as a two-letter code. Nothing finer — no region, no city.
- A device category: one of
mobile,tablet,desktop,bot. - A referrer category: one of
direct,search,social,chat,video,internal,other. We know traffic came from a chat app. We do not know which server, group or conversation. - The page language, and the step id when the event is about a step.
- A visitor hash, described below.
The visitor hash
Same construction as the creator hash: a salted digest of your IP, your user agent and today's date, truncated to twelve characters. It lets a creator see "roughly 400 people" instead of "1,200 page loads". It cannot identify you, it cannot be reversed, and it is a different value tomorrow.
Your unlock progress lives in a cookie on your own device, signed so it cannot be forged. It expires after an hour and we store no copy.
What we deliberately do not do
No fingerprinting
No canvas rendering, no WebGL probing, no font enumeration, no audio context, no screen or timezone collection, no battery or hardware concurrency reads. The device category above comes from a coarse user-agent match and the user agent is discarded immediately.
No third parties
There is no Google Analytics, no Meta pixel, no tag manager, no ad network, no session recorder, no chat widget. The only external request any page can make is to Cloudflare Turnstile, and only on pages that can show a challenge. We do not sell, rent or share data, because there is nothing collected that would be worth buying.
No email
Creating a link requires no email address. Reporting a link requires no email address. There is no mailing list.
Reports, logs and retention
Reports. A report stores the reason, your optional free text, your country, and a daily reporter hash used only to collapse duplicates. No email, no IP.
Server logs. Cloudflare's platform records request metadata for a short, platform-controlled window as part of operating the network. Our own application logs contain a random request id, an error code and a country — never a URL that identifies a person's activity, and never a credential.
Retention. Analytics events are held by Analytics Engine for its retention window (currently up to 90 days) and then gone. Resolved reports are deleted after 180 days. Moderation audit entries are deleted after 365 days. Links live until they expire or you delete them. Deleting a link erases its destination URL from our database immediately and permanently — the row is kept only as a tombstone so the slug cannot be reassigned to somebody else.
Your rights
Under GDPR, UK GDPR, CCPA and comparable laws you have rights of access, correction, deletion and portability. Here is the honest situation:
As a creator, your management link IS your access, correction, portability and deletion mechanism. It works instantly, needs no request, and requires you to prove nothing to a human.
As a visitor, we hold nothing that identifies you, so there is nothing to access or delete. That is not evasion — it is the deliberate consequence of the design described above. If you believe we hold something about you, write toprivacy@subtounlock.app and we will look.
Legal basis (GDPR Art. 6): legitimate interest in operating a link service safely, and in preventing abuse. We do not rely on consent for anything, because we do not do anything that would require it.
Cookies
There is no cookie banner because every cookie we set is strictly necessary: unlock progress, a management session, a CSRF token, and your theme and language preferences. None is used for advertising or tracking, and none is shared with anyone.
Where your data lives, and changes
Everything runs on Cloudflare — Workers, D1, KV, R2 and Analytics Engine — distributed across their global network. Cloudflare acts as our processor; their sub-processor list and data-protection terms are published on their site.
If this policy changes materially we will update the date at the top and note what changed. We will not quietly start collecting something this document says we do not.
Questions: privacy@subtounlock.app. Related reading: Safety,Terms, andAcceptable use.