Privacy Policy

Account information — your email address, an optional display name, and a securely hashed password. If you sign in with Google, we receive your basic Google profile (email and name). If you turn on two-factor authentication, we store the secret and backup codes needed to verify it.

Your content — the timelines you write: their titles and entries. This content is yours.

Usage and technical data — we use privacy-first, cookieless web analytics (Cloudflare) that measure aggregate page views and real-world performance (Core Web Vitals). There is no cross-site tracking and no advertising profile. We also use error monitoring (Sentry), which may record technical details such as your browser and a truncated network address to help us fix crashes. Sign-in sessions record your IP address and browser signature, for account security.

Cookies — a sign-in session cookie, short-lived sign-in security cookies (such as the sign-in-with-Google state check and the two-factor challenge), a language-preference cookie, a short-lived invite cookie, and a 7-day acquisition-source cookie set only when you arrive via a promotion link. (Copies of the source cookie saved before 2026-07-26 may remain on your device for up to 30 days; they no longer have any effect and are removed on your next visit.) We use no advertising or cross-site tracking cookies.

Invitations — if you use or share an invite link, we record which account invited which, so we can grant the referral bonus.

Acquisition — if you arrive via a promotion link, we record the channel tag it carried on your account at sign-up; we also record each image export (when it happened and the browser used) to understand which channels and devices work. The tag identifies a channel, never you.

Billing — if you subscribe to Plus, payment is handled by Stripe. Your card details go to Stripe directly and never touch our servers; we store your subscription status and a Stripe customer reference.

To provide and secure the service, send essential account emails (address verification, password resets, and security notices), prevent abuse (rate limiting and blocking disposable-email signups), and understand aggregate traffic and performance.

We do not sell your data, and we do not use your timeline content for advertising.

We rely on a small set of service providers, each processing data only to deliver their part of the service: Supabase (database), Vercel (web hosting), Fly.io (export-image rendering), Cloudflare (DNS and cookieless analytics), Google (optional sign-in), Stripe (payments), Resend (account emails), and Sentry (error monitoring).

You can delete your account yourself at any time, from account settings. Deletion takes effect immediately and permanently: your account and all of your timeline content are erased from our database, and any active subscription is canceled. This can’t be undone.

Afterwards we keep a small audit record of the deletion — including a one-way hashed reference to your former email address, basic technical details of the request (such as network address and device), and non-identifying details of the deletion itself (such as how it was confirmed and how much content was removed). If you ever subscribed, we also keep our copy of Stripe billing events, which reference your Stripe customer identifier, to meet financial obligations. Short-lived operational entries (such as verification codes and rate-limit counters) expire on their own. Export activity records (the time and browser of each export) are unlinked from the deleted account and kept for aggregate analysis. None of these can be used to restore your account or read your timeline content.

When you delete a single timeline it disappears from the product immediately, and its data is permanently erased from our database within 30 days.

Passwords are hashed, two-factor authentication is available, and connections are encrypted. No system is perfectly secure, but we take reasonable measures to protect your data.

Our infrastructure is global, so your data may be processed on servers outside your country.

Sharing has two levels, and both are off until you choose one. "Shared": anyone with the link can view the timeline’s title and contents; link-only pages are not listed anywhere on TimeLink and are not indexed by search engines. "Public": in addition to the link, the timeline may appear on our public Gallery page (/board), and while it stays public its own page — title and all entries — can be indexed by search engines. Switching back to shared-only or private removes it from the Gallery and tells search engines to stop indexing it (already-cached copies can take some time to disappear); turning sharing off stops new visitors, but a link you have already shared works again if you re-enable sharing.

You must be at least the minimum age required by the laws of your country or region to use TimeLink, and we don’t knowingly collect data from anyone below that age.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above.