Privacy & data

This service is operated by Gabriel Molter. For privacy questions, or to request access, correction, or deletion of your data, email gabriel@cpbr.digital.

People who visit links and pages

Public links and pages do not set analytics cookies or create persistent visitor identifiers. Unlocking a password-protected page sets an essential cookie for one hour so its buttons and images can load.

Analytics

When enabled, analytics increments daily counters for views and clicks, grouped by link or page, referring hostname, broad device class, and likely bot traffic. These counters never store IP addresses, full referrer URLs, or full user-agent strings. Do Not Track and Global Privacy Control signals turn this measurement off.

Your account

We store your email address, username, hashed password, and the content you create. At signup, we record the terms version you accept and the acceptance time. Your session uses an essential, HTTP-only cookie that expires after seven days. You can export your account, pages, and links from Personal settings, and delete your account there. Deletion removes the account and its content and analytics from the active database.

Payments

Pro payments are processed by the payment provider. We keep each purchase’s amount, term, status, and reference. We never store card or bank account details.

Abuse reports

A report stores the reported public URL, the reason, details, review status, and time for up to 90 days. Reports do not ask for the reporter’s email or store their IP address. Please avoid including sensitive personal information in a report.

Retention

Aggregate analytics are kept for 365 days. Security audit records are kept for 90 days. Expired tokens, invitations, and rate-limit records are removed automatically every six hours. Account data and uploaded images are kept until you delete them. Deleted data can remain in encrypted backups until those backups expire. Server and security logs are kept separately from analytics and rotated by size.

Service providers

Hostinger VPS in Boston, United States. Cloudflare global DNS/HTTPS proxy processes network metadata; optional RUM and Zaraz are disabled on Capybara hostnames. Twilio SendGrid sends account and operational email with click/open tracking disabled for those messages. Providers may process data outside Brazil. Encrypted backups on Homer in Petropolis, Brazil retain seven daily, four weekly and three monthly restore points and contain account data and recovery secrets.

Last updated 11 October 2026.