Privacy Policy

This policy explains what personal data inmy.bio and 👻❤.ws (“inmy.bio”, “we”) collect, why, who else handles it, and the choices you have. It covers two groups of people: creators, who have an account, and visitors, who open a page hosted on inmy.bio.

We are the controller for creators’ account data and for visitor analytics. For emails and form answers a creator collects on their page, the creator is the controller and we process that data for them (see section 3).

1. Data about creators

• Account: email address, name, a hash of your password (never the password itself), your language, and the time you verified your email. If you sign in with Google or Apple, we receive your email address and an account identifier from them.
• Your pages: what you publish: profile, photos and other uploads, links, blocks, themes, handles, emoji links and custom domains.
• Billing: your plan, subscriptions and invoices. Stripe handles card details; we never see or store your card number. If you subscribe in the iPhone or Android app, Apple or Google takes the payment and we receive the transaction details (product, dates, renewal status and a transaction ID) to turn your plan or emoji link on.
• The mobile app: once per install, a random install ID, the platform, OS and app version and the device model, so we can count downloads. If the app crashes, a crash report with the device and OS details and your account ID (not your email) goes to Firebase Crashlytics so we can fix it. Photos and videos you pick are checked for nudity on your device before upload; that check sends nothing anywhere.
• Integrations: API keys you give us for tools like Mailchimp, Kit, MailerLite, Beehiiv or Brevo, stored only to send them your subscribers; the account IDs and keys of payment providers you connect (PayPal, Mollie, Mercado Pago, Razorpay, Lemon Squeezy), stored encrypted and used only to take payments for you; analytics pixel IDs you add; and API keys and webhooks you create.
• Security and support: sign-in sessions, security events, and what you write to us.

We use this to run your account and your pages, take payments, prevent abuse, keep the service secure, send you service emails (verification, password reset, receipts, important changes) and, if you leave them on, the weekly stats email, alerts about new sign-ups on your page, and reminders before an emoji link ends. You can turn the optional emails off in Settings or with the unsubscribe link in each one. The legal basis is our contract with you, and our legitimate interest in keeping the service secure and working.

2. Data about visitors

When someone opens a page or clicks a link on it, we record a view or click for the creator’s analytics: the page and block, the time, the referring site, the country (from our network provider), the device type, the browser and any UTM campaign tags. To count unique visitors without cookies, we combine the IP address and browser signature with a secret that changes every day and keep only a short hash of the result. We don’t store visitors’ IP addresses with analytics, can’t link a visitor across days, and use no advertising or cross-site tracking. Our basis is our legitimate interest, and the creator’s, in knowing how a page is used.

If a visitor buys something or leaves a tip, Stripe or the payment provider the creator connected (PayPal, Mollie, Mercado Pago, Razorpay or Lemon Squeezy) processes the payment under its own privacy policy, and we keep the order (item, amount, time, the buyer’s name and email as the provider shares them, and any message the buyer added) so the creator can see it.

3. Emails and form answers collected on creators’ pages

If a page has an email or form block, what visitors enter there (such as an email address, a phone number or answers) is stored for the page’s creator. The creator decides what to collect and how to use it. Questions or requests about it should go to the creator first; we will help them answer. Where the creator turns on double opt-in, we email the visitor once to confirm. If the creator connects an email tool (Mailchimp, Kit, MailerLite, Beehiiv or Brevo), new sign-ups are sent there.

4. Cookies and local storage

• session: keeps you signed in to the dashboard, for up to 30 days.
• csrf_token: protects forms against cross-site request forgery.
• Local storage: remembers your language and a few display preferences in your browser.

These are strictly necessary, so we don’t ask for consent. inmy.bio sets no advertising or analytics cookies. A creator can add their own Google Analytics, Meta Pixel or TikTok Pixel to their page. Those load only after the visitor chooses Allow on that page, and then follow Google’s, Meta’s or TikTok’s own policies; the choice is kept in the visitor’s browser. Videos, music players and other embeds that creators add to their pages come from those services, which may set their own cookies under their own policies.

5. Who else handles data

We share personal data only with service providers that help us run inmy.bio, under contracts that protect it:

• OVHcloud: our servers, in Warsaw, Poland (EU).
• Cloudflare: domain names, network delivery, TLS certificates for custom domains, and the spam check on page forms where it is on.
• Amazon Web Services: storing uploaded images and videos (Amazon S3), sending email (Amazon SES, Frankfurt, Germany) and routing custom-domain set-up.
• Stripe: payments, subscriptions and invoices on the website.
• Google: web fonts on public pages, sign-in with Google if you use it, checking links against Safe Browsing, crash reports from the mobile app (Firebase Crashlytics), and Google Play billing for subscriptions bought in the Android app.
• Apple: sign-in with Apple, if you use it, and App Store billing for subscriptions bought in the iPhone app.
• Brandfetch: logos of third-party tools shown in the dashboard, loaded straight from its servers.
• Unsplash: photo search for page backgrounds, when you use it.
• Mailchimp, Kit: only if you connect them yourself.

Loading fonts, logos and embeds sends your IP address and browser details to the provider, as with any web page. Some providers are in the United States or other countries outside the EU. Where that happens, transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We don’t sell personal data and don’t share it for advertising. We disclose data to authorities only when the law requires us to.

6. How long we keep data

• Account and page data: while your account exists. When it is deleted, we remove it from the live system within 30 days.
• Analytics events: for your plan’s analytics history (7 days on Free, 30 on Starter, 1 year on Pro, 2 years on Business), then deleted automatically.
• Form answers and sign-ups: until the creator deletes them or their account.
• Invoices and orders: as long as tax and accounting law requires, usually up to 10 years.
• Backups: encrypted nightly backups are kept for 30 days and then overwritten.

7. Your rights

Depending on where you live (for example under the EU or UK GDPR), you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Most of your data can be edited in the dashboard; your page’s emails and form answers can be exported as CSV. For anything else, including deleting your account, write to us through our contact form using your account’s email address. We answer within 30 days. You also have the right to complain to your local data protection authority.

8. Security

Passwords are stored as strong one-way hashes, all traffic is encrypted with HTTPS, access to servers is limited and logged, and backups are encrypted. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

9. Children

inmy.bio isn’t for children under 16. If you think a child has given us personal data, contact us and we will delete it.

10. Changes and contact

If we change this policy in a way that matters, we tell creators by email or in the dashboard before it applies. Questions or requests about privacy: use our contact form. See also our Terms of Service.