Who we are
comein.cc (“we”, “us”) runs the link-in-bio service at comein.cc and is responsible for the personal information described here. For anything in this policy, write to [email protected].
What we collect
If you create a page
- Your email address, to send you sign-in links and to reach you about your account. It is never shown on your page. There is no password.
- What you publish: your handle, profile, links, text, sections, private pages, the look of your page, and a custom domain if you add one. Keys are stored only as a one-way hash, so we cannot read them back.
- Images you upload. Every image is decoded and re-encoded before it is stored, which strips EXIF data, including GPS location. We never serve bytes we did not produce.
- Your page’s statistics (see below), shown to you and to nobody else.
- A session while you are signed in: a random token in a cookie, matched to a record on our server. Signing out deletes the record.
When you paste a link into the editor, our server fetches that address to fill in its title and picture. The site sees a request from our server, not from you.
If you visit a page
Visitors have no accounts. For each view, click and unlock attempt we record, for the page’s creator: the page and link involved, the time, the referring site as a bare host name (never the full address), a campaign tag if the link carried one, the country Cloudflare reports for the request, and a device class (mobile, tablet, desktop or bot). We do not store IP addresses, in our statistics or our logs. The browser’s User-Agent is reduced to that device class and the string is thrown away. Rate limits use a one-way hash of the address, held in memory and never written down.
If you write to us
We keep your message and our reply so we can deal with it.
Cookies
We use only cookies the service needs to work. There are no advertising or cross-site tracking cookies.
- Session cookie, for signed-in creators: keeps you signed in for 30 days from your last visit. Our sign-in library also sets short-lived security cookies during sign-in.
- Unlock cookie, for visitors who open a private page: a signed record of the keys this browser has presented, kept for 30 days on the visitor’s device. “Lock again” clears it.
- Human-check cookie, for visitors who pass a check to see protected links: kept for 24 hours.
- Age cookie, for visitors who confirm their age to see age-restricted links: a signed record of the age they said they are (18 or 21), for that one page. It is a session cookie, cleared when the browser session ends and never kept longer than 30 days. Nobody’s age is checked, and “Lock again” clears it.
The human check is Cloudflare Turnstile, which may use its own cookies or signals from the browser to tell people from bots. Cloudflare’s analytics beacon uses no cookies and no browser storage.
How we use it
- to run the service: sign you in, store and serve your page, open private pages for key holders;
- to show you your page’s statistics;
- to keep the service safe: rate limits, human checks, and enforcing the Terms;
- to answer you when you write to us, and to tell you about changes that affect your account.
We do not sell personal information, we do not show ads, and we do not share it with anyone except the service providers below, or when the law requires it.
Your public page is public
A published page can be seen by anyone, indexed by search engines, and is listed in our sitemap so they can find it. Unpublishing or deleting the page takes it off the sitemap and out of service. Private pages are never listed, never cached and marked not to be indexed.
Who processes it for us
- Cloudflare: every request to comein.cc passes through its network, so it receives visitors’ IP addresses as part of delivering the page. It also stores uploaded images (in Western Europe), sends sign-in emails, runs the Turnstile human check, provides the Web Analytics beacon that counts page views and page speed, serves custom domains, and forwards mail sent to our contact address.
- netcup: hosts the server that runs comein.cc and its database, in the European Union.
Database backups are copied to a separate server that we operate.
How long we keep it
- Your account, page, images and statistics: for as long as your account exists.
- Sign-in links: they expire after 15 minutes, and unused ones are deleted nightly.
- Sessions: until you sign out, or 30 days after your last visit.
- When you delete your account we remove, at once, your account, page, links, keys, statistics and the image files themselves, and we clear your page from Cloudflare’s cache. Copies in our database backups are overwritten as the backups rotate, within 90 days.
Your choices and rights
- See and take your data: download everything from your account page, any time, as a single .zip file holding your page, your keys’ settings, your statistics and every image you uploaded.
- Correct it: edit your page and profile in the editor.
- Delete it: delete your account from your account page.
For anything else, such as a question about your data or a request the tools above do not cover, write to [email protected]. Depending on where you live you may have further rights, including the right to complain to your data protection authority. Our statistics hold nothing that identifies a visitor, so we cannot find a particular visitor’s records in them.
Children
comein.cc is not meant for anyone below the minimum age in the Terms. If you believe a child has given us personal information, tell us at [email protected] and we will delete it.
Changes to this policy
The date at the top of this page says when this policy last changed. When a change materially affects you, we will tell you before it takes effect, by email or on the site.