Minimal data.
Explicit lifetimes.
Draft updated September 5, 2026
What Linkifact processes
- Artifact data: the HTML, title, immutable versions, size, status, and expiry needed to publish a link.
- Shared-session data: conversation text deliberately included in a portable bundle, its title and publisher-claimed source adapter, a redaction ledger, size, status, and expiry. Built-in native adapters deliberately do not extract native session IDs, hidden provider state, branches, or live tool state. Recognized credential patterns are redacted, but unknown sensitive text can remain.
- Account data: the email address used for one-time-code sign-in, plus authentication sessions, plan, collections, and hashed API-key records.
- Safety data: validation results, pseudonymous quota and abuse-prevention keys, reports, optional reporter contact details, and moderation state.
- Operations data: request IDs, timestamps, coarse outcome and performance data, and infrastructure security events. Application logs are designed to exclude HTML bodies, cookies, account credentials, and raw IP addresses.
Why it is processed
We use this data to provide requested publishing and account features, enforce limits, prevent abuse, investigate reports, secure the service, diagnose failures, and meet legal obligations. We do not sell personal data or place third-party advertising or analytics inside artifacts or the account application.
Who handles it
Cloudflare provides application, email delivery, database, object-storage, queue, DNS, and edge-security infrastructure. Access inside Linkifact is limited to service operation, support, safety, and legal needs.
Anyone who receives an unlisted artifact, session viewer, or session bundle URL can access that shared content and may save another copy. When you deliberately attach or paste an imported continuation into a coding harness, that harness and its model provider may process the continuation under their own account, retention, training, and privacy settings. Linkifact does not send an imported bundle to a model provider on its own.
Retention
A Free-account artifact's retention restarts after each successful version update; an account session keeps the expiry returned when it is published. Deleted bytes are queued for prompt removal and a minimal tombstone may remain for up to 30 additional days to make deletion responses deterministic and deter abuse. Account, collection, security, and report records are kept only while needed for the service, safety, disputes, or law; a final retention schedule is a public-launch requirement.
During the beta, the service also enforces conservative technical defaults for artifact and shared-session moderation data. Daily pseudonymous report-limit counters are eligible for deletion two days after their last update. Seven days after a report is closed as resolved or dismissed, a scheduled job makes the report's pseudonymous reporter key non-identifying and clears optional contact details, free-form report details, and the reviewer identifier. The remaining closed report row is eligible for deletion after 90 days. A moderation action's reviewer identifier and free-form reason are erased after 30 days; the action row is eligible for deletion after 180 days when it has been superseded on an active or quarantined resource, or its resource is missing, expired, or deleted. Open and reviewing reports, the latest action needed to interpret an active or quarantined resource, and action rows for a deletion still in progress are retained for safety and lifecycle recovery. Invalid timestamps and cleanup failures retain data for operator investigation instead of risking premature deletion. These are eligibility thresholds for a bounded 15-minute job, not guaranteed deletion instants, and remain subject to the final legal retention review described above.
Your choices
You can delete an artifact or shared session through signed-in owner controls and revoke API keys. The verified channel for access, correction, export, and account-deletion requests is not yet active.
Expiry or deletion stops Linkifact from serving the content, but it cannot retract copies that a recipient already downloaded, copied, cached outside Linkifact, or added to a downstream agent transcript. Review both the audience and the complete content before sharing or importing.
Security and children
Linkifact serves untrusted HTML from a dedicated cookie-free subdomain inside an opaque browser sandbox, treats imported session context as untrusted data, and uses scoped credentials, private storage, and retention jobs. Session redaction is a safety net rather than complete data-loss prevention. No system is perfectly secure, so do not publish secrets or sensitive personal data. The service is not directed to children, and the final minimum-age rule will be set with counsel before launch.
Questions
Privacy and security intake addresses will be published only after end-to-end delivery and monitoring have been verified. Do not send personal data or vulnerability details to a guessed address while those channels are pending.