Privacy Policy

Effective date: 06-25-2026

FanRoute ("the Service", "we") is a link-routing service for creators. This Privacy Policy describes what we collect, how we use it, and the rights you have over your data. We have designed the Service to collect the minimum information necessary to operate it.

1. What we collect about Creators

Account email address (used for login, email verification, and password reset).
A salted, hashed password — we never store passwords in plaintext.
Display name, public handle, bio, avatar URL, and banner URL that you publish.
Links you create, including title, destination URL, optional backup URL, category, and sensitivity flag.
Operational metadata such as account creation time, last login time, and plan tier.

2. What we collect about visitors to a public profile

When a visitor opens a public profile page or clicks a routed link, the Service records a small amount of routing telemetry so creators can see aggregate analytics:

Inferred source platform (derived from the HTTP Referer header).
The two-letter country code derived from the request (we do not store the raw IP address in plaintext).
User-agent string, used to detect bots and to display approximate device class in analytics.
Timestamp of the view or click.
Which link was clicked, and whether a backup URL was used.

3. What we explicitly do not collect

We do not retain raw visitor IP addresses in plaintext storage.
We do not identify visitors by name, email, social account, or device fingerprint.
We never receive or store card numbers or any other payment instrument — card details go directly to our payment processor. If you subscribe to a paid plan we do store the processor's customer and subscription identifiers, plus invoice status and amounts, so we can manage your subscription.
We do not host or store media of any kind.

4. Cookies, local storage, and third parties

The Service uses browser local storage to (a) persist a Creator's login session token after sign-in and (b) generate a random visitor session identifier used only to deduplicate analytics. We use a CAPTCHA provider (Cloudflare Turnstile) on registration to reduce automated abuse; the CAPTCHA provider sees the request as part of its anti-abuse function and is subject to its own privacy policy. We do not use third-party advertising or marketing trackers.

5. Retention

Account data is retained for as long as your account is active. Click and view telemetry is deleted automatically after 90 days. If you are on the Free plan, that telemetry — and the hourly totals derived from it — is deleted after 30 days. On paid plans the hourly totals are kept for longer.

Separately, how far back your dashboard lets you look depends on your plan — Free 14 days · Pro 30 days · Enterprise 90 days. That is a display limit only: reaching it hides older figures from your charts, it does not delete anything. Records can therefore still exist for longer than your charts show, and a data-access request is answered from the records that still exist.

You may request deletion of your account and associated personal data via the contact below.

6. Your rights (GDPR / CCPA / similar)

Subject to applicable law, you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email privacy@[placeholder-domain]. Self-serve export and deletion are also available in-product under Settings → Data & Privacy: export downloads a full copy of your data, and deletion is a two-step flow with a 30-day cooling-off window you can cancel before the purge runs.

7. Children

The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided personal data, contact us and we will delete it.

8. Security

Passwords are hashed with a modern key-derivation function. Database traffic is encrypted in transit. We follow industry-standard practices but cannot guarantee absolute security. If a breach affects you, we will notify you as required by law.

9. Contact

Privacy questions, data-subject requests, and breach notifications: privacy@[placeholder-domain].