Last updated: October 20, 2026
This Privacy Policy explains how miinideck (the “Service”, “we”, “us”, or “our”) collects, uses, and protects your information.
Privacy is the core of what we build, so this policy is written to be read — not buried.
Account information. When you sign in with Google or GitHub, we receive your email address, display name, and a provider account identifier. We never receive or store your Google or GitHub password.
Files you upload. We store the HTML files you upload and their metadata — the title, the random link slug, expiry settings, and, if you set one, a one-way bcrypt hash of your link password. Link passwords are never stored in readable form.
No-account uploads. If you upload without an account, we store a hashed, irreversible form of your IP address to enforce per-user limits. We do not keep your raw IP address for this purpose.
Opens of your links. When someone opens one of your links, we record that it was opened and when, and whether the open came from a network your account is known to use, so your own opens can be told apart from other people's. To make that comparison we hash the visitor's IP address at that moment; neither the address nor its hash is stored with the open. We do not record who opened a link. These records are kept for the life of the document and are deleted when the document or your account is deleted.
Visitor analytics on paid plans. On links owned by a Solo or Studio account (trials included), an open by someone other than the owner (as judged by the network check above) also records: the website that linked to it, as its domain only (for example linkedin.com — never the full address); the country, as a two-letter code our hosting provider derives from the connection, and nothing more precise; the kind of device (desktop, mobile or tablet) and the browser family (such as Chrome or Safari), read from the browser's user-agent string, which is not stored; and how long the page was visible, which the page sends when it is hidden or closed. To attach that time to the right open, the page makes a random one-time key that exists only in that browser tab, and we store only a one-way hash of it. Nothing here is an IP address, a visitor ID, a cookie or a device fingerprint, and nothing links one open to another. The link's owner sees only totals for each link — sources, countries, devices, browsers and typical time on page — and only once the link has enough opens that no single open stands out. These records are deleted with the open and the document. Links on the free plan, and links uploaded without an account, record none of this.
Payment information. Paid plans are processed by Stripe. We store your Stripe customer and subscription identifiers to manage your plan. We never receive or store your full card number — card details are handled entirely by Stripe.
Security and diagnostics. We use hashed IP addresses for rate limiting and abuse detection, a bot-protection check (Cloudflare Turnstile) on uploads, and error monitoring to diagnose problems. Uploaded files are checked against Google Safe Browsing for known malicious URLs. Files our automated checks flag as possible phishing or malware may be reviewed by an automated system that uses a third-party AI provider (Anthropic) to help decide whether to take them down.
Abuse reports. If you submit an abuse report, we store the reason you provide and, if you choose to include it, your email address.
We use a small number of strictly necessary cookies: an HttpOnly authentication cookie that keeps you signed in, and short-lived cookies used only during the sign-in process.
We also set one first-party cookie the first time you visit, recording only which site linked you to us and which of our pages you landed on. If you later create an account, that is saved with it so we know which channels bring people here. It contains no personal information, is never read by anyone but us, is never shared or sold, and cannot follow you to other sites.
We do not use advertising or third-party tracking cookies.
We use the information above only to operate and secure the Service, authenticate you, host and deliver your files, process payments, send essential transactional emails (such as a welcome email or an abuse notification), detect and prevent abuse, and comply with legal obligations.
We rely on the following service providers to operate the Service. Each receives only the information needed for its function:
We do not sell your personal information, and we do not share it for advertising.
Files uploaded without an account are automatically deleted 7 days after upload. On the free plan, links expire 7 days after upload by default; you can keep one link always-on, which is retained until you delete it. Files you delete are held in Trash for 30 days and then permanently purged. Account information is kept while your account is active, and is deleted when you delete your account or ask us to do so.
We protect your information with measures including encrypted connections (HTTPS), one-way hashing of passwords and IP addresses, strict separation of frontend and backend credentials, and access controls on our database. No system is perfectly secure, but we treat your data the way we would want our own treated.
You may access, correct, export, or delete your personal information at any time. You can manage most data directly from your dashboard, or contact us at the address below for anything else. We will respond within a reasonable time.
The Service stores data on infrastructure in Singapore and elsewhere in the Asia-Pacific region, and information may be processed in other countries where our service providers operate. By using the Service, you consent to this transfer.
The Service is not intended for anyone under 16 years of age, and we do not knowingly collect information from children.
We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page.
For any privacy question or request, contact us at support@miinideck.com.