Privacy Policy

hiall.me is a link in bio service: you claim hiall.me/yourname and build a public page with your photo, bio, social icons and links. “We” and “us” in this policy mean hiall.me. Questions about your data go to [email protected].

Your account

• Your email address and username.
• Your password, stored only as a salted hash. We can't read it.
• If you sign in with Google: your name, email address, profile photo and Google account ID, plus the sign-in tokens Google gives us. We don't get your Google password or anything else in your Google account.

Your page

The name, photo, bio, social icons, links (and their group titles and descriptions), theme and colors, fonts, background (a gradient, pattern or photo you upload), layout and avatar style (its shape, letter or emoji, background and font) you add in the editor. Your page is public: anyone with the link can see it, search engines can index it, and apps show a preview card of it when the link is shared.

When you upload a photo, we also keep the original, before your crop, filter and adjustments, with those settings, so you can edit it again later. It's stored like your photo, at an address only your editor uses; it isn't on your page.

If we hide your page for breaking our terms, we keep when we hid it and the reason we emailed you, until we show it again.

Visits to your page

When someone opens a hiall.me page, their browser tells us which page it was, the domain of the site they came from (or a utm_source tag in the link), and whether they clicked a link or social icon. Cloudflare, which delivers our pages, tells us the visitor's country. We add this up into daily totals per page: views, clicks, countries and referring sites.

We never store visitors' IP addresses or individual visits, and public pages set no cookies of ours, so the stats can't tell anyone who visited. Visits from known bots aren't counted.

When you're logged in

A session record that keeps you logged in, with the name of the browser you logged in with (its user agent). We don't store your IP address with it.

Messages to us

If you use the contact form: your name, email address, the topic and your message, and your account if you were logged in. If you email us, the email itself.

What we don't do

No ads, no third-party analytics or tracking scripts, and we never sell your data or your visitors' data.

• To run hiall.me: show your page, log you in and save your changes.
• To email you about your account: confirming your email, password resets, and notices when your password, email or username changes or your account is deleted. We don't send newsletters or marketing emails.
• To show you your stats on your dashboard.
• To keep hiall.me safe: to stop spam and abuse we count requests per IP address, in memory only, for up to an hour. Those counts are never saved.
• To answer your messages and look into reports.

If you're in the European Economic Area or the UK: we use your account and page data to provide the service you signed up for (performance of a contract), and the stats, security measures and messages because we have a legitimate interest in running a useful, safe service.

We share data only with the companies that help us run hiall.me, and only what each one needs:

• Cloudflare delivers our pages, protects the site from attacks, stores profile photos and looks up visitors' countries. Like any network that delivers web traffic, it handles visitors' IP addresses to do that.
• Resend sends our emails, so it gets your email address and the emails we send you.
• Google, only if you choose to sign in with Google.
• Our hosting provider runs the servers our app and database live on.

We may also share data if the law requires it, or to protect people from harm or fraud. We'll tell you when we're allowed to.

We use only what the site needs to work, so there's no cookie banner:

• hiall.session_token keeps you logged in. It ends when you log out, or after a week of not using hiall.me.
• hiall.signed_in tells our home page to show “Dashboard” instead of “Log in”. It only contains the number 1.
• Short-lived cookies while you sign in with Google, to make sure the sign-in started on hiall.me.
• Your light or dark mode choice, and how you've arranged the editor (its width and preview mode), saved in your browser's local storage. They never leave your device.
• Cloudflare may set a security cookie to tell people from bots.
• hiall.admin logs the people who run hiall.me into our admin area. Visitors never get it.

• Your account and page: until you delete your account.
• Email sign-ups never confirmed: deleted after 7 days, which frees the username.
• Photos you replace or remove (and their originals), background photos too: deleted within a couple of days.
• Sessions: until you log out or they expire. Expired ones are deleted every day.
• Stats: daily totals for about a year (366 days).
• Messages to us: one year.
• A username you give up by renaming or deleting your account stays reserved for 30 days, so nobody can take over an address you've shared. After a rename, the old address sends visitors to your new one.

When you delete your account, we delete your account, page, links, stats, sessions and photos straight away and email you to confirm. Your old username is then reserved for 30 days without any link to you. Messages you sent us stay until their year is up, unless you ask us to delete them.

• Change anything on your page at any time in the editor.
• Change your username, email or password, or delete your account, in Settings.
• Ask us for a copy of your data, to correct it, to delete it, or to stop using it for something: email [email protected] from your account's email address. We'll reply within a month.

Depending on where you live, you may also have the right to complain to your data protection authority. We'd appreciate the chance to fix things first.

Every connection to hiall.me is encrypted (HTTPS), passwords are hashed, email addresses must be confirmed, and logins and forms are rate-limited. Changing your password can log you out on every other device, and we email you whenever your password, email or username changes. Only the people who run hiall.me can see account details, in a password-protected admin area, and only to run the service: answering messages, handling reports and fixing problems. No service is perfectly secure: if a breach affects your data, we'll tell you.

hiall.me isn't for children under 13, or under the minimum age to use online services without a parent's consent where you live. If we learn that a child has made an account, we'll delete it.

When we change this policy, we update the date at the top. If a change matters, we'll email account holders before it takes effect.

Email [email protected] or use the contact form.