Privacy notice

Last updated October 19, 2026

ClickiClick is operated by ClickiClick, LLC. 2912 University Ave, Longmont, CO 80503 Contact support@clickiclick.com or use our contact page.

Information used to run your account

We store your email address, password hash, display name, timezone, account status, page drafts, published content, revision history, processed images, link destinations and saved QR designs. We also keep operational records needed for security, billing and delivery of the service. We do not store your plain-text password.

Signing in with Google, Apple or Microsoft

If you choose a connected sign-in provider, it authenticates you and shares a provider account identifier and available basic profile details, such as your name and email address. We store a protected identifier for the connection so you can return to the same ClickiClick account. Apple may supply a private relay email address. A Microsoft email suggestion must be verified through our normal email verification before protected actions. We do not receive your provider password or request access to your mailbox, files, contacts or calendar. Sign-in access tokens are discarded after authentication. An Apple refresh token is stored encrypted while connected so we can revoke Apple authorization when you disconnect it or delete your ClickiClick account. You can review and disconnect sign-in providers in Account after keeping another sign-in method available.

Native inquiries

When you submit a form, the business receives your provided name, email, message and any requested optional fields. The workspace owner and explicitly authorized staff can access these records. Email notifications link to the private inbox. A Business workspace may send inquiry data to its verified external webhook receiver; that receiver has its own data practices. Do not submit sensitive personal information.

What becomes public

Published pages and linked images are public to anyone with the address while coverage is active. Searchable pages can be indexed and have content in social previews. Link-only pages ask search engines not to index them and use generic social previews. They are not password protected. Choose carefully before publishing addresses, personal details or photos.

Payments and service providers

Stripe hosts checkout and payment management. Card details go directly to Stripe; ClickiClick receives payment identifiers and status, amounts, billing periods and receipt links. Hostinger provides hosting. Account and service messages use our email delivery provider. Provider records and logs have their own retention and policies.

Cookies and visit counts

We use an account session cookie and security controls to keep you signed in and protect requests. ClickiClick does not use advertising pixels or behavioral advertising. Analytics retain activity for 7 days on Free, 90 days on Plus or 12 months on Business, subject to the plan at capture and current access. Counts distinguish route entries, page views, button actions and accepted inquiries. They do not identify unique people, and a QR-tagged visit is not proof of a camera scan.

Application analytics do not store raw IP addresses. Short-lived attribution tokens expire after 30 minutes. Deduplication hashes expire after 48 hours. Limited, rotating abuse identifiers are retained for 24 hours; minimized application request and security logs are kept for seven days. Hosting and payment providers may separately process request or payment information to operate and protect their services.

Sponsor referrals

Opening a sponsor landing address sets a first-party referral cookie for up to 30 days when you are signed out. It preserves the first sponsor visit in that browser. When you create a new account, we attach that sponsor to your account to calculate commissions on collected subscription revenue. We retain the referral and necessary financial evidence for commission reconciliation, including refunds and payment records. Sponsors see referral numbers and commission amounts, not your email, name, page content or account access. We do not use referral tracking pixels, fingerprinting or raw IP addresses. Blocking or deleting the cookie, or changing browsers or devices, can prevent attribution. Existing accounts are not reattributed.

Google Analytics on our website

If you allow analytics, we use Google Analytics on ClickiClick’s public website to understand page visits and referral sources. Google receives public page titles, page addresses without query strings or fragments, referral origins and browser/device information, and processes request information to provide the service. Analytics cookies last up to 180 days. We do not send account identifiers, private workspace or editor activity, customer page activity, inquiry contents or form field values to Google Analytics. Advertising features and automatic enhanced measurement are off.

Google Analytics is blocked until you choose Allow analytics. Decline analytics leaves it blocked. Use Analytics preferences at the bottom of a public website page to change your choice. We remember your choice in this browser for up to 180 days; declining after allowing stops collection and removes the Analytics cookies set by this site. These website statistics are separate from the plan-based application visit counts described above. See Google’s privacy policy and how Google uses information from sites that use its services.

Retention and removal

Free pages and managed links remain available within their allowances. Excess premium page archives have a 90-day recovery window. Native inquiries are retained for 24 months from receipt, including after cancellation. Previously accepted inquiry deliveries may finish retries for up to 72 hours; webhook payloads are then removed after their short operational retention period. Workspace owners can export inquiries and explicitly delete their workspace.

Explicit deletion removes public access immediately and queues deletion of content and unreferenced media. Backups are intended to age out within 30 days. Minimal route reservations persist to prevent reassignment. Financial and abuse evidence may be retained for necessary operational or legal purposes. Previously public copies outside ClickiClick cannot be recalled.

Authorized administrators can inspect account and billing status, handle support requests, and record the reason and outcome of support actions. Internal support notes are removed when the associated account is deleted. Minimal payment and action identifiers remain when needed for reconciliation or other necessary recordkeeping. The console does not provide administrators a password or access to private inquiry message bodies.

Your account and requests

Use Account to update your profile, change password or verified email, export your content or request account deletion. Billing cancellation and content deletion are distinct actions. For other privacy or access requests, use Contact.