Privacy Policy

1. Introduction

At Beckon, we take your privacy seriously. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. This policy applies to all users of our URL shortening service and form builder platform.

2. Data We Collect

Account Information

When you create an account, we collect your email address, name (if provided), and authentication credentials. If you sign up via a third-party OAuth provider (such as Google or GitHub), we receive your name and email from that provider.

Usage Data

We collect information about how you use the Service, including links created, forms built, and dashboard interactions. This helps us improve the product and provide support.

Click Analytics

When someone clicks a short link, we collect the following data for analytics purposes:

• IP address — hashed with SHA-256 before storage. We never store raw IP addresses.
• Approximate geolocation — country, region, and city derived from the IP address via ip-api.com, cached for 24 hours.
• User agent — parsed to determine browser, operating system, and device type.
• Referrer URL — the page that linked to the short URL.
• UTM parameters — if present in the URL.

Form Submissions

When someone submits a form built with Beckon, the form data is stored on behalf of the form creator. The form creator is the data controller for submitted data. We act as a data processor. Form submissions may include any data the form creator has chosen to collect.

3. How We Use Your Data

• To provide, maintain, and improve the Service.
• To process transactions and send billing-related communications.
• To provide click analytics and form submission data to link and form creators.
• To send important service updates and security notifications.
• To detect and prevent abuse, spam, and malicious activity.
• To respond to support requests and inquiries.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

4. Data Storage and Security

Your data is stored securely using Supabase (built on PostgreSQL) with Row Level Security policies ensuring users can only access their own data. All data is encrypted in transit via TLS and at rest.

Passwords are hashed using industry-standard algorithms. IP addresses collected during click tracking are hashed with SHA-256 before storage, ensuring they cannot be reversed to identify individuals.

5. Data Sharing

We may share your data with the following categories of third parties, solely for the purpose of operating the Service:

• Supabase — database hosting and authentication.
• Stripe — payment processing. Stripe receives your billing information directly; we do not store credit card numbers.
• ip-api.com — IP geolocation lookups for click analytics (IP addresses only, cached for 24 hours).
• Fathom Analytics — privacy-focused website analytics (see Cookies section below).

We may disclose your data if required by law, such as in response to a valid legal process or to protect the rights and safety of Beckon and its users.

6. Cookies

We use minimal cookies necessary for the operation of the Service:

• Authentication cookies — to keep you signed in to your account.
• Fathom Analytics — we use Fathom for website analytics, which is a privacy-focused alternative to Google Analytics. Fathom does not use cookies, does not track personal data, and is fully GDPR, ePrivacy, PECR, and CCPA compliant. No cookie banner is required.

We do not use advertising cookies or third-party tracking cookies.

7. Your Rights

You have the following rights regarding your data:

• Access — you can view all your data through the dashboard at any time.
• Export — you can export your links, analytics, and form submissions as CSV files from the dashboard.
• Correction — you can update your account information through the dashboard settings.
• Deletion — you can delete your account and all associated data from the dashboard settings. You may also contact us for immediate deletion.
• Portability — you can request a machine-readable export of all your data.

8. GDPR Compliance

For users in the European Economic Area (EEA), we process your data under the following legal bases:

• Contract performance — processing necessary to provide the Service you have signed up for.
• Legitimate interest — analytics and abuse prevention, balanced against your privacy rights.
• Consent — where required, we will ask for your explicit consent before processing.

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated. For form submissions, the form creator is the data controller and Beckon acts as a data processor under the terms of our Data Processing Agreement.

9. Data Retention

We retain your account data for as long as your account is active. Click analytics data is retained for the duration of your account. When you delete your account, all associated data is permanently deleted within 30 days. You may request immediate deletion by contacting us. Form submission data is retained until the form creator deletes it or their account is closed.

10. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that data promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the effective date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

12. Contact

If you have any questions about this Privacy Policy or want to exercise your data rights, please contact us at hello@usebeckon.com.