Privacy & data

People who visit customer links and pages

Public customer links and pages do not set analytics cookies or create persistent visitor identifiers. Unlocking a password-protected page sets an essential cookie for one hour so its buttons and images can load.

Analytics

When enabled, analytics increments daily counters for views and clicks, grouped by link or page, referring hostname, broad device class, and likely bot traffic. Country, when available, is provided by a trusted network edge and stored in separate daily totals. We do not request browser location or send your IP to a geolocation service. Historical or unavailable countries appear as unknown. These counters never store visitor IP addresses, cities, coordinates, full referrer URLs, or full user-agent strings. Do Not Track and Global Privacy Control signals turn this measurement off.

Your account

We store your email address, username, hashed password, and the content you create. At signup, we record the terms version you accept and the acceptance time. Your session uses an essential, HTTP-only cookie that expires after seven days. You can export your account, pages, and links from Personal settings, and delete your account there. Deletion removes the account and its content and analytics from the active database.

Affiliate connections

When you connect a program, we store its account identifiers, settings, encrypted credentials, until you disconnect it or delete your account; conversion history remains with each saved link until that link or account is deleted. Conversion sends the product URL and required account identifiers to your selected provider. Credentials are not included in exports. After a visitor chooses to continue, the retailer and network apply their own tracking and privacy policies.

Payments

Pro payments are processed by the payment provider. We keep each purchase’s amount, term, status, and reference. We never store card or bank account details.

Abuse reports

A report stores the reported public URL, the reason, details, review status, and time for up to 90 days. Reports do not ask for the reporter’s email or store their IP address. Please avoid including sensitive personal information in a report.

Forms and media players

Form responses are sent to the page owner and stored in that account’s private inbox. Retention is configurable from 7 to 730 days (180 by default); expired responses become unavailable immediately and are removed during periodic cleanup. Owners can export and delete responses. Deleting the page or account removes its responses. We do not store IP addresses or user-agent strings in responses. Video and music players load lazily as they approach the viewport, and preview images may load from their providers. These requests share connection information with the provider, whose privacy policy applies. Forms may also send responses to destinations configured by the page owner. Connected-service credentials are encrypted until disconnect or account deletion. Delivery records follow the response retention period and are removed with the response; external services apply their own retention policies.

Test orders

When a test checkout is enabled, orders store name, phone, items, options, amounts and pickup details for up to seven days. No charge, Pix or real store order is created. Details are available to the store owner and the holder of the private test receipt; expired orders become unavailable and are removed during periodic cleanup. Orders do not store IP addresses or user-agent strings. Use fictional details for testing and do not enter passwords, card or bank details.

Retention

Aggregate analytics are kept for 365 days. Security audit records are kept for 90 days. Expired tokens, invitations, and rate-limit records are removed automatically every six hours. Account data and uploaded images are kept until you delete them. Deleted data can remain in encrypted backups until those backups expire. Server and security logs are kept separately from analytics and rotated by size.

Service providers

Infrastructure is provided by hosting, network, and email providers.

Last updated 17 October 2026.

Analytics on our marketing website

This section applies to the marketing pages at cpbr.link/capybara/, separately from analytics on customer links and pages. With your permission, we use our own Rybbit installation at nosy.cpbr.digital to understand visits, traffic sources, campaigns, navigation, calls to action, use of the demo and site performance.

Rybbit processes browser, device, language, screen size, page and referring-site information. Your IP address is processed for approximate location, bot detection and a pseudonymous identifier that rotates daily; event IP storage is disabled. Its script also creates a random identifier in your browser’s local storage. We do not connect visits to your account. Session recording, copied-text capture and input/form capture are disabled. Full URL parameters are not recorded; we record only allowed campaign codes. Analytics events are kept until the operator deletes them; bot records expire after three months. Infrastructure logs and backups have separate lifecycles.

Tracking starts only after “Accept analytics”; “Decline” is equally prominent. We remember this browser’s choice for six months. You can change it using Analytics preferences in the marketing footer. Declining or withdrawing stops future collection and removes Rybbit’s local identifiers; it does not automatically erase events already received. We honor Do Not Track and Global Privacy Control. Use the privacy contact above for requests about data already collected. Data goes to our hosted infrastructure, rather than Rybbit’s cloud service.

App usage collection and security auditing

This instance offers Privacy, Anonymous Statistics and Audit presets with individual switches. Privacy keeps only the existing aggregate customer-link/page statistics. Anonymous Statistics stores daily totals, coarse categories and measurements without individual event records, visitor/account IDs, persistent histories, replay or retained IPs in the analytics dataset. Rare breakdown buckets are suppressed in detailed reports. Necessary account, consent, signup and infrastructure records are separate; this does not promise anonymity for the entire service operation.

Audit and custom configurations can enable detailed events, browser-identifier histories, pseudonymous account journeys, interactions, performance, failure counts, traffic/campaign categories and allowed language/date-range/sort parameters. Account identifiers are pseudonymous but remain personal data. Optional usage analytics, account linking, masked session replay and precise location have separate choices. All begin off until permission. Precise location additionally needs browser permission. Declining or withdrawing does not prevent ordinary app use. We honor Do Not Track and Global Privacy Control for optional collection. Choices expire after six months; a policy change requires renewed permission.

Recordings are masked in the browser before upload and filtered again at the server. User text, fields and private attributes are removed; authentication, billing, settings, operator and preview screens are excluded. Passwords, authentication/recovery/invitation tokens, payment secrets, raw form contents, copied text and arbitrary error messages/stacks never enter analytics or replay.

When enabled, security auditing retains the account identifier, time, action category, resource identifier and request outcome. If IP retention is on, it includes the IPv4/IPv6 obtained through verified ingress; unavailable IPs are not invented from untrusted headers. These restricted records support prevention and investigation of abuse, unauthorized access and incidents, separately from optional consent. Signup requires accepting the acceptable-use and security policy. We record its version/hash, acceptance time and, when enabled, client IP. This acceptance does not replace consent for optional analytics or recording.

Consented detailed events and recordings go to our Rybbit instance at nosy.cpbr.digital. The app does not forward visitor IPs or raw User-Agents to Rybbit; audit IPs stay in the restricted app database. Approximate country may use a trusted Cloudflare header; precise coordinates are sent only when permitted. The owner selects usage retention of 30/90/180 days, security retention of 30/90/180 days and replay retention of 7/14/30 days. Cleanup runs daily; backups expire separately. Consent evidence is retained for its validity plus event retention, up to 360 days; its IPs follow security retention. Document-acceptance evidence is retained for the account lifecycle and applicable legal needs, with IPs limited by security retention. Use the privacy contact above for access or deletion requests. Marketing controls and retention are separate.