Privacy Policy

• App: DSLink (iOS app and the dslink.me website)
• Company: UniApp
• Effective Date: October 22, 2026
• Last Updated: October 22, 2026

1. Introduction and Scope

This Privacy Policy explains how UniApp ("Company", "we", "us" or "our") processes information in connection with the DSLink mobile application (the "App"), the website at dslink.me and its subdomains (the "Website"), and the short links, branded subdomains, link-in-bio pages and related services we provide through them (together, the "Service").

This Privacy Policy covers two groups of people:

• Users: people who install the App, create an account or use the Website.
• Visitors: people who open a short link, a branded subdomain or a link-in-bio page created by a User, whether or not they have an account.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the Company is the controller of Personal Data processed through the Service, except where a Third-Party Service or an App Store Provider acts as an independent controller, as described in this Privacy Policy. Users decide which links they create and share and how they use the statistics we show them, and they are responsible for complying with the law that applies to their own use of the Service.

This Privacy Policy applies only to the Service. It does not apply to the websites, apps or other destinations that short links point to, or to any other Third-Party Services, even if they are accessible through the Service.

By downloading, installing, accessing or using the App or the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the Service.

This Privacy Policy forms part of, and should be read together with, our End User License Agreement (Terms of Use) available at https://dslink.me/terms-of-use.html.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, such as collection, storage, use, disclosure or deletion.
• "Device" means the smartphone, tablet, computer or other device on which you use the Service.
• "Account" means a DSLink user account, created with an email address and password, with Sign in with Apple or with Google sign-in.
• "Short Link" means a link on dslink.me or on a branded subdomain that redirects to a destination chosen by a User (the "Destination").
• "Third-Party Services" means services, software development kits (SDKs), platforms and content provided by persons other than the Company.
• "App Store Provider" means Apple Inc. (App Store).

3. Information We Collect

3.1 Information You Provide to Us

Account Information. If you create an Account, we process the information you provide or authorize: your email address, your password if you set one, and a sign-in identifier from Apple or Google if you use their sign-in. If you use Sign in with Apple, you may choose to hide your email address, in which case we receive an address relayed by Apple. You can delete your Account at any time in the App (Settings > Delete account). Deletion removes your Account data as described in Section 10.

Links and Pages You Create. We store the content you create in the Service: Destination addresses, Short Link endings, link titles, the names of your branded subdomains, and the content of your link-in-bio pages, such as a profile name, links to your social media profiles and display settings. Short Links, branded subdomains and link-in-bio pages are public by design: anyone who has the address can open them.

Communications. If you contact us by email or through the contact form on the Website, we process the information you choose to provide, such as your name, email address, the subject and the content of your message, in order to respond to you.

3.2 Information Collected Automatically

From Users of the App and the Website:

• Sessions and devices: when you sign in, we create a session for your Device and store its platform (iOS or web), a device name (such as "iPhone") and the dates the session was created and last used, so that you can see and sign out of your signed-in devices. A session token is stored in the Keychain of your Device or in the local storage of your browser to keep you signed in. On our server we store only a cryptographic hash of this token.
• Push notification token: if you allow notifications, the App sends us the push notification token that Apple assigns to your Device, so that we can send you notifications about your Account.
• Technical and security data: when the App or the Website communicates with our server, we and our hosting provider process your IP address and technical request data in server logs and in short-lived records used to limit repeated requests and to protect the Service against abuse.

The App does not contain third-party analytics, advertising or crash reporting SDKs.

From Visitors, when a Short Link, a branded subdomain or a link-in-bio page is opened:

• Click data: the date and time, the link that was opened, the device type, operating system and browser family derived from the browser's user agent, the host name of the referring website, whether the request appears to come from an automated bot, and, where available, the country.
• Pseudonymous visitor identifier: to count unique visitors, we create a hash of the IP address and user agent combined with a secret value that changes every day. The IP address itself is not stored in click statistics, and identifiers from different days cannot be linked to each other.
• Technical and security data: server logs as described above.

3.3 Information from App Store Providers and Payment Providers

When you purchase a Subscription in the App, Apple processes your payment. The App sends the signed transaction information issued by Apple to our server, where it is verified with Apple and used to apply your plan to your Account in the App and on the Website. This information includes the product identifier, transaction identifiers, purchase and expiration dates and renewal status. We do not receive or store your payment card details, billing address or Apple account password.

If we offer Subscriptions on the Website, payments are processed by Stripe. In that case, Stripe collects your payment details directly, and we receive only the information needed to manage your Subscription, such as a customer identifier, the plan and its status.

3.4 Device Permissions

The App may request permission to access certain features of your Device. You decide whether to grant each permission and can change your decision at any time in your Device settings. If you decline or revoke a permission, some features of the App may not be available or may not work properly, and the Company is not responsible for any resulting limitation.

Photo Library (add only). The App may request permission to save QR codes you create to your photo library when you choose to do so. The App does not read the photos and videos in your library.

Notifications. The App may request permission to send you notifications about your Account, for example when a branded subdomain is paused. Notifications are optional, and you can turn them off at any time in your Device settings.

3.5 Information We Do Not Intentionally Collect

Unless expressly stated in this Privacy Policy, we do not intentionally collect your postal address, phone number, precise location, contacts, photos, files, or any special categories of Personal Data (such as data concerning health, biometric data, racial or ethnic origin, political opinions, religious beliefs or sexual orientation). Please do not include such information, or Personal Data of other people, in your links, link titles or link-in-bio pages unless you have the right to do so.

4. Third-Party Services We Use

The Service uses the Third-Party Services listed below. Some of them process data on our behalf as processors, and some act as independent controllers. We do not control, and are not responsible for, the data practices of Third-Party Services. We encourage you to read their privacy policies.

When you open the Website, your browser connects directly to Google Fonts and, on the dashboard, to jsDelivr, which receive your IP address as part of that connection. When you use Sign in with Apple or Google sign-in, you interact directly with Apple or Google under their own terms and privacy policies.

5. How We Use Information

We and our Third-Party Services use the information described in this Privacy Policy for the following purposes:

• to provide, operate and maintain the App, the Website and the Service, including creating Short Links and redirecting Visitors to Destinations or to the matching apps on their Devices;
• to create and manage Accounts and keep them in sync between the App and the Website;
• to provide branded subdomains and link-in-bio pages;
• to show Users statistics about the clicks on their own links, such as clicks per day, countries, devices, referrers, busiest hours and the number of unique visitors;
• to check Destinations for phishing and malware, warn Visitors before suspicious pages and block malicious links;
• to process, validate, manage and restore Subscriptions and in-app purchases;
• to send you notifications about your Account, where you have allowed them;
• to detect, prevent and address fraud, spam, abuse, security incidents and technical issues;
• to respond to your requests and communicate with you;
• to comply with legal obligations and to establish, exercise or defend legal claims;
• for any other purpose with your consent.

6. Legal Bases for Processing (EEA, UK and Switzerland)

If you are located in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): to provide the Service to Users, including Accounts, Short Links, statistics, branded subdomains, link-in-bio pages, and the processing and management of Subscriptions.
• Legitimate interests (Art. 6(1)(f) GDPR): to redirect Visitors and produce click statistics for the Users who created the links, to check Destinations for phishing and malware, to keep the Service secure and stable, to prevent fraud and abuse, and to establish, exercise or defend legal claims. Our legitimate interests are not overridden by your interests or fundamental rights, taking into account that Visitor data is pseudonymous, that IP addresses are not stored in click statistics and that Visitor identifiers change every day.
• Consent (Art. 6(1)(a) GDPR): for push notifications. You may withdraw your consent at any time in your Device settings. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Legal obligation (Art. 6(1)(c) GDPR): where processing is necessary to comply with the law, such as accounting and tax obligations or lawful requests from authorities.

7. Advertising and Tracking

The Service does not display third-party advertisements, does not use your advertising identifier and does not track you across apps and websites owned by other companies. The App does not contain third-party analytics or advertising SDKs, and the Website does not use advertising cookies. The Website stores a sign-in token and basic account details in your browser's local storage only to keep you signed in; they are removed when you sign out. If we introduce advertising, we will update this Privacy Policy and, where required by law, request your consent.

8. How We Share Information

We do not sell your Personal Data. We may share information only as follows:

• With Users, about their own links: Users see statistics about the clicks on the links they created, such as clicks per day, countries, devices, referrers and the number of unique visitors. These statistics do not reveal the identity or the IP address of individual Visitors.
• Publicly: Short Links, branded subdomains and link-in-bio pages are public, together with the content their creators put on them.
• Third-Party Services listed in Section 4, which process data to provide their services to us or as independent controllers.
• App Store Providers and payment providers, which process purchases and Subscriptions.
• Abuse handling and legal requirements: where we believe in good faith that disclosure is required by law, regulation, legal process or a governmental request, or is necessary to investigate phishing, malware, fraud or other abuse, or to protect the rights, property or safety of the Company, our Users, Visitors or others.
• Business transfers: in connection with a merger, acquisition, reorganization, financing, sale of assets or similar transaction, in which case information may be transferred to the acquirer or successor.
• With your consent or at your direction.
• Aggregated or de-identified information that cannot reasonably be used to identify you may be shared for any lawful purpose.

9. International Data Transfers

The servers of the Service are operated by our hosting provider in Ukraine, and some of our Third-Party Services, including Apple, Google and Stripe, are located in, or transfer data to, the United States and other countries. These countries may not provide the same level of data protection as your country. Where required by applicable law, such transfers are based on the European Commission's adequacy decisions (including the EU-U.S. Data Privacy Framework, for certified recipients), on Standard Contractual Clauses approved by the European Commission, or on other lawful transfer mechanisms. By using the Service, you acknowledge that your information will be transferred to and processed in such countries.

10. Data Retention

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law:

• Account data, links, branded subdomains and link-in-bio pages: until you delete them or your Account.
• Detailed click data: up to 400 days from the click, after which it is deleted automatically. Daily click totals are kept for as long as the link exists.
• Sessions: until you sign out, revoke the session in the list of your devices, or the session expires, which happens no later than 90 days after it was created.
• Push notification tokens: until you delete your Account or sign the Device out, or until the token is no longer valid.
• Records used to limit repeated requests: these records are keyed by a hash of the IP address and are used only within short time windows of one minute to one hour.
• Abuse reports and records of blocked links: for as long as necessary to investigate and prevent abuse.
• Correspondence: for as long as needed to handle your request and for a reasonable period afterwards to defend potential claims.
• Server logs: for the limited period configured by our hosting provider.

When you delete your Account in the App, we delete your Account together with your links, their click data and daily totals, your branded subdomains, your link-in-bio pages, your sessions, your linked Apple and Google sign-in identifiers and your push notification tokens. Copies may remain in backups for a limited period until they are overwritten. Reports that Visitors submitted about your links may be kept as described above. Information processed by Third-Party Services is retained in accordance with their own retention policies.

11. Data Security

We and our Third-Party Services use technical and organizational measures designed to protect information against unauthorized access, loss, misuse or alteration, including encryption in transit (HTTPS) and storing only cryptographic hashes of session tokens on our server. However, no method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your Device and your credentials secure, including using a passcode, installing operating system updates and not using the App on a jailbroken Device. Where required by applicable law, we will notify you and/or the competent authorities of a personal data breach.

12. Your Rights

12.1 EEA, UK and Switzerland

Subject to the conditions and exceptions set out in applicable law, you have the right to:

• request access to your Personal Data;
• request rectification of inaccurate Personal Data;
• request erasure of your Personal Data;
• request restriction of processing;
• receive your Personal Data in a portable format;
• object to processing based on legitimate interests, including profiling;
• withdraw your consent at any time;
• lodge a complaint with a supervisory authority. The supervisory authority for the Company is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Poland, https://uodo.gov.pl. You may also contact the authority in your country of residence.

12.2 United States

Depending on your state of residence (for example, California, Virginia, Colorado, Connecticut, Utah, Texas or Oregon), you may have the right to know what Personal Data we process, to access and receive a copy of it, to correct it, to delete it, and to opt out of "targeted advertising", "sale" or "sharing" of Personal Data as defined by applicable state law. We do not sell Personal Data and do not use it for targeted advertising. We will not discriminate against you for exercising your rights. You may designate an authorized agent to make a request on your behalf, subject to verification.

12.3 How to Exercise Your Rights

You can view and edit your links, branded subdomains and link-in-bio pages in the App, sign out of your devices in the App's settings, and delete your Account at any time in the App (Settings > Delete account). To exercise any other right, contact us at support@dslink.me from the email address associated with your Account. We may need to verify your identity before responding. We respond within the time limits required by applicable law.

Visitor data is pseudonymous: IP addresses are not stored in click statistics, and Visitor identifiers change every day. For this reason, we are usually unable to link click data to a specific person. If you are a Visitor and believe we process your Personal Data, contact us with as much detail as possible, such as the link you opened and the date and time. If we cannot reasonably identify the data relating to you, we may be unable to fulfill your request, as permitted by applicable law.

13. Your Choices and Controls

• Device permissions: manage or revoke permissions, including notifications and photo library access, at any time in your Device settings.
• Signed-in devices: review your sessions and sign out of any of them in the App's settings.
• Links and pages: edit or delete your links, branded subdomains and link-in-bio pages at any time.
• Account deletion: delete your Account at any time in the App (Settings > Delete account).
• Subscriptions: manage or cancel Subscriptions purchased in the App through your Apple account settings, and Subscriptions purchased on the Website, where offered, on the Website.
• Stop collection by the App: you can stop all collection of information by the App at any time by signing out and uninstalling the App. Links you have shared remain active and keep collecting click data until you delete them or your Account.

14. Children's Privacy

The Service is not directed to children under the age of 13, or under the higher minimum age required for consent to data processing in your country (for example, 16 in some EEA countries). We do not knowingly collect Personal Data from such children. If you are a parent or guardian and believe that your child has provided Personal Data through the Service, contact us at support@dslink.me, and we will take steps to delete such information. Parents and guardians are responsible for supervising their children's use of Devices and apps.

15. Third-Party Links and Content

Short Links redirect to Destinations chosen by Users, including third-party websites and apps such as YouTube, Instagram, TikTok, Telegram and Spotify. We do not control Destinations and are not responsible for their content, privacy practices or security. Our phishing and malware checks are automated and cannot detect every harmful page. Your interactions with Destinations and other third parties are governed by their own terms and privacy policies.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time at our sole discretion. The updated version will be published at https://dslink.me/privacy-policy.html and will be effective from the "Last Updated" date shown above. Where required by applicable law, we will inform you of material changes through the App, by email or by other appropriate means. Your continued use of the Service after the "Last Updated" date means that you acknowledge the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

17. Language

This Privacy Policy is written in English. If it is translated into another language, the English version prevails in the event of any inconsistency, to the extent permitted by applicable law.

18. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us:

• Company: UniApp
• Email: support@dslink.me
• Website: https://dslink.me