Privacy
Last updated: 28 July 2026
This instance of Nexo Links is open source and self-hosted. We collect the minimum needed for your links page to work, and nothing else. There are no tracking cookies, no third-party analytics, and no requests to anyone else's servers from any page.
What we store about your account
Your name, your email and an encrypted (hashed) version of your password, plus the date you verified your email. The email is used to verify the account and to recover access, and nothing else: we send no newsletters. If this instance has Nexo ID sign-in enabled and you use it, we also store the identifier that service gives us to recognise you.
Your public page is public
Your username, bio, photo, banner, links (title and destination) and social icons are published at this site's /yourname address for anyone who has it, and the page is listed in the sitemap so search engines can index it. The photo and banner live in a public folder on the server: anyone with their URL can see them, even after you remove the link. Do not put anything there you would not publish — a phone number or an email address added as a social icon is on display too.
What we measure about visits
Only the clicks on your links. For each click we store which link it was, when it happened, an anonymous visitor fingerprint and, if it came from another site, only the originating domain (for example "instagram.com", without the path or the query string). Clicks that come from your own page are stored as direct. We do not store the IP address, the browser, the location, or any identifier that persists.
Why the fingerprint cannot follow you
The fingerprint is the result of running SHA-256 over four things together: this installation's secret key, today's date, your IP address and your browser. Only that result is stored; the IP and the browser are discarded immediately and cannot be recovered from it. Because the date goes into the calculation, tomorrow the same person produces a completely different fingerprint and there is no way to match the two: it can count "how many distinct people clicked today" and nothing more. And because the key belongs to this installation, it cannot be cross-referenced with another site's either.
Cookies
Only the ones the site needs to work: the session cookie and the form-protection cookie (issued when you sign in to your account), and two that remember your language and light/dark theme preference. Those last two travel unencrypted and scoped to the parent domain on purpose, so your choice is honoured across every Nexo tool; they carry no personal data. None of them is used for advertising or tracking, which is why you will not see a consent banner.
While your session is open
The server's session record stores your IP address and browser while the session is alive, so it can be closed and abuse can be detected. It is deleted when you sign out or when it expires. This only happens if you have an account and signed in: visiting a public page creates no session at all.
Reports
Anyone can report a page or a link without signing up. For a report we store the reason, the optional comment you write, which page or link it points at, and the same anonymous daily fingerprint, used only to avoid accepting the same report twice in one day. We ask reporters for no email and no name. The page owner sees the reason and the comment.
The only emails we send are account ones: email verification and password recovery. They go out through an external email provider, which necessarily processes the destination address and the message content in order to deliver them.
Nothing external on the pages
No page loads third-party fonts, scripts, images or CDNs: everything is served from this domain and the site's content security policy blocks it explicitly. That means visiting your page tells nobody else that you visited it. There is an optional Nexo ecosystem counter, off by default, which only sends a "one visit to this tool" signal, identifying neither the visitor nor which page they went to.
How long, and how it is deleted
The data lives as long as your account does. Deleting the account cascades: your page, your links, your social icons, the recorded clicks and the reports received are all deleted. When you change or remove your photo or banner, the previous file is deleted from the server.
Your rights
You can see and edit your data from your own dashboard, and delete all of it by deleting the account. To request access, correction or deletion another way, write to whoever operates this instance using the contact link at the bottom of this page.
Other instances
Nexo Links can be installed on any server. Each installation is independent, has its own key and is responsible for its own data: this policy covers this instance only.
Privacy · Terms · Contact us