Privacy Policy
Effective October 4, 2026
strms.link is a smart link service for music releases, currently a free beta run by an individual developer (“we”, “us”). This policy explains what personal data we handle, why, and what you can do about it. Questions: contact@strms.link.
1. Your account
When you create an account we store your email address, an optional name and, if you sign up with a password, a one-way Argon2id hash of it. We never store your password in plain text. We use this data to run your account, sign you in and keep it secure.
2. Signing in with Google
If you choose “Sign in with Google”, we request only the openid, email and profile scopes. From Google we receive your email address (and whether Google has verified it), your Google account ID and your name. We use them only to create your account and sign you in. We do not access your contacts, files, calendar or any other Google data, and we do not use Google data for advertising.
strms.link’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. Cookies
- A session cookie that keeps you signed in. It is strictly necessary and expires after 30 days of inactivity or when you sign out.
- A short-lived cookie (about 10 minutes) that protects the Google sign-in flow against forgery.
We do not use advertising or third-party tracking cookies on strms.link itself.
4. Security and abuse prevention
We record the IP address and browser user agent of each sign-in session so you can recognise your sessions and so we can detect abuse. We also count requests per IP address and per email address to rate-limit sign-up, sign-in and password reset attempts.
5. Email
We send transactional emails only: verification codes, password reset codes and important service notices. They are delivered through Resend, our email provider. We do not send marketing email without your consent.
6. Smartlink pages and their visitors
When someone visits a smartlink page created by an artist or label, we record the page view (a small request the page sends when it is shown) and clicks on streaming service buttons, together with approximate location (country, region and city, as reported by our network provider), device, operating system and browser type, the referring site and UTM campaign parameters. We use this to show the artist aggregated analytics and to filter out bot traffic. We do not use cookies for this and we do not store IP addresses or user agents. We do not sell this data and do not build visitor profiles across different artists’ pages.
To count unique visitors, our server turns the IP address, the browser’s user agent and the page into a one-way hash. The hash key is random, changes every day and is deleted after two days, so the stored value cannot identify anyone and cannot be linked to the same visitor on another day or on another page.
An artist may enable the Meta Pixel, TikTok Pixel or the Meta and TikTok conversion APIs on their pages. In that case the artist decides to share visit and click events with those providers, is responsible for obtaining any required consent, and the data is governed by those providers’ terms and privacy policies. For visitors in the EEA, the UK and Switzerland, such advertising tracking runs only after the visitor has given consent.
6a. Pixels and ads measurement on smartlink pages
Artists and labels can connect a Meta Pixel (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) or a TikTok Pixel (TikTok Technology Ltd. / TikTok Inc.) to their smartlink pages to measure their ads. For that data, the artist or label who runs the page is the controller and we process it on their behalf; Meta and TikTok receive it as recipients under their own terms and privacy policies.
When a page has a pixel and tracking is allowed for you, the page and our servers send Meta and/or TikTok an event when you view the page and when you tap a button that leaves it. These events contain the page address and its campaign parameters, the referring site, the button you tapped, your IP address, your browser’s user agent, the cookies listed below and a pseudonymous visitor ID (a one-way hash that differs for every artist account). We never send your name, email address or phone number; we do not have them. We do not store IP addresses, user agents or click IDs for this purpose: they exist only while an event is on its way to Meta or TikTok, at most 7 days.
Visitors in the EEA, the UK and Switzerland (and visitors whose country we cannot determine) see a banner first. Until you choose “Accept”, nothing is sent to Meta or TikTok and none of these cookies are set. If you are in the US and your browser sends a Global Privacy Control signal, Meta receives your events with Limited Data Use and the TikTok Pixel is not loaded.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
strms_consent | strms.link | Remembers your choice in the banner | 180 days |
__Host-strms_vid | strms.link | Pseudonymous visitor ID used for matching (hashed per artist account) | 180 days |
_fbp, _fbc | strms.link and the Meta Pixel | Meta browser ID and the click ID of a Meta ad | 90 days |
_ttp, ttclid, strms_ttclid | the TikTok Pixel and strms.link | TikTok browser ID and the click ID of a TikTok ad | up to 13 months (click ID 30 days) |
Changing your mind. Use the “Privacy choices” link at the bottom of a smartlink page and choose “Decline”: we delete the cookies above, tell the pixels to stop, and no further events are sent. Your choice is kept for 180 days. Our own anonymous counts of page views and button taps (no cookies, no stored IP address, no lasting visitor ID; see section 6) continue for every visitor so artists see how many fans opened the page and tapped each button.
7. Service providers
- Hetzner (Germany) hosts our servers and database.
- Cloudflare provides DNS, content delivery and security filtering. Requests to strms.link pass through Cloudflare.
- Resend delivers our transactional email.
- Google provides sign-in, if you choose to use it.
These providers process data on our behalf and only as needed to provide their service. Some of them may process data outside your country, under appropriate safeguards.
8. Legal bases
We process account data to provide the service you asked for (contract), security and analytics data for our legitimate interest in running a safe and useful service, and advertising tracking on smartlink pages only with consent where the law requires it.
9. Retention
- Account data is kept while your account exists and deleted within 30 days after you ask us to delete it.
- Sign-up and reset codes expire within 30 minutes; expired sessions, codes and rate-limit counters are removed automatically.
- Raw page view and click events are kept for up to 24 months, then deleted or kept only in aggregated form. Aggregated counts of unique visitors may keep the daily visitor codes they were counted from: one-way codes made with a key that is destroyed after 48 hours, so they cannot be linked back to a device or an IP address.
- Technical server logs are kept for a short period, normally no longer than 30 days.
10. Your rights
You can ask us to access, correct, export or delete your personal data, or object to its processing, by emailing contact@strms.link. We will respond within 30 days. If you are in the EEA or UK you may also complain to your local data protection authority.
11. We do not sell your data
We do not sell or rent personal data, and we do not share it with third parties for their own marketing.
12. Children
strms.link is not intended for anyone under 16, and you may not create an account if you are under 16. If we learn that we hold data of a child under 16, we will delete it.
13. Changes
We may update this policy as the service develops. We will change the effective date above and, for significant changes, notify account holders by email before they take effect.
14. Contact
strms.link · contact@strms.link