What we record, and what we never do

Who is responsible

DL2App is operated by Siddi Tek LLC, 41551 Bostonian Place, Aldie, Virginia 20105, United States. For the accounts of people who sign up, we decide how data is used (a “controller”). For the people who tap our customers’ links and use their apps, we act on the customer’s behalf (a “processor”): the app’s developer decides why the link exists and is the one to ask about it.

The short version

• We never store a full IP address for a link tap. We keep a truncated network (the first three of four parts of an IPv4 address, the first 48 bits of IPv6) and a hash that changes every day.
• We never read an advertising identifier. The SDKs do not touch the IDFA or the Android advertising ID, and do not ask for tracking permission.
• Link pages set no cookies, with one exception: a password-protected link remembers that the password was entered.
• We do not sell data, build profiles across customers, or use link data for advertising.

When someone taps a link

One row is written per tap. It holds:

• the link and the time;
• the operating system and its version, the kind of device (phone, tablet, desktop), the browser, and whether the tap came from inside another app such as Instagram, all worked out from the browser’s user-agent header. The header itself is not stored;
• country, region and city, taken from a location database held on our own server or from a header set by our own network proxy. The address is not sent to a separate location service;
• the website the tap came from (hostname only, not the full page address) and any utm_ campaign labels on the link;
• whether the visitor looked like a person, a preview bot or an automated scanner, and whether the tap came from a QR code;
• the truncated network described above;
• a visitor hash, used only to count the same visitor once: an HMAC of the address and user-agent with a key that is replaced every day. Yesterday’s hash cannot be matched to today’s, and the hash cannot be turned back into an address.

Link previews fetched by chat apps and search engines are recorded as bots and are not counted as clicks.

When a tap leads to an install

To open the right screen after someone installs an app from a link (“deferred deep linking”), a tap that leads to an app store also leaves a short-lived note: a keyed hash of the address, a hash of its network, the operating-system version, screen size, language and time zone, and the link’s destination inside the app.

The note can be matched only until the window chosen by the app’s developer has passed (2 hours by default, 24 hours at most). On Android an exact match through the Play Install Referrer stays possible for up to 7 days, and the note is deleted by an hourly job once it is 7 days past that window. It is used for nothing except delivering the link to the app.

What the SDKs send from an app

• A random install ID created by the SDK the first time the app runs. It is not derived from the device or from any hardware or advertising identifier, and it is different for every app.
• The platform, operating-system version, app version and SDK version.
• On first launch only: screen size, language and time zone, to match the note above; on Android, the install referrer text from Google Play.
• The link that opened the app, when there is one.
• Events the app’s developer chooses to report (a name, an optional amount and currency, and properties they define).

The iOS clipboard is read only if the developer has turned clipboard matching on, and iOS shows its own notice when that happens. Developers will find suggested store disclosure answers in Privacy and App Store disclosure.

Accounts

For people who sign up to the dashboard we keep: email address, name if given, a password hash (bcrypt; we cannot read the password), two-factor secrets in encrypted form if two-factor is on, the team they belong to, and an activity log of changes they make. Signing in with Google or GitHub gives us the email address and the provider’s account ID.

The dashboard sets these cookies, all first-party: a session cookie (30 days, HttpOnly), a cookie remembering light or dark theme, one remembering which team you last used, a short-lived one while you sign in with Google or GitHub, and, if you choose “trust this device”, a cookie for that. Each signed-in session also records the browser it was started from, so you can recognise it. There are no analytics or advertising cookies, and no third-party scripts on the dashboard or on this site.

Payment is handled by Stripe. Card numbers never reach our servers; we store Stripe’s customer and subscription identifiers and the plan.

Abuse reports

The report form stores the reported link, the reason, any details and email address the reporter chooses to give, and a daily-keyed hash of the reporter’s address, used only to limit one address to 5 reports an hour. The reporter’s identity is not shown to the link’s owner.

To check where links lead, destination addresses of links (not visitor data) may be sent to Google Web Risk when the operator has enabled it.

How long things are kept

Deleting a project removes its links, clicks and reports. Deleting your account removes your user record and any team only you belong to, with its projects and links. A team with other members has to be handed over or emptied first.

Who else handles data

Data is stored in the United States, in DigitalOcean data centres in the New York region. The providers above are United States companies and handle the data there. We do not offer storage in another country at present.

Your rights

If you have an account, you can see and change your details in the dashboard, export your team’s data at any time, and delete your account. For anything else, including access, correction or deletion requests under PIPEDA, GDPR or similar laws, write to privacy@dl2.app.

If you tapped a link on a dl2.app address or a customer’s own domain, the app’s developer is the one responsible for that link, and we will pass your request to them. Because we keep no full address and no lasting identifier for a tap, we usually cannot find “your” rows.

DL2App is run from the United States and is offered to customers there. It is not currently directed at people in the European Union or the United Kingdom, so this page does not set out legal bases under the GDPR or name a data protection authority. If we change this page in a way that matters, we will email account holders at least 30 days before the change applies and update the date at the top.