Privacy Policy

Last updated: 2 October 2026

This policy explains what Smart Software ("we") collects when you use click2: the website at click2.page, the dashboard, and the short links our customers create.

People who click links

When someone opens a click2 link we record: the link, the time, the platform (iOS, Android or desktop, derived from the browser's user agent), whether the visitor is in an app's in-app browser, the visitor's country (as provided by our network provider), and the referring page's address without its query string. To count unique clicks we compute an anonymous code from the IP address and user agent together with a random value that is replaced every day and deleted after two days; we store only that code, never the IP address. While that day's random value exists (up to about 48 hours) the code is pseudonymous; once it's deleted, codes can't be linked to each other or to a person. We do not fingerprint devices or track people across days or across teams. Browsers that send Global Privacy Control are not counted. Apps can tell us a user opted out of tracking; nothing is recorded for them. When a link shows its "open in the app" page, we also count that page being shown and which of its buttons was tapped (reported by the page itself to the same link address), under the same rules. If a team adds its Meta install referrer key, we decrypt the campaign information Meta includes with Android installs from its ads (campaign, ad set and ad names and ids); it contains no personal data.

If a team adds its logo, the visitor's browser loads it from the image address the team chose, so that host sees the visitor's IP address, as with any image on the web. Social preview images are fetched by the apps that show the preview, not by us.

When a customer points their email click-tracking domain at click2, requests to it are forwarded to the customer's email provider (with the visitor's IP address and browser details, as the provider would otherwise receive them directly) so the provider can count clicks and handle unsubscribes. We don't store those requests.

For install attribution, customers' apps may send Apple's AdServices attribution token (which we exchange with Apple for the Search Ads campaign, without any device identifier) and the Google Play install referrer's campaign tags.

Customers' apps can also report in-app events (such as a purchase, with its amount) and, if the customer chooses, their own user id for the person; these are stored with the customer's link data and used for their reports and integrations.

Customers can have these link events sent to their own systems or analytics providers (webhooks, Segment, Amplitude, mParticle, Braze); we send them only where the customer configures it.

On customers' websites, the click2 banner script sets no cookies. It keeps a few values in the browser's local storage for that site only: when a banner was closed, a page-view count and which A/B variant was shown, so banners aren't repeated and tests stay consistent. Banner views, taps and closes are counted only as daily totals per campaign.

We use this data to show our customers how their links perform. Customers act as controllers for their campaigns; we process the data on their behalf.

Dashboard users

You sign in with Google or, if your company set it up, your company's single sign-on (OpenID Connect). We receive your name, email address and profile picture. We keep your email to identify your account and team memberships. Your name and picture are kept only in your session, which lasts 12 hours, or up to 30 days with "Keep me signed in". The session cookie is strictly necessary and set only on app.click2.page. We do not use advertising or analytics cookies.

If a team subscribes to Pro, the purchase is made through Link, Stripe's merchant of record service ("Sold through Link"): we send Stripe the admin's email address and the team name, and the checkout collects the card, name and billing address. Link sells the subscription on our behalf and handles payment, tax, invoices, receipts and payment support under its own terms and privacy policy. We store only the team's Stripe customer id and subscription status; we never see card numbers.

Changes made in a team (links, members, keys, settings) are recorded with the email address or API key name of whoever made them (our own staff appear as "click2 support") and kept for 400 days, so the team's admins can see who changed what.

Service providers

We use Cloudflare (network, TLS, protection against abuse), our hosting provider (servers in the EU), Backblaze (encrypted backups), Stripe (payments, invoices and tax, selling Pro as merchant of record through Link), Google (sign-in), and, for teams that set it up, their own company sign-in provider.

Retention

Individual click records and journey daily totals are deleted after two years (730 days); daily link totals are kept while the link's team exists. Dashboard accounts are kept until you delete yours (Your account), ask us to, or your team is closed. Encrypted backups keep deleted data for up to about five weeks (seven daily and four weekly copies) before it's gone for good.

Your rights

In the dashboard you can download your data or delete your account yourself (Your account), and team admins can export or erase what their apps reported for one of their users. You can also ask us for access to, correction of, or deletion of your personal data, and object to its processing. Contact hello@click2.page. You also have the right to complain to your data protection authority.

Contact

Smart Software, Gorczyn 64B, 98-100 Łask, Poland · hello@click2.page