This Privacy Policy explains what information LinkMagnet collects, why we collect it, the service providers involved, and the choices available to users.
Last updated October 30, 2026 · California-based and independently operated
LinkMagnet is operated by Dario Rapisardi (Pants AI), an individual based in California, USA. This Privacy Policy applies to our website, short-link tools, analytics features, Open Graph validator, card service, REST API, MCP server, command-line client, and related services.
When you use LinkMagnet, we may collect technical and usage information such as browser details, device information, IP address, approximate location, referral information, and interactions with the site. Some of this information comes directly from your browser or from infrastructure and analytics providers we use to run the service.
When a program uses your key through the API, the MCP server, or the command-line client, we update the time the key was last used, at most every five minutes. The command-line client identifies itself in its user agent. It names its key requests "linkmagnet CLI" unless you give another name, and it stores your key in a file on your own computer (or reads it from an environment variable); we keep only a hash. A new key is shown once in your browser, and we exclude it from session replay.
On supported website pages, we may use Microsoft Clarity to better understand how visitors navigate and use the site through behavioral analytics such as page views, clicks, scrolling activity, session replay, and heatmap-style insights. We use this information to improve site content, navigation, usability, and overall product experience. We do not use Microsoft Clarity on LinkMagnet short-link redirect pages under /s/*.
When someone visits a LinkMagnet short link, we may record or derive analytics including click totals, referrer domain, country code, and device category. We use this information to provide reporting to the link owner, understand service usage, and improve the product. We read the user agent to tell people from link-preview and search-engine crawlers; visits we identify as crawlers receive the preview page and are not recorded as clicks. Other automated visits may still be counted.
When a site's owner sets a custom short-link domain, we register that hostname with Vercel, our hosting provider, which checks its DNS records and issues a TLS certificate for it. Visits to links on that domain are handled and counted like any other short link.
When you or a program asks the Open Graph validator to audit a URL (on the website, at /v1/validate, through the MCP audit_site tool, or as markdown at /validator?url=), we fetch that page and its preview images from the site that hosts it. We may also send the URL to Meta's Graph API and to LinkPreview to read its preview metadata. On the public validator and the API, no account is needed and we do not link these requests to an account. When you audit a page from your site's console, we keep the latest audit report for that page (its URL, the Open Graph tags we read, and the image size and ratio) with your site.
To verify a hostname we perform DNS lookups for it and may fetch its homepage. To render a card we fetch the requested page on a verified hostname and read its title, description, images, icon, site name, and language. Parts of that content are drawn into the rendered image. Rendered cards are cached for up to 14 days. We record the number of new cards drawn per site per day, to apply the daily fair-use limit and show the site's usage; we do not record who requested a card.
LinkMagnet uses cookies and similar technologies for authentication, security, analytics, and basic site functionality. This includes a persistent cookie called better-auth.last_used_login_method, set for 30 days, that remembers which sign-in method (Google, Facebook, or email) you last used so we can highlight it on your next visit. We also set a session cookie called NEXT_LOCALE to remember the language you selected during your visit.
Our analytics and site tooling providers may also set or read cookies and similar technologies to help us understand site usage, measure performance, and improve the service.
Depending on the feature used, LinkMagnet currently relies on third-party providers for infrastructure and product functionality, including analytics and session replay tooling on supported website pages.
We may share information with service providers that help us operate LinkMagnet. We may also disclose information if required by law, to protect rights and safety, to investigate abuse or security issues, or in connection with a sale, transfer, or restructuring of the service.
We do not sell personal information for money.
We retain information for as long as reasonably necessary to provide the service, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements. We may keep aggregated or de-identified analytics longer.
Key requests expire after 15 minutes and are deleted within two days of being created. If you approve a request, the client name and user agent it reported are kept with the resulting API key. Revoked API keys stay on record, marked revoked, until your account data is deleted, so we can investigate past access; they no longer appear on your API keys page.
Billing records for a site (its Stripe identifiers, plan and subscription status) are kept for as long as the site exists. Records of processed payment notifications are deleted after 90 days. Deleting a site removes our billing records for it; the Stripe customer created for the site (email, site name and identifiers), its invoices and payment records stay with Stripe as required for tax and accounting.
The latest audit report for each page you check from the console is kept until you audit that page again, remove its domain, or delete the site.
When we rate-limit a site, pause its new cards, suspend it or unverify one of its hostnames, we keep a record of the action: the site, account or hostname it applies to, the reason, any note our staff wrote, who took it and when it ends. These records are kept to enforce our Terms and handle appeals, and they stay after the site or account is deleted.
Short-link click statistics are kept for up to 18 months; deleting a link, or the site it belongs to, removes the link and its statistics immediately. Removing a custom short-link domain, or deleting its site, detaches the hostname from Vercel and deletes our record of it. Rendered cards and cached site icons are kept for up to 14 and 30 days respectively and are then purged. Deleting a site removes its hostnames and render counts immediately; cards already cached expire on their own schedule.
You can contact us to request access to, correction of, or deletion of certain personal information, subject to applicable law and exceptions. California residents may have additional rights under California privacy law, including the right to know what categories of personal information we collect and the right to request deletion.
To request deletion of your data, email contact@linkmag.net with the subject line "Data Deletion Request". We will acknowledge your request within a few business days and complete the deletion within 30 days, subject to any legal obligations that require us to retain certain records. See our Data Deletion Instructions page for full details.
LinkMagnet is not intended for anyone under 18, and we do not knowingly permit accounts for minors. We also do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13, we will take reasonable steps to delete it.
We use reasonable administrative, technical, and organizational measures to protect information, but no method of transmission or storage is completely secure. As a result, we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. When we do, we will post the revised version here and update the last updated date.
Privacy questions or requests can be sent to contact@linkmag.net.
This Privacy Policy explains what information LinkMagnet collects, why we collect it, the service providers involved, and the choices available to users.
Last updated October 30, 2026 · California-based and independently operated
LinkMagnet is operated by Dario Rapisardi (Pants AI), an individual based in California, USA. This Privacy Policy applies to our website, short-link tools, analytics features, Open Graph validator, card service, REST API, MCP server, command-line client, and related services.
When you use LinkMagnet, we may collect technical and usage information such as browser details, device information, IP address, approximate location, referral information, and interactions with the site. Some of this information comes directly from your browser or from infrastructure and analytics providers we use to run the service.
When a program uses your key through the API, the MCP server, or the command-line client, we update the time the key was last used, at most every five minutes. The command-line client identifies itself in its user agent. It names its key requests "linkmagnet CLI" unless you give another name, and it stores your key in a file on your own computer (or reads it from an environment variable); we keep only a hash. A new key is shown once in your browser, and we exclude it from session replay.
On supported website pages, we may use Microsoft Clarity to better understand how visitors navigate and use the site through behavioral analytics such as page views, clicks, scrolling activity, session replay, and heatmap-style insights. We use this information to improve site content, navigation, usability, and overall product experience. We do not use Microsoft Clarity on LinkMagnet short-link redirect pages under /s/*.
When someone visits a LinkMagnet short link, we may record or derive analytics including click totals, referrer domain, country code, and device category. We use this information to provide reporting to the link owner, understand service usage, and improve the product. We read the user agent to tell people from link-preview and search-engine crawlers; visits we identify as crawlers receive the preview page and are not recorded as clicks. Other automated visits may still be counted.
When a site's owner sets a custom short-link domain, we register that hostname with Vercel, our hosting provider, which checks its DNS records and issues a TLS certificate for it. Visits to links on that domain are handled and counted like any other short link.
When you or a program asks the Open Graph validator to audit a URL (on the website, at /v1/validate, through the MCP audit_site tool, or as markdown at /validator?url=), we fetch that page and its preview images from the site that hosts it. We may also send the URL to Meta's Graph API and to LinkPreview to read its preview metadata. On the public validator and the API, no account is needed and we do not link these requests to an account. When you audit a page from your site's console, we keep the latest audit report for that page (its URL, the Open Graph tags we read, and the image size and ratio) with your site.
To verify a hostname we perform DNS lookups for it and may fetch its homepage. To render a card we fetch the requested page on a verified hostname and read its title, description, images, icon, site name, and language. Parts of that content are drawn into the rendered image. Rendered cards are cached for up to 14 days. We record the number of new cards drawn per site per day, to apply the daily fair-use limit and show the site's usage; we do not record who requested a card.
LinkMagnet uses cookies and similar technologies for authentication, security, analytics, and basic site functionality. This includes a persistent cookie called better-auth.last_used_login_method, set for 30 days, that remembers which sign-in method (Google, Facebook, or email) you last used so we can highlight it on your next visit. We also set a session cookie called NEXT_LOCALE to remember the language you selected during your visit.
Our analytics and site tooling providers may also set or read cookies and similar technologies to help us understand site usage, measure performance, and improve the service.
Depending on the feature used, LinkMagnet currently relies on third-party providers for infrastructure and product functionality, including analytics and session replay tooling on supported website pages.
We may share information with service providers that help us operate LinkMagnet. We may also disclose information if required by law, to protect rights and safety, to investigate abuse or security issues, or in connection with a sale, transfer, or restructuring of the service.
We do not sell personal information for money.
We retain information for as long as reasonably necessary to provide the service, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements. We may keep aggregated or de-identified analytics longer.
Key requests expire after 15 minutes and are deleted within two days of being created. If you approve a request, the client name and user agent it reported are kept with the resulting API key. Revoked API keys stay on record, marked revoked, until your account data is deleted, so we can investigate past access; they no longer appear on your API keys page.
Billing records for a site (its Stripe identifiers, plan and subscription status) are kept for as long as the site exists. Records of processed payment notifications are deleted after 90 days. Deleting a site removes our billing records for it; the Stripe customer created for the site (email, site name and identifiers), its invoices and payment records stay with Stripe as required for tax and accounting.
The latest audit report for each page you check from the console is kept until you audit that page again, remove its domain, or delete the site.
When we rate-limit a site, pause its new cards, suspend it or unverify one of its hostnames, we keep a record of the action: the site, account or hostname it applies to, the reason, any note our staff wrote, who took it and when it ends. These records are kept to enforce our Terms and handle appeals, and they stay after the site or account is deleted.
Short-link click statistics are kept for up to 18 months; deleting a link, or the site it belongs to, removes the link and its statistics immediately. Removing a custom short-link domain, or deleting its site, detaches the hostname from Vercel and deletes our record of it. Rendered cards and cached site icons are kept for up to 14 and 30 days respectively and are then purged. Deleting a site removes its hostnames and render counts immediately; cards already cached expire on their own schedule.
You can contact us to request access to, correction of, or deletion of certain personal information, subject to applicable law and exceptions. California residents may have additional rights under California privacy law, including the right to know what categories of personal information we collect and the right to request deletion.
To request deletion of your data, email contact@linkmag.net with the subject line "Data Deletion Request". We will acknowledge your request within a few business days and complete the deletion within 30 days, subject to any legal obligations that require us to retain certain records. See our Data Deletion Instructions page for full details.
LinkMagnet is not intended for anyone under 18, and we do not knowingly permit accounts for minors. We also do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13, we will take reasonable steps to delete it.
We use reasonable administrative, technical, and organizational measures to protect information, but no method of transmission or storage is completely secure. As a result, we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. When we do, we will post the revised version here and update the last updated date.
Privacy questions or requests can be sent to contact@linkmag.net.