What is stored, read out of the code that stores it.

Who is responsible

handsofflinks is run by one person, an individual based in Poland, who is the data controller for everything described here. There is no company and no data protection officer. Contact: hello@handsofflinks.com.

1. If you submit the form

The domain-and-email form on the home page posts to a Cloudflare Worker at handsofflinks-api.lipmichal.workers.dev. The record it writes contains:

• The domain you typed, normalised to lower case with any https://, path and www. stripped.
• The email address you typed, lower-cased.
• A timestamp.
• A two-letter country code, taken from Cloudflare's CF-IPCountry header on your request.
• The referring URL your browser reported, truncated to 200 characters.
• Your browser's user-agent string, truncated to 200 characters.
• The plan and the price, if you were reserving a price rather than asking a question. There is one product, so these are always written as pipeline and 99; nothing you type decides them.

Two of those are not things you typed: the referring URL comes from your browser's referrer and the user agent from its request headers. Both are stored. The IP address itself is not written into this record — it is used only for rate limiting, described next.

Why: so there is something to reply to, and so a price reservation can be honoured against the right domain.

2. Rate limiting

To stop the form being hammered, the worker keeps a counter keyed on your IP address and the current hour, in the form rl:<ip>:<YYYY-MM-DDTHH>. The value is a number, nothing else. The limit is 5 submissions per IP per hour. The key expires after 3,900 seconds, which is 65 minutes, and then it is gone on its own.

3. If you buy

The payment happens on Stripe's own checkout page. No card number, expiry, CVC or billing address ever reaches this site's servers. What Stripe reports back, and what the worker then stores as an order record, is:

• The Stripe checkout session id.
• The email address you gave Stripe.
• The plan, the amount and the currency. With one product the plan is always pipeline; the field survives so that orders placed before 6 August 2026 still read correctly.
• Whether the payment was live or a test.
• A timestamp, a download counter, and the product version.

A second entry maps the Stripe session id to your download token, so that returning to the thank-you page finds the same download rather than minting a new one. Both expire after 90 days.

Why: a download has to be authorised by something, and this is that something. Without it there is no way to tell a buyer from a stranger with a link.

4. Each time the file is downloaded

Every download writes a separate record containing:

• The Stripe session id and the download token.
• Which download this was, of the 10 a link allows.
• The product version.
• Your IP address, from Cloudflare's CF-Connecting-IP header.
• Your two-letter country code.

These expire after 120 days. The order record is also updated with the time of the most recent download and the country it came from.

Why: so a link that leaks can be recognised rather than quietly drained, and so there is an answer when a buyer says the download never arrived. It is the one place where an IP address is deliberately kept, and it is worth being blunt about that rather than burying it.

5. Retention, in one table

These are the expiry values set in the worker source. If they change, this table changes with them and the date at the bottom of the page moves.

6. Where it is stored

In Cloudflare Workers KV, written by a Cloudflare Worker. Being straight about what that means geographically: KV is a globally distributed key-value store. Values live in Cloudflare's own storage and are cached in Cloudflare data centres around the world as they are read. This site does not pin that storage to a region and has no mechanism to.

So assume the data is processed outside Poland and outside the EEA. The transfer is governed by Cloudflare's own data processing terms and the standard contractual clauses inside them. There is no additional arrangement beyond that, and this page is not going to imply one.

7. Who else sees it

• Stripe — takes the payment. Stripe holds the card data and the payment record under its own privacy policy, as its own controller for that. This site receives only the fields listed in section 3.
• Cloudflare — runs the worker and the KV store and sits in front of the API, so it processes request metadata including your IP address.
• GitHub Pages — hosts the static pages you are reading right now. Like any web host it sees the requests that reach it, including IP addresses. That is GitHub's log rather than mine; there is no analytics view of it here and no way to query it.
• The mailbox behind hello@handsofflinks.com — if you email, what you write sits in that mailbox with whichever provider runs it.

Nobody else. No advertising networks, no analytics vendors, no session recording, no data brokers, no mailing-list platform, and nothing is ever sold or rented. Emails to people holding a reserved price are sent by hand from the address above.

8. The legal bases

These are the words the GDPR uses, used here because they are the accurate ones:

• Orders and downloads — performance of a contract. You cannot be sold a file without a record that you bought it.
• Rate limiting and download logging — legitimate interests, specifically keeping the delivery endpoint working and not letting one leaked link drain it.
• The form — consent. You typed it in and pressed the button, and you can withdraw that at any time by asking for deletion.

9. Your rights

If the GDPR applies to you, you have the right to ask for access to your data, correction of it, deletion of it, restriction of its processing, and a copy of it in a portable form, and to object to processing based on legitimate interests. There is no automated decision-making and no profiling here to object to.

You can also complain to a supervisory authority: in Poland that is the Prezes Urzędu Ochrony Danych Osobowych (UODO), and you may instead complain to the authority in the country where you live.

10. How to get it deleted

Email hello@handsofflinks.com from the address you gave, or naming the domain you entered, and say you want it deleted. No form, no reason, no identity documents.

• Form records are deleted outright. Nothing depends on them.
• Order and download records can also be deleted on request, with one honest caveat: Stripe holds its own record of the payment for its own legal and accounting reasons, and deleting the copy here does not touch that. For Stripe's copy you have to go to Stripe. A record of a completed sale may also need to be kept for tax and accounting purposes, and where that applies the deletion is deferred rather than refused silently — you will be told which it is.
• If you do nothing, order records disappear after 90 days and download records after 120, on their own.

11. Children

This is a developer tool sold to businesses and site owners. It is not directed at children and nothing here is knowingly collected from anyone under 16.

12. Changes

If what the code stores changes, this page changes in the same commit and the date below moves. A privacy page that is older than the system it describes is worse than none.