What is stored, read out of the code that stores it.

Who is responsible

handsofflinks is run by one person, an individual based in Poland, who is the data controller for everything described here. There is no company and no data protection officer. Contact: hello@handsofflinks.com.

1. If you submit the form

The domain-and-email form on the home page posts to a Cloudflare Worker at handsofflinks-api.lipmichal.workers.dev. The record it writes contains:

• The domain you typed, normalised to lower case with any https://, path and www. stripped.
• The email address you typed, lower-cased.
• A timestamp.
• A two-letter country code, taken from Cloudflare's CF-IPCountry header on your request.
• The referring URL your browser reported, truncated to 200 characters.
• Your browser's user-agent string, truncated to 200 characters.
• The plan and the price, if you were reserving a price rather than asking a question. There is one product, so these are always written as pipeline and 99; nothing you type decides them.

Two of those are not things you typed: the referring URL comes from your browser's referrer and the user agent from its request headers. Both are stored. The IP address itself is not written into this record — it is used only for rate limiting, described next.

Why: so there is something to reply to, and so a price reservation can be honoured against the right domain.

2. Rate limiting

To stop the form being hammered, the worker keeps a counter keyed on your IP address and the current hour, in the form rl:<ip>:<YYYY-MM-DDTHH>. The value is a number, nothing else. The limit is 5 submissions per IP per hour. The key expires after 3,900 seconds, which is 65 minutes, and then it is gone on its own.

3. If you buy

The payment happens on Stripe's own checkout page. No card number, expiry, CVC or billing address ever reaches this site's servers. What Stripe reports back, and what the worker then stores as an order record, is:

• The Stripe checkout session id.
• The email address you gave Stripe.
• The plan, the amount and the currency. With one product the plan is always pipeline; the field survives so that orders placed before 6 August 2026 still read correctly.
• Whether the payment was live or a test.
• A timestamp, a download counter, and the product version.

A second entry maps the Stripe session id to your download token, so that returning to the thank-you page finds the same download rather than minting a new one. Both expire after 90 days.

Why: a download has to be authorised by something, and this is that something. Without it there is no way to tell a buyer from a stranger with a link.

4. Each time the file is downloaded

Every download writes a separate record containing:

• The Stripe session id and the download token.
• Which download this was, of the 10 a link allows.
• The product version.
• Your IP address, from Cloudflare's CF-Connecting-IP header.
• Your two-letter country code.

These expire after 120 days. The order record is also updated with the time of the most recent download and the country it came from.

Why: so a link that leaks can be recognised rather than quietly drained, and so there is an answer when a buyer says the download never arrived. It is the one place where an IP address is deliberately kept, and it is worth being blunt about that rather than burying it.

5. Analytics and cookies

I use Google Analytics 4 to see which channels bring people to handsofflinks.com, such as a search engine, a forum thread, LinkedIn or X, and what they do once they're here. It tells me which guides are worth writing. I don't use it for ads, and I never sell what it collects.

With analytics on, the page sends Google the pages you view, the link or campaign tag that brought you, your device type, browser, screen size and language, and an approximate location. It also counts a few actions, such as clicking a checkout link or a link to another site, opening an FAQ answer, scrolling to the end of a page, or starting and sending a form. It never reads what you type or paste into the tools or the form.

Before any page address goes to Google, the script removes every query parameter except the utm_ campaign tags and gclid. Once Stripe has confirmed a payment, the thank-you page sends Google one purchase event with the plan you bought and its price. It's tagged with the Stripe checkout reference, so I can match a sale in Stripe to the visit that led to it. Google Analytics is also set to blank out download tokens and email addresses in links before they're sent. Google reads your country and city from your IP address and then drops the address. GA4 doesn't log or store IP addresses. I never send Google your email address or your card details.

Two first-party cookies let GA4 recognize a repeat visit from the same browser. They hold random IDs and nothing else about you.

In the EEA, the UK and Switzerland, nothing loads from Google until you press Accept in the banner. Google's tag doesn't load before then, and it never loads if you decline. In those countries I rely on your consent (Art. 6(1)(a) GDPR). The cookie rules ask for the same consent, under Art. 5(3) of the ePrivacy Directive and the national laws that implement it, and under the UK's PECR. I ask in Switzerland too.

Everywhere else, analytics is on when the page loads. I rely on my legitimate interest in knowing which channels work (Art. 6(1)(f) GDPR), and you can switch it off at any time. To decide whether to show the banner, the page asks Cloudflare, through the same worker described above, which country your connection comes from. I don't store that answer. If your browser sends Global Privacy Control or Do Not Track, Google Analytics never loads here at all.

If you switch analytics off, the page stops sending anything to Google and deletes the _ga cookies. Like any web request, loading Google's tag reaches Google from your IP address.

Google LLC, and Google Ireland Limited where Google's terms name it, process this data for me as my processor under the Google Ads Data Processing Terms. Google signals and advertising features are switched off, so analytics data isn't linked to Google accounts or used for ads. GA4 deletes event data after 14 months.

Google may process the data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and Google's terms also include the European Commission's standard contractual clauses.

You can change your choice at any time with Cookie settings, here or at the foot of any page. If you withdraw consent, analytics stops and the page deletes the _ga cookies from your browser. Data sent before that stays in GA4 until its 14 months run out. You can also block Google Analytics on every site with Google's opt-out add-on at tools.google.com/dlpage/gaoptout, or block cookies in your browser.

6. Retention, in one table

The first five rows are the expiry values set in the worker source. The last three come from the Google Analytics settings and the analytics script. If they change, this table changes with them and the date at the bottom of the page moves.

7. Where it is stored

In Cloudflare Workers KV, written by a Cloudflare Worker. Being straight about what that means geographically: KV is a globally distributed key-value store. Values live in Cloudflare's own storage and are cached in Cloudflare data centres around the world as they are read. This site does not pin that storage to a region and has no mechanism to.

So assume the data is processed outside Poland and outside the EEA. The transfer is governed by Cloudflare's own data processing terms and the standard contractual clauses inside them. There is no additional arrangement beyond that, and this page is not going to imply one.

8. Who else sees it

• Stripe — takes the payment. Stripe holds the card data and the payment record under its own privacy policy, as its own controller for that. This site receives only the fields listed in section 3.
• Cloudflare — runs the worker and the KV store and sits in front of the API, so it processes request metadata including your IP address.
• GitHub Pages — hosts the static pages you are reading right now. Like any web host it sees the requests that reach it, including IP addresses. That is GitHub's log rather than mine; there is no analytics view of it here and no way to query it.
• Google runs Google Analytics for me as my processor, as described in section 5. In the EEA, the UK and Switzerland that only happens after you accept.
• The mailbox behind hello@handsofflinks.com — if you email, what you write sits in that mailbox with whichever provider runs it.

Nobody else. No advertising networks, no other analytics vendors, no session recording, no data brokers, no mailing-list platform, and nothing is ever sold or rented. Emails to people holding a reserved price are sent by hand from the address above.

9. The legal bases

These are the words the GDPR uses, used here because they are the accurate ones:

• Orders and downloads — performance of a contract. You cannot be sold a file without a record that you bought it.
• Rate limiting and download logging — legitimate interests, specifically keeping the delivery endpoint working and not letting one leaked link drain it.
• Analytics rests on your consent in the EEA, the UK and Switzerland, and on legitimate interests everywhere else (see section 5).
• The form — consent. You typed it in and pressed the button, and you can withdraw that at any time by asking for deletion.

10. Your rights

If the GDPR applies to you, you have the right to ask for access to your data, correction of it, deletion of it, restriction of its processing, and a copy of it in a portable form, and to object to processing based on legitimate interests. There is no automated decision-making here. The analytics in section 5 counts visits and clicks, and it's never used to make a decision about you or to target ads.

You can also complain to a supervisory authority: in Poland that is the Prezes Urzędu Ochrony Danych Osobowych (UODO), and you may instead complain to the authority in the country where you live.

11. How to get it deleted

Email hello@handsofflinks.com from the address you gave, or naming the domain you entered, and say you want it deleted. No form, no reason, no identity documents.

• Form records are deleted outright. Nothing depends on them.
• Order and download records can also be deleted on request, with one honest caveat: Stripe holds its own record of the payment for its own legal and accounting reasons, and deleting the copy here does not touch that. For Stripe's copy you have to go to Stripe. A record of a completed sale may also need to be kept for tax and accounting purposes, and where that applies the deletion is deferred rather than refused silently — you will be told which it is.
• If you do nothing, order records disappear after 90 days and download records after 120, on their own.

12. Children

This is a developer tool sold to businesses and site owners. It is not directed at children and nothing here is knowingly collected from anyone under 16.

13. Changes

If what the code stores changes, this page changes in the same commit and the date below moves. A privacy page that is older than the system it describes is worse than none.