Privacy Policy

Last updated: August 2026

LinkLoom (“we”, “us”, “our”) operates the linkloom.app website and the LinkLoom content platform (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices available to you.

By creating an account or using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information we collect

1.1 Account information

When you create a LinkLoom account, we collect:

Email address - used as your login identifier and for transactional communications.
Display name - shown within your workspace.
Authentication tokens - we use one-time password (OTP) email authentication; we do not store passwords.

1.2 Content and workspace data

Content you create - articles, drafts, templates, brand voice profiles, and media assets you upload or generate within LinkLoom.
Publishing configurations - connected destinations, scheduling preferences, and webhook settings.
Optimization scores - SEO, AEO, and GEO scores generated for your content.

1.3 Third-party integration data

When you connect third-party accounts to LinkLoom, we access and store certain data from those services:

Google Search Console - search performance data including clicks, impressions, average position, click-through rate (CTR), and search queries associated with your verified properties. This data is accessed via the Google Search Console API using read-only OAuth 2.0 scopes. LinkLoom does not modify any data in your Google Search Console account.
Google Analytics - when you connect Google Analytics, we access read-only reporting data including pageviews, sessions, engagement metrics, and traffic sources for properties you authorize. We do not modify your Google Analytics configuration or data.
CMS platforms (WordPress, Ghost, Webflow, Medium, Substack, and others) - publishing credentials and content metadata necessary to publish on your behalf.
Social media accounts (X/Twitter, LinkedIn, Facebook, Instagram, TikTok, Pinterest, Threads, YouTube, Reddit) - authorization tokens and profile information necessary to post content on your behalf.
Email platforms (Mailchimp, ConvertKit, Beehiiv, and others) - API keys or OAuth tokens and list/audience metadata necessary to distribute content.

1.4 Usage and analytics data

We automatically collect:

Device and browser information - browser type, operating system, screen resolution, and device type.
Log data - IP address (anonymized), pages visited, features used, timestamps, and referral URLs.
Performance data - page load times, errors, and feature interaction patterns.

We use Google Analytics 4 with IP anonymization enabled (anonymize_ip: true) and Cloudflare Web Analytics for aggregate site analytics on linkloom.app.

1.5 Billing information

Payment processing is handled by our third-party payment provider. We receive and store:

Last four digits of your card number, card brand, and expiration date (for display in your billing settings).
Billing address and invoice history.

We never receive, transmit, or store full card numbers, CVVs, or bank account credentials.

2. How we use your information

We use the information we collect to:

Provide and operate the Service - create and manage your account, process and publish content, connect integrations, and deliver optimization scoring.
Provide Google Search Console insights - pull search performance data from your connected GSC property, cross-reference it with AI visibility metrics, and generate prioritized fix recommendations.
Provide analytics insights - display content performance metrics from connected analytics properties alongside LinkLoom’s own tracking data.
Improve the Service - analyze usage patterns to identify bugs, improve features, and inform product decisions.
Communicate with you - send transactional emails (login codes, billing receipts, publishing confirmations), product updates, and service announcements. You can opt out of non-essential communications at any time.
Ensure security and prevent abuse - detect unauthorized access, enforce rate limits, and protect against spam or fraudulent activity.
Comply with legal obligations - respond to lawful requests and enforce our Terms of Service.

3. Google API Services - Limited Use Disclosure

LinkLoom’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

We only use Google user data for the purposes described in this privacy policy - to provide and improve the LinkLoom Service as authorized by the user.
We do not transfer Google user data to third parties except as necessary to provide or improve the Service (e.g., infrastructure hosting), as required by law, or with your explicit consent. We do not transfer data to third parties for their own purposes.
We do not use Google user data for advertising purposes. We do not serve ads, and we do not use data received from Google APIs to create advertising profiles, retarget users, or serve personalized or interest-based advertising.
We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations.
Google Search Console data is accessed using read-only OAuth 2.0 scopes. LinkLoom requests only the https://www.googleapis.com/auth/webmasters.readonly scope. We do not request write access to your Search Console properties.
Google Analytics data is accessed using read-only OAuth 2.0 scopes. LinkLoom requests only reporting/read scopes. We do not modify your Google Analytics configuration, create goals, or alter tracking settings.

You can revoke LinkLoom’s access to your Google account at any time by visiting your Google Account permissions page or by disconnecting the integration from your LinkLoom dashboard.

We do not sell, rent, or trade your personal information.

We share data only in the following circumstances:

Service providers - we use third-party vendors to operate infrastructure (cloud hosting, CDN), process payments, send transactional emails, and provide customer support tools. These providers access data only to perform services on our behalf and are contractually obligated to protect it.
Publishing destinations - when you publish content through LinkLoom, we transmit your content and associated metadata to the platforms you have connected and authorized.
Analytics providers - we use Google Analytics 4 (with IP anonymization) and Cloudflare Web Analytics to collect aggregate usage data about linkloom.app. These services may set their own cookies per their respective privacy policies.
Legal requirements - we may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of LinkLoom, our users, or the public.
Business transfers - in the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction. We will notify you of any such change in ownership.

5. Data retention

Account data - retained while your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required for legal, tax, or audit purposes (up to 7 years for billing records).
Content - your articles, drafts, and media are deleted within 30 days of account deletion. Published content on third-party platforms is not affected by account deletion on LinkLoom.
Google API data - search performance data, analytics data, and associated tokens are deleted when you disconnect the integration or delete your account. Cached performance data is refreshed according to your plan tier (weekly, daily, or every 6 hours) and older snapshots are retained for up to 90 days for trend analysis.
Usage logs - anonymized and aggregated usage data may be retained indefinitely for product improvement purposes.
Backups - encrypted backups containing user data are purged within 90 days of the original data deletion.

6. Data security

We implement industry-standard security measures to protect your data:

Encryption in transit - all data transmitted between your browser and LinkLoom is encrypted using TLS 1.2 or higher.
Encryption at rest - stored data is encrypted using AES-256 encryption.
OAuth 2.0 - third-party integrations (Google Search Console, Google Analytics, CMS platforms, social media) use OAuth 2.0 for secure authorization. We store encrypted refresh tokens and never store third-party passwords.
Access controls - internal access to user data is restricted on a need-to-know basis and protected by multi-factor authentication.
Regular audits - we conduct periodic security reviews and vulnerability assessments.

7. Your rights and choices

Depending on your jurisdiction, you may have the following rights:

Access - request a copy of the personal data we hold about you.
Correction - request correction of inaccurate or incomplete data.
Deletion - request deletion of your account and associated personal data.
Data portability - export your content in Markdown, HTML, or JSON format at any time from your dashboard.
Restrict processing - request that we limit how we use your data.
Withdraw consent - revoke consent for optional data processing at any time.
Disconnect integrations - revoke LinkLoom’s access to any connected third-party account from your dashboard or directly from the third-party provider’s settings.
Opt out of analytics - use browser privacy settings, ad blockers, or the Google Analytics opt-out browser add-on to prevent analytics collection.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7.1 California residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To submit a request, email [email protected] with the subject line “CCPA Request.”

If you are located in the European Economic Area, our legal bases for processing personal data are: performance of a contract (providing the Service), legitimate interests (improving the Service, ensuring security), consent (optional analytics and marketing communications), and compliance with legal obligations. You have the right to lodge a complaint with your local data protection authority.

8. International data transfers

LinkLoom processes data in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. We rely on standard contractual clauses and other lawful transfer mechanisms to ensure adequate protection for international data transfers.

9. Children’s privacy

LinkLoom is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly. Contact [email protected] if you believe a child has provided us with personal information.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice at least 30 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact

For questions, concerns, or data requests related to this policy, contact us at:

Email: [email protected] Mail: LinkLoom, Attn: Privacy, PO Box 3201, Wilmington, DE 19804, USA