Privacy Policy
Our commitments to creator privacy, data transparency, GDPR & CCPA readiness, and Google API Services User Data Policy compliance.
Effective Date: September 17, 2026 · Last Updated: September 17, 2026
1. Privacy Philosophy: No Data Selling
At Tyxos, we believe creators, publishers, and businesses deserve high-speed link intelligence without sacrificing audience privacy or personal security.
2. Information We Collect
We collect information strictly necessary to provide, secure, and operate our edge routing and link synchronization services:
A. Registered Creator Account Information
- Full name and verified email address for account authentication.
- Password hashes (securely salted using Argon2id/bcrypt; plaintext passwords are never stored).
- Connected custom domain hostnames and SSL verification status.
- Affiliate tracking IDs (e.g. Amazon Associates Store IDs, Impact, ShareASale) configured by the creator.
- Subscription metadata (managed via our PCI-compliant Merchant of Record, Dodo Payments; raw credit card numbers are never held by Tyxos).
B. Edge Routing Telemetry (Anonymous & Non-Identifiable)
When end visitors click an Tyxos shortlink (initl.ink/* or a creator's custom domain), our global edge nodes process transient HTTP request headers in ultra-low latency edge memory:
- Country & City: Derived from edge headers (e.g. Cloudflare IP country) to perform instant geo-routing without persisting the visitor's raw IP address.
- Device & OS: Extracted from the User-Agent header (iOS, Android, Windows, Mac) for device-targeted routing.
- Referrer Domain: To supply high-level traffic attribution (e.g. YouTube, Instagram, X) to the link owner.
- Timestamp: UTC timestamp for performance graphs.
C. Mobile Application & iOS Share Extension Data
When using the native Tyxos iOS Application and Share Sheet Extension:
- Shared URLs & Text: The Share Extension accesses URLs or text snippets strictly when you explicitly tap the "Tyxos" action in the iOS share sheet. No ambient or background browsing monitoring occurs.
- Encrypted Local Keychain: Your API Key and active workspace identifiers are stored locally in the encrypted Apple Keychain and sandboxed App Group (
group.com.initlnk). - Photo Library Access: Photo access is requested on-demand solely if you choose to export or save a generated QR Code to your device's Photos album.
- Zero Third-Party SDK Trackers: The mobile application does not integrate third-party ad networks, advertising trackers (IDFA), or location-tracking SDKs.
3. Google API Services & YouTube Data Compliance
Google OAuth 2.0 & YouTube Data API v3 integration disclosure
Official Google Limited Use Disclosure:
"Tyxos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."
YouTube API Services & Scopes Used
Tyxos utilizes official YouTube API Services. By connecting your YouTube Channel to Tyxos, you agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy.
Allows Tyxos to read your channel name, thumbnail, and existing video descriptions to scan and detect outdated or affiliate URLs.
Allows Tyxos to update video descriptions on your channel solely when you explicitly review and click "Update Selected Videos".
How We Handle & Protect Google User Data
- No Advertising Profiling: Google user data is never used to serve targeted advertisements or retargeting campaigns.
- No AI Model Training: Google user data and video content are never used to train generalized artificial intelligence or machine learning models.
- Encrypted Token Storage: OAuth access and refresh tokens are encrypted at rest using industry-standard AES-256 encryption.
- Revoking Access Anytime: You can disconnect your YouTube channel at any time from your Tyxos dashboard, or revoke access directly via the Google Security Permissions Page. Disconnecting immediately removes all stored OAuth tokens from our database.
4. How We Use Collected Data
We process your data exclusively for the following operational purposes:
- Sub-50ms Global Redirection: Executing edge-level redirects based on country, operating system, and custom rules.
- Affiliate Tag Preservation: Automatically injecting creator-specified Amazon Associates, Impact, and affiliate tags without overwriting user earnings.
- Audience Analytics: Providing real-time charts showing aggregated click volume, top referrers, and geographic heatmaps.
- Abuse Prevention & Security: Detecting bot scrapers, click fraud, malware URLs, and DDoS attacks.
- Customer Support & Billing: Managing account authentication, password resets, and subscription renewals.
5. Sub-Processors & Infrastructure Partners
Tyxos partners with vetted, enterprise-grade cloud infrastructure providers adhering to ISO/IEC 27001, SOC-2 Type II, and GDPR compliance standards:
| Partner | Purpose | Data Processed | Location |
|---|---|---|---|
| Cloudflare | Global Edge Network, DDoS & SSL | Transient HTTP headers | Global (330+ edge locations) |
| Neon Postgres | Serverless Database Storage | Account records, links, encrypted tokens | United States / EU |
| Vercel | Next.js Compute & Hosting | Application rendering & API logic | Global Edge Compute |
| Dodo Payments | Merchant of Record & Billing | Payment processing & tax compliance | United States |
| Google Cloud Platform | YouTube OAuth & Data APIs | Channel metadata & video descriptions | United States |
6. Data Retention, Deletion & Revocation
We retain your account data for as long as your account remains active. Detailed visitor click event logs are retained according to your plan tier (7 days on Hobby, 30 days on Creator, 90 days on Pro, 365 days on Scale) and are automatically purged upon expiry.
Self-Service Permanent Account Deletion
You can permanently delete your account at any time from Dashboard > Settings > Danger Zone or directly from the Tyxos iOS App (Settings > Legal > Manage or Delete Account). Deleting your account initiates a permanent cascade deletion that instantly removes your user profile, active links, analytics history, custom domains, and all third-party OAuth connections (including Google/YouTube tokens) across all databases.
7. Your Rights (GDPR & CCPA / CPRA)
Regardless of your geographic location, Tyxos provides comprehensive data rights:
- Right to Access & Portability: Request a complete export of your links and analytics history in CSV/JSON format.
- Right to Rectification: Update or modify your email, profile, or domain routing settings at any time in the dashboard.
- Right to Erasure ("Right to be Forgotten"): Request or execute full deletion of all personal data.
- Right to Non-Discrimination: We never discriminate against or reduce service quality for users who exercise their privacy rights.
8. Security & Encryption Standards
Tyxos employs multi-layered physical, technical, and administrative safeguards to protect your data against unauthorized access, loss, or alteration:
- End-to-end TLS 1.3 encryption on all web and API traffic.
- Automated SSL/TLS certificate provisioning and renewal for all custom domains.
- Encrypted credential vaults and isolated session token authentication.
- Continuous vulnerability scanning and automated DDoS protection.
9. Privacy Inquiries & Contact
If you have questions, comments, or requests regarding this Privacy Policy or wish to exercise any of your legal rights, contact our Data Protection Team: