Privacy Policy

1. What we collect

Account data: your email address and password (Supabase, our authentication provider, stores your password in hashed form -- we never see or store it ourselves), your username(s), and, if you set them, your display name, bio, and profile/banner images.

Page content: the links, headings, banners, and other blocks you add to your page(s), plus any social profile links you connect and any images you upload.

Public page analytics: when someone views your page or clicks a link, we log the event -- timestamp, best-effort country and device type, and referrer source. This exists solely to give you, the page owner, insight into how your page is performing -- we don't build profiles of your visitors from it. Retention: 6 months on the Free plan, 2 years on Ad-Free and Agency -- after that window, the events are automatically and permanently deleted.

Cookies/session data: used to keep you logged in and your dashboard session secure. See our Cookie Notice for the full breakdown.

2. Advertising

Our Free plan's business model includes showing ads -- on public pages and inside the dashboard -- to keep the product free. As of today, we haven't turned any ads on and haven't selected an ad provider yet. Before any ad network goes live, we'll name the provider here, state exactly what data (if any) is shared with them, and -- if that involves tracking or profiling -- update this notice and ask for your consent again specifically for that, rather than relying on this one. Ad-Free and Agency plans never show ads, now or after this changes.

3. Who we share data with

• Supabase -- our database, authentication, file storage, and the service that sends our account emails (like verification and password reset).
• Vercel -- hosts the application itself.
• Payment processor -- not yet integrated. When paid plans go live, we intend to use Razorpay to handle billing; we never store your card details ourselves.
• Ad provider-- none selected yet (see "Advertising" above).

Each of these only receives what it needs to do its job, and none of them may use your data for their own purposes. We do not sell your personal data, ever.

4. Your rights

• Access & correction: view and edit your account and page details any time from your dashboard.
• Erasure: delete individual links or pages, or your entire account and all associated data, from Account Settings.
• Withdraw consent:turn off "product updates and offers" in Account Settings at any time -- it takes effect immediately and doesn't affect your account. Withdrawing consent to our Terms/ Privacy Notice means deleting your account, since we can't provide the Service without it.
• Grievance redressal: email hello@xhadow.inwith any question or complaint about your data. If you're not satisfied with our response, you have the right to escalate to the Data Protection Board of India.

5. Children's privacy

Klicking isn't directed at children under 13, and we don't knowingly collect data from them. If you believe a child has created an account, contact us and we'll remove it.

6. Changes to this notice

Whenever we materially change what we collect, why, or who we share it with, we'll treat it as a new version of this notice -- meaning we'll ask for your consent again where required, rather than silently relying on an old agreement.

Notice version: 2026-07-23 (last updated 23 July 2026).