Privacy Policy

Last updated: 28 October 2026

Issued by StickTech, Inc., a Delaware corporation (Delaware file number 10724998).

1. Five kinds of people#

Most policies in this category lump everyone together. We don't, because the person who publishes a page, the person who fills in a form on it and the person who buys from it are in genuinely different positions.

If you are a Contact or a Buyer, the creator whose page you used decides what happens to your data and their privacy notice governs, not this one. We hold it on their instructions under Terms §8. Ask them for corrections or deletion; if you cannot reach them, write to help@stick.so and we will help.

2. If you are a Creator#

What we collect. Your email address — that is genuinely all we require for a magic-link account. We do not ask for your name, we have no profile table, and we do not collect date of birth, gender, phone or address. Google sign-in gives us your email and basic profile; we do not request Drive, Calendar or Contacts access. Beyond that: what you build (pages, drafts, uploads, settings), support messages you send us, and technical data when you use the editor — IP, browser, device and error diagnostics.

If you only visit stick.so, we do not know your account email. When product analytics are enabled in production, we measure page views, navigation and calls to action. In the signed-in product we also measure feature use. Signed-in analytics use the Supabase user ID as the identifier, not the account email.

We do not buy data about you and we do not build advertising profiles.

If you sell. Payments run on your own Stripe account. You give Stripe your identity and bank details on Stripe's own pages, not to us, and Stripe's privacy policy covers them. We keep the Stripe account ID, whether it can take payments, what Stripe still needs from you, its country and currency, and when you connected it. The files you sell are stored privately (section 8). The emails that deliver your products come from our address with your page's name on them, and replies go to your account email — a buyer who replies will see that address.

Why, and on what basis:

We make no automated decisions about you with legal or similarly significant effects, and we do not profile you.

Cookies and analytics on stick.so and in the editor. Signing in sets Supabase authentication cookies (sb-<project>-auth-token, plus a short-lived verifier during sign-in). They are strictly necessary — the editor cannot work without them — so we do not ask consent for them. The current Supabase browser client sets them SameSite=Lax, host-scoped to app.stick.so, and readable by the browser authentication client; they are not shared with published pages.

When the production analytics keys are configured, stick.so and the editor use PostHog for product analytics and Google Tag Manager to deliver configured measurement tags. These tools can use browser storage or cookies. PostHog session replay is disabled everywhere except the page editor; in the editor it records clicks, drags and layout changes while masking every input value. We do not use these tools to build advertising profiles.

3. If you visit a published page#

Published stick pages set no cookies of ours. None. No analytics cookie, no session cookie, no consent cookie, and no local or session storage. That is a property of how the pages are built, not a promise we are asking you to take on trust.

What we measure. Page views and link clicks, so creators can see whether their page works. Per event: which page and block; your country only, derived at the network edge — never a city or precise location; the hostname that referred you (instagram.com, never the full URL); coarse device, browser and operating system categories derived from the user-agent; and a visitor hash. The raw user-agent is not stored.

How the hash works. We take your IP and user-agent, combine them with the creator's site ID and a secret salt we rotate at midnight UTC, hash it, and keep only the result. So:

• Your IP address and user-agent are never written to our database. They exist in memory long enough to compute the hash, then are discarded.
• The hash cannot be reversed to recover your IP.
• Because the salt changes daily, the same person's hash changes daily — we cannot follow you across days, build a profile, or link your activity across different creators' pages.

This is deliberately less capable than the analytics our competitors run, and we accept that trade.

We do not act on Do Not Track signals because we do not do the cross-site tracking DNT exists to stop.

Retention. Individual events are deleted automatically after 90 days. What survives is aggregate daily counts — views, clicks, referrer hostnames, country totals — containing nothing about any individual.

Legal basis: our legitimate interest, and the creator's, in knowing whether a page works. We store no direct identifier and no identifier that persists beyond a day.

4. If you are a Contact#

When you submit a form, we store it so the creator can see it. That always includes an email address (our forms require one) and may include your name, phone, free-text answers and checkbox responses — whatever that creator asked for. We keep the individual submission and a merged per-creator contact record, so repeat submissions from the same address appear once.

We do not use this for our own purposes. We do not market to you, sell it, share it with other creators, or add you to anything. We hold it for the creator, on their instructions.

We do not send campaigns to page contacts. Authentication emails for Creators are delivered through Supabase, but Stick does not provide a campaign-sending service for Contact records. The only emails a Contact gets from us are the ones a product needs (section 5). If a creator emails you, they do it from their own tool, and their unsubscribe applies.

The creator is responsible for telling you why they collected it, having a lawful basis, and handling your requests. Retention: for as long as the creator keeps their account and has not deleted the record. If they delete their site or account, it goes too.

5. If you buy from a page#

The sale is between you and the creator. Stick is not the seller and never holds your money: you pay the creator through Stripe, on the creator's own Stripe account. Questions about the product and refunds go to the creator.

A product starts with a form, so everything in section 4 applies to what you type into it. The creator gets it as soon as you submit — before you pay, and even if you do not finish checkout.

Card details never reach us. You enter them on Stripe's own checkout page, and Stripe processes the payment under its own privacy policy. To open that page we send Stripe your email address, the product's name, description and price, and our order reference. Stripe sends back whether the payment went through, the payment reference, the email you paid with and the country of your billing address — and later, if the payment is refunded or disputed.

What we store, for the creator. For a paid product we keep an order: your email, the product and its price, the payment status, the Stripe payment reference, your billing country and how many download links have been issued. The creator sees your orders in their dashboard.

Emails. We send the email with your product on the creator's behalf: it comes from our address with their page's name on it, and a reply goes to the creator. If you ask for a new download link, we email you a one-time code that works for 10 minutes. We send you nothing else.

Your receipt link. The address in that email is the key to your order — anyone who has it can open the receipt, so do not share it. For a paid file, each download link works for 5 minutes, and after 5 downloads we ask you to confirm your email with a code.

The creator is responsible for their own privacy notice, their refunds and your requests about your data, as in section 4. Retention: orders stay while the creator keeps the site; deleting the site or the account deletes them. Stripe keeps its own payment records under its own rules.

6. Third parties on published pages#

A creator can add blocks that make your browser contact other companies. Their own privacy policies apply, and the creator, not us, chose to include them:

The four in the second row matter most: they execute third-party JavaScript with full page privileges and can set their own cookies. Where consent is required for that, it is the creator's responsibility.

Note that link thumbnails default to fetching a favicon from Google, so most pages disclose their outbound link hostnames to Google. Typography is self-hosted — we do not call Google Fonts for fonts.

7. Who we share with#

We do not sell personal data and do not share it for behavioural advertising. Our providers:

Stripe is not on this list because it is not our provider: a sale runs on the creator's own Stripe account, under Stripe's privacy policy and the creator's agreement with Stripe. What we exchange with Stripe is in section 5.

Our error tracking is self-hosted on our own server in Germany, not a third-party error-tracking service, so diagnostics stay on infrastructure we operate. It runs only in the editor — no error monitoring runs on published pages, so Visitors are never included.

Beyond these we disclose data only if the law requires it, to enforce our Terms, to protect someone from harm, or to a buyer of our business (we will tell you first, and this policy continues until replaced).

Not used by Stick on published pages: PostHog, Google Tag Manager and our self-hosted error monitoring do not run on pages at *.stick.site. Embedded third-party blocks listed above can still contact their providers. We do not use Mixpanel, Amplitude, Segment, Hotjar, FullStory or LogRocket.

AI apps you connect. Stick has no AI features of its own and does not send your content to a model provider. You can connect an AI app to your account through the Stick MCP connector — Claude, ChatGPT, or a program on your computer such as Claude Code or Codex. Once you allow it on our consent screen, the app acts on your instructions: it can read your sites (their names, addresses, blocks, text, photos and styling, and whether they are published), create sites, save new drafts and upload the photos you pick. It cannot publish, unpublish or delete a site, and none of its tools reads analytics, contacts, form submissions or orders. What the app reads goes to the company behind it — Anthropic or OpenAI, for example — under that company's own terms: you choose to share it, and that company does not process it for us. Supabase, our authentication provider, issues the app's sign-in tokens. Sticker searches the app makes are sent to GIPHY, and photos uploaded through it are public like any other upload (section 8). To disconnect, remove Stick from the app's connectors.

8. Uploaded images are public#

Anything you upload is stored in a publicly readable bucket. The file is reachable by anyone with its URL; this is true whether or not your site is published; and unpublishing does not make images private again. Do not upload anything you would not want public. Images only (JPEG, PNG, GIF, WebP, AVIF, SVG), up to 10 MB.

Files you sell are the exception. They go to a separate private bucket that nobody can read directly. A buyer gets a signed link that expires — after 5 minutes for a paid file, an hour for a free one — and a paid file only once Stripe has confirmed the payment. Files up to 5 GB.

9. How long we keep things#

We publish real numbers because neither Linktree nor Stan Store publishes any retention periods at all.

10. Where data goes#

We are incorporated in Delaware, USA. Core account, page, contact, order and upload data is stored in the European Union — the database and file storage are in Frankfurt (AWS eu-central-1), files sold through a product sit in a private Amazon S3 bucket in the same region, error diagnostics are on our own server in Germany, and PostHog events go to its EU ingestion endpoint. Vercel serves requests through its global delivery network. Google Tag Manager is delivered through Google's infrastructure and can transfer the data handled by configured tags outside this core EU storage. Stripe processes payments on its own global infrastructure.

Supabase, Inc., Vercel Inc., Amazon Web Services, Resend, Inc., PostHog Inc. and Google LLC are US companies. Their staff or infrastructure may process data outside the EU for support, maintenance or delivery as described above.

Data is encrypted in transit, and the database is encrypted at rest.

11. Your rights#

You can ask us to access, correct, delete, restrict or object to our use of your personal data, to port it, or to withdraw consent where we relied on it.

Write to help@stick.so. We respond within 30 days, free of charge, and will tell you if a complex request needs longer. We may need to verify who you are.

If you are a Contact or a Buyer, send these to the creator whose page you used — they are the controller. We will help if you cannot reach them.

You can complain to your data protection authority: your national supervisory authority in the EU, or the ICO in the UK.

12. Children#

stick is not for anyone under 16, and you must be 16 to hold an account. We do not knowingly collect personal data from children under 16 — if you believe we have, write to help@stick.so and we will delete it. This single threshold applies everywhere.

13. Security#

Access to creator data is enforced at the database by row-level security, so one creator cannot read another's data even if the application has a bug. Traffic is encrypted in transit. Auth cookies are SameSite=Lax and host-scoped to the editor. Form submissions are validated server-side against the stored field schema, and contact writes happen only in server-side code — never directly from a visitor's browser. Analytics are built so the identifying inputs are never stored at all.

Card details never touch our servers — they are entered on Stripe's page. Files for sale sit in a private bucket and leave it only as short-lived signed links, and the download limit is enforced by the database.

No system is perfectly secure and we do not claim otherwise. Report vulnerabilities to help@stick.so — we will not pursue good-faith research.

14. Changes and contact#

If we change this policy in a way that materially affects you, we will email you and give notice in the product at least 30 days beforehand. Smaller corrections take effect when published.

Reach us at help@stick.so for anything — privacy and data requests, security reports, or general questions.