Privacy policy

Controller

The controller for the processing of personal data on 2link.ch, in the 2link application and on 2link.link is:

Scope

This policy covers the 2link.ch website, the 2link application after sign-in, and the redirects on 2link.link.

Visiting 2link.ch

The marketing pages set no cookies and load no third-party content. There are no advertising trackers and no analytics services. When a page is requested, our web server logs technical details including the IP address, the time, the requested address and the browser type. These logs serve operation and security.

Log retention period:

Details to follow

Account and sign-in

For an account we process your first and last name, e-mail address, account name and, if given, your company. The password is stored only as an Argon2id hash, never in clear text.

The application sets only strictly necessary cookies:

2l_session

Keeps you signed in.

2l_session_renewed

Records that the session was renewed recently.

2l_presession

Protects the sign-in form against abuse.

2l_presession_register

Protects the registration form against abuse.

2l_presession_auth

Protects the remaining account forms against abuse.

2l_check_mail

Shows the check-your-mail notice after registration.

2l_forgot_check_mail

Shows the check-your-mail notice after a reset request.

2l_verify_token

Receives the verification code from the e-mail so it does not sit in the address bar.

2l_reset_token

Receives the password-reset code so it does not sit in the address bar.

2l_invite_token

Receives the invitation code from the e-mail so it does not sit in the address bar.

2l_locale

Remembers the language chosen for the application.

2l_deletion_cancel_token

Receives the code for cancelling an account deletion from the e-mail so it does not sit in the address bar.

2l_draft

Keeps your draft for 24 hours until you activate it with an account. We store the destination address in Switzerland and no IP address.

Opening short links and QR codes

2link.link sets no cookies, performs no fingerprinting and stores no full IP addresses. When a link is opened we record the time, the referring page, the device type, the browser and the operating system. We collect no location data.

Detailed click data is kept for 30 days or 12 months, depending on the plan. The total number of clicks per link is kept permanently.

Destination checks

To protect against malware and phishing, we send destination addresses to Google Web Risk. This means those addresses reach a recipient outside Switzerland (Art. 19 para. 4 FADP).

Wording confirmed by the operator:

Details to follow

E-mail

We send transactional e-mail only: address verification, password resets and invitations. It is sent over SMTP. We send no marketing e-mail.

SMTP provider:

Details to follow

Payment

For paid plans we work with Stripe as our payment processor. Stripe is the one exception to our Swiss storage location: you enter your card details directly on Stripe’s own checkout page, they never reach our servers, and we store no card data at all — not the card number, not the verification code, the expiry date, the name on the card or the last digits. From Stripe we receive back only identifiers and the status of the subscription.

Your links, QR codes, click data and logs remain stored in Switzerland, unchanged.

Where data is stored

Accounts, links, click data and application logs are stored in Switzerland.

Hosting provider:

Details to follow

Your rights

You have the right to access the data processed about you, and to have it corrected or deleted. To exercise these rights, contact the controller named above.

Changes

We update this policy when the processing changes. The version bearing the date above is the current one.