1. Account data
When you create an xfinlink account, we collect your email address and store a securely hashed password. If you sign in via Google or GitHub, we receive the profile information those providers share (typically your name and email). This data is used for authentication, account management, emails about your account and plan, and analytics (see section 3). We do not sell it. Service providers process it on our behalf (see section 4).
Our affiliate program runs on Rewardful. If you accept referral attribution (see section 3) and register or sign in after following an affiliate link, and your account has never paid, we save the Rewardful referral ID to your account and add it to your Stripe customer record. A Stripe customer record may be created at sign-in for this purpose. Rewardful uses it to attribute eligible subscription payments to the affiliate. Affiliates see sale descriptions and anonymous customer references in Rewardful, never customer email addresses. Affiliate payouts are sent through Wise, which receives the affiliate's payout email address.
2. What we log
Each API request records the time, endpoint, tickers, fields, status, response time, rows returned, cache status, an identifier derived from the IP address with SHA-256, and a hash of the API key, which links the request to the account. Failed requests also record the query string, method, error detail and user agent. The IP address itself is not stored.
These logs are used for enforcing rate limits, showing each account its own usage, detecting abuse, diagnosing errors and understanding usage patterns (e.g., which endpoints are most popular).
3. Cookies and tracking
Use to accept, reject or change optional cookies and browser storage. Analytics, referral attribution and advertising are off until you choose them. Essential storage supports the functions and security you request.
| Purpose and provider | Storage | Duration |
|---|---|---|
| Essential — Xfinlink cookie preferences | xfl_consent_v1, local storage | 180 days from your choice, then we ask again |
| Essential — Supabase sign-in | sb-auth-auth-token, local storage | Until sign-out, session expiry or browser deletion; the session may refresh while you remain signed in |
| Essential — Cloudflare Turnstile | Security checks used during signup, login and password reset | For the security check; any provider security cookies follow Cloudflare’s settings |
| Essential — Xfinlink interface preferences | xfl-docs-lang, xfl-docs-nav and account-scoped xfl_plan, local storage | Until replaced or cleared in your browser |
| Essential — Xfinlink visit state | Session storage, including dashboard welcome state | Until the tab closes |
| Essential — Xfinlink free-lookup limits | xfl_lk cookie; xfl_lk_used local storage | The cookie lasts one year; the used-up flag applies to the current UTC day |
| Referral attribution — Rewardful | rewardful.referral cookie, set by Rewardful after an affiliate link click. A copy of the referral ID in xfl_rewardful_referral, local storage | The cookie lasts for the referral period of the affiliate campaign. The local copy is removed after sign-in sends it to Xfinlink, or on a later visit once the cookie has expired. Both are cleared when referral attribution consent is withdrawn or expires |
| Analytics — PostHog | ph_*_posthog cookies and local storage; __ph_* consent state | Provider cookies can last up to 365 days. We stop collection and clear accessible optional identifiers when you withdraw consent or your choice expires |
| Advertising — Xfinlink campaign attribution | utm_source, utm_medium, utm_campaign, xfl_ad_click and xfl_vid, local storage | Until your choice is withdrawn or expires, the values are replaced, or your browser clears them |
| Advertising — Reddit Pixel | Reddit first-party identifiers, including _rdt_uuid and, after an ad click, _rdt_cid | Provider expiry, generally up to 90 days; accessible identifiers are cleared when advertising consent is withdrawn |
Consented PostHog analytics includes page views, clicks and session replay, with form inputs masked. Consented advertising attribution can associate campaign details and a browser identifier with a signup and eligible conversion. The Reddit Pixel measures visits and advertising performance; Reddit may use the information for advertising personalisation under its Privacy Policy. Optional scripts do not run on authentication pages, customer or affiliate financial dashboards, or owner-management pages.
A customer who enters an affiliate's promotion code in Stripe Checkout has that purchase attributed to the affiliate. This works without referral cookies, because Rewardful reads the code from Stripe. Once a valid referral is saved to an account, a later payment does not depend on the browser cookie. Withdrawing cookie consent clears optional browser tracking; it does not erase legitimate account, referral or financial records already saved. Those records follow the retention rules below.
Browsers may block storage or delete it sooner. You can also clear it through your browser. Free lookups additionally use a one-way hash of the network address to enforce the daily limit; that count is deleted at the end of the UTC day.
4. No data sales
We do not sell or rent personal data, including logged data.
These service providers process personal data to run xfinlink:
- Supabase (accounts, sign-in and the database)
- Stripe (payments)
- Cloudflare (hosting, security, Turnstile, and the cdnjs code library on blog posts)
- Resend (email)
- PostHog (analytics)
- Rewardful (affiliate program and referral attribution)
- Wise (affiliate payouts)
- Reddit (ad measurement)
- Google Ads (ad measurement)
- Google and GitHub (optional sign-in)
- unpkg (serves the Supabase sign-in library)
5. Data retention
Raw API request logs are aggregated after 30 days into anonymous summary statistics (e.g., daily request counts per endpoint). The raw log entries are then deleted. Aggregated statistics contain no IP hashes or other identifiers.
A Rewardful referral ID saved to an account is deleted when the account is deleted. The copy in the Stripe customer record and Rewardful's own referral and commission records are kept by those service providers (see section 4). Affiliate accounting records are retained for at least 24 months after the final commission payment, and longer where needed to meet legal accounting requirements or resolve a dispute. Deleting a customer account does not erase the related financial history; we separate it from the deleted account where possible.
6. GDPR compliance
xfinlink is designed to be GDPR-compliant by default. We minimize data collection. The request log keeps an identifier derived from the IP address, not the IP address itself. If you believe any data we hold relates to you and wish to exercise your rights under GDPR, contact us and we will address your request.
7. Changes to this policy
We may update this policy as our practices evolve. Changes will be reflected on this page with an updated date.
8. Contact
Privacy questions? Email hello@xfinlink.com.