Privacy policy

The short version

• We collect what we need to run your account and your pages — nothing to sell or to advertise with.
• Visitors to your pages are counted without cookies and without storing who they are.
• No third-party trackers, ad networks or analytics scripts run on smoooch.bio.

If you have an account

We store:

• Account details: your email address, your name if you add one, and your password as a one-way hash (we cannot read it). If you sign in with Google, we receive your email address, name and Google account id.
• What you publish: pages, links, texts, images you upload, social links, themes and settings. Published pages are public by design.
• Team and workspace data: who is in which workspace and with which role, invitations, and an activity log of changes (who changed what and when).
• Billing: if you buy a plan, payment is handled by Stripe. We store your plan, its status and Stripe's customer and subscription ids — never your card details.
• Security data: session cookies and short-lived records needed to keep your account safe (for example password reset tokens, stored only as hashes).

Legal basis: performing our contract with you, and our legitimate interest in keeping the service secure.

If you visit a page on smoooch.bio

When someone views a page or taps a link, we count it. To tell how many different people visited on a day, we combine the IP address and browser identifier with a random value that changes every day, and keep only a one-way hash of the result. The daily value and the hashes are deleted when the day is over, so visits cannot be linked to a person or across days. We also keep aggregate counts of the referring site or app, the country (from the IP address, as provided by Cloudflare) and the device type. Only these totals are stored and shown to the page owner.

We do not set cookies for visitors, except one: if a page or link is marked 18+, a cookie remembers for the rest of your browser session that you confirmed your age.

Legal basis: our legitimate interest, and that of page owners, in knowing how pages are used, in a way that does not identify visitors.

Cookies

smoooch.bio only uses cookies that are strictly necessary: one to keep you signed in, one that protects forms against forgery, the 18+ confirmation above, and a short-lived one during Google sign-in. None are used for tracking or advertising, so there is no cookie banner.

Who else handles data

We use a small number of providers, each only for its task and under a data processing agreement:

• Hetzner Online GmbH (Germany) — the servers that run the service and store its data.
• Cloudflare, Inc. — network, security and delivery of all traffic to smoooch.bio.
• Resend (sending from the EU) — delivery of account emails such as password resets and invitations.
• Stripe — payments, if you buy a plan.
• Google — only if you choose to sign in with Google.

Some of these companies are based in the United States; transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. We never sell personal data.

How long we keep it

• Account and page data: for as long as your account exists. When you ask us to delete your account, we delete it and its pages; backups roll over within 30 days.
• Visitor hashes: until the end of the day. Aggregate statistics: as long as the page exists.
• Billing records: as long as accounting law requires.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Write to hello@smoooch.bio. You also have the right to complain to your data protection authority.

Security

Traffic is encrypted, passwords and tokens are stored as hashes, access inside workspaces follows roles, and the servers are not reachable directly from the internet. No system is perfect; if something goes wrong that affects you, we will tell you.

Children

smoooch.bio is not for children under 16. Pages marked 18+ ask visitors to confirm their age before continuing.

Changes

If we change this policy in a way that matters, we will tell account holders by email before it takes effect.