What a link page costs you.

When someone taps your link they didn't agree to anything. They have no account and no way to object. On most link services their visit is still announced to companies they've never heard of.

Their own privacy policy is direct about the purpose:

Worth saying plainly: bio.link came out considerably cleaner than the other two, Linktree's hosts include a consent platform, and link.me's policy says its site honours Global Privacy Control signals automatically. The point isn't that everyone is equally careless. It's that the number can be zero, and mostly it isn't.

We checked this ourselves rather than taking anyone's word for it. On 10 August 2026, link.me/security resolved to an ordinary member profile belonging to a user named Riley. Not a company page. A person who registered the word “security”.

The address bar is the one safety check ordinary people are taught to read. If anyone can be /security, that lesson quietly starts teaching the wrong thing — and nobody has to be hacked for someone to get hurt.

On orion.directory, 79 handles a visitor would reasonably read as the company speaking cannot be claimed by anyone. That list is enforced by a test that fails our build if it ever shrinks. Writing it caught two we had missed.

Their terms are unambiguous about how an account can end:

A correction worth making. We previously described this as coming with no way to get your data back. Reading the documents ourselves, that was too strong: link.me operates a privacy-request form that includes Request Data Portability among its options. It is a form with identity verification rather than a self-serve download, and the Terms themselves promise nothing about it — but it exists, and saying otherwise would have been unfair.

Here, one button in Settings returns your profile, every link in order, and your full analytics history as a single file. No form, no queue, no verification wait. A page you can't take with you was never quite yours.

This is the sentence to know about. It sits in the User Accounts section, after the ordinary business about passwords:

Read it twice. Not the company's data about you — your fans'names, email addresses and social handles, for the company's own purposes. The people that covers never signed anything. You agreed on their behalf.

For balance: the same document also takes a licence over your posted content, and that one is normal — it is scoped “on and through the Service”, which is simply what any platform needs in order to display your page. The fan-data sentence is the unusual one.

We don't collect that. Our analytics tables have no column that could identify a visitor — no IP address, no browser fingerprint, no visitor ID, no email. What's stored is a page, a timestamp, a referring domain like instagram.com, a country code, and whether the device was a phone. That's the whole list. To be precise: a visitor's IP is used in memory for a moment to rate-limit abuse, and is never written down.

We have no third-party security audit, no published retention schedule (analytics currently accumulate with no expiry job), no vulnerability-disclosure contact, and no two-factor sign-in — the login is a single-factor emailed link.

The honest version of this page says that rather than hoping you don't check. Every figure above is reproducible in a fresh browser, and every quote links to the document it came from.