Version 2026-09-05 · In effect from 2026-09-05

Privacy notice for Links

Last updated: 5 September 2026

Links counts the days you spend in each country, so you can answer questions about tax residency and the Schengen 90/180 rule. Counting your days means handling information about where you have been, and this notice explains exactly what we do with it.

This is not a contract and there is nothing here for you to agree to. It is a description of what happens to your data, given to you because the law says you are entitled to it — and because you should not have to guess.

1. Who we are, and how to reach us

Links is made by Leafbit Limited, a company registered in England and Wales. Leafbit is the data controller: we decide what data the app handles and why.

• Registered company number: 16583520
• Registered office: 8-10 South Street, Epsom, Surrey, KT18 7PF, United Kingdom

Write to us about anything in this notice — including any of your rights in section 7 — at privacy@leafbit.uk. A person reads that address. You do not need to use any particular form of words.

If you are in the EU or EEA: we have not appointed a representative under Article 27 of the EU GDPR. We would rather tell you that than leave a gap you cannot see. Write to us at privacy@leafbit.uk — the same address, read by the same person — and you can complain to your own national supervisory authority at any time, as section 7 explains.

2. What Links collects

What stays on your phone

Your exact location never reaches us. This is the most important thing in this notice, so here is the whole sequence.

Every few hours — every four by default, and you can change or stop it — your phone records a single location reading. That reading is a latitude and longitude, and it is written to a small queue on your phone. The app sends it to Apple's geocoder, turns the answer into a country, writes the check-in down and then deletes the coordinates. They are on your phone for the length of that round trip and no longer — and if the deletion ever fails, the seven-day sweep below catches them. What remains is a check-in: a country code, a timestamp, and a time zone. Nothing finer.

If the reading cannot be turned into a country straight away — you are offline, or the geocoder is busy — the coordinates wait in the queue until the app tries again. Any that have been sitting there for more than seven days are retried once and then deleted. That deletion is not a timer: it runs when you next open the app while signed in. A phone left in a drawer keeps its queued coordinates until it is opened again.

We never see the coordinates. They are not synced, not backed up by us, and not stored anywhere we can reach.

Apple does see them. Turning a coordinate into a country uses Apple's geocoding service, which is a network service: your phone sends the coordinate to Apple and Apple sends back the country. That is how it works on every iPhone app that does this, and it is why the app cannot work out your country while you have no signal. Apple handles that request under its own privacy policy, not ours.

Also kept only on your phone: your sign-in state, and the identifiers of accounts that have signed in on that device. Your app settings are not on that list — they sync, and they are described below.

What reaches our servers

If you sign in, your data syncs so you do not lose it when you change or lose your phone. What we hold is:

• Your stays. The country, the arrival and departure dates, the time zone, whether the stay came from your phone's readings or you entered it yourself, whether it was a layover, whether you pinned the dates, and the note the app has attached to that stay, if it has one. There is no free-text box anywhere in your travel record: countries are picked from a list and dates from a calendar. The only free text Links stores is the name you can type in Settings and the email address you sign in with. The notes field holds one of three fixed sentences the app writes about itself — that it filled a gap between two stays in the same country, that it retired such a fill, or that a gap could not be resolved and is being counted at the worst case — or nothing at all. It is stored and synced like every other field, and if you have used an older build of Links it may still carry a value that build put there.
• Your check-ins. A country code, a timestamp and a time zone, roughly six a day at the default frequency. No coordinates.
• Your profile. Your name, your home country, your nationality and any additional passports, and your counting settings and limits. Your date of birth is currently stored here too — see the note in section 6.
• Your account. Your email address, or your Google account identity if you sign in with Google.

One honest detail about deleting:

• Deleting a trip hides it, but does not yet erase it. When you delete a stay, the app marks it deleted and it disappears from every device. The underlying record — its country, its dates and whatever is in its notes field — currently remains in our database until you delete your whole account. We consider this wrong and we are changing it; until we do, deleting your account is the only way to remove a deleted trip's contents. When we fix it, a deleted trip's contents will be erased within 30 days of you deleting it, rather than waiting for the account to go.

Links has no analytics, no crash reporting, no advertising and no tracking of any kind. There is no measurement SDK in the app. We do not know how often you open it, what you tap, or which screens you look at. We do not build a profile of you, we do not sell anything to anyone, and we do not share your data with advertisers.

3. Why we do it, and our lawful basis

We do not make any automated decisions about you that have legal or similarly significant effects. The app's counts and warnings are calculations shown to you; nothing decides anything on your behalf.

We do not ask you to consent to the counting itself, because the ICO's guidance is that where processing is genuinely necessary to deliver what you asked for, consent is the wrong basis to claim. You can stop background tracking at any time — see section 7.

Giving us a name, a date of birth or a nationality is optional and the app works without them. The date of birth is the odd one out: it has no row in the table above because it serves no purpose we can state, which is exactly why we are removing it (section 6).

4. Who else sees it

Google — our processor. Google runs the database and the sign-in system behind Links (Firebase). Google stores your data on our instructions and under a data processing agreement; it is not permitted to use it for its own purposes. The agreement is Google's Cloud Data Processing Addendum, which covers the Firebase services Links uses.

Apple — geocoding. As described above, Apple's servers receive a coordinate each time your phone needs to know which country it is in. Apple answers that request under its own privacy policy rather than on our instructions, so for geocoding Apple is not our processor. The request comes from your phone rather than from us: we never see the coordinate, and nothing identifying your account is attached to it.

Google — as your sign-in provider. If you choose "Sign in with Google", Google knows you have signed in to Links, in its own right as your identity provider.

Expo. The app checks for software updates on each launch. That request goes to Expo's update service, which sees your device's IP address and which version of the app you are running. It carries none of your travel data.

Cloudflare — where this notice lives. This notice and our terms are published at links.leafbit.uk, which Cloudflare serves. Cloudflare sees the IP address behind each request and which page it asked for, so reading this page sends Cloudflare your IP address. The request also carries your browser or device's user agent and the address you asked for. We switch on Cloudflare's request logging for the version endpoint, so we keep a short log line for those calls too. The app is also being built to ask that same address whether either document has changed; once that ships, each of those checks will send an IP address and the app version. No travel data goes there either way. That in-app check has not shipped yet, so as things stand this paragraph describes the hosting of these two pages and nothing more.

Nobody else. No analytics company, no crash reporting service, no advertiser, no data broker. We do not sell or rent your data, ever.

We would disclose data if the law compelled us to, and we would tell you unless we were forbidden to.

What Google can see, even though it cannot read the meaning of your travel

We do not use end-to-end encryption, and we will not claim otherwise. Your data is encrypted in transit, and encrypted at rest with keys Google holds — which means Google could technically read it, and so, in principle, could we. Being specific is more useful than being vague, so:

• Your email address and, if you use Google sign-in, your Google account identity.
• Your user ID, which labels every record you have.
• How many records you have — how many trips, how many check-ins. A count of check-ins is roughly a measure of how long you have used the app.
• When each record last changed, to the second, because Google's servers stamp that.
• Your IP address at the moment you sync, which is an approximate location in its own right, held by Google for abuse prevention. Google's published position is that Firebase Authentication keeps logged IP addresses for a few weeks.
• The contents of your stays and check-ins: countries, dates, time zones, and the app's own notes about gaps.

Two things it does not see, because they never leave your phone: your coordinates, and any finer-grained place than a country. Links has no concept of a city, an address or a venue, and we do not intend to add one.

5. Where your data is stored

• Your travel data — stays, check-ins and your profile — is stored in Europe, in Google's London region (europe-west2). We have checked that against the live database rather than assuming it, and a Firestore location is fixed when the database is created: it cannot drift without somebody building a new one.
• Your account credentials are processed in the United States. Firebase Authentication holds your email address, your password hash and your sign-in history. If you sign in with Google it also holds the display name and profile picture on your Google account, which Google writes there when it issues the sign-in — we do not put them there, but they are there, and the app reads that name to greet you. So for Google sign-in the US record holds a name. What we ask you for in the app — your date of birth, your nationality, your home country — is never copied into it; that stays in the European database above. Google's own documentation is explicit that Firebase Authentication runs only from US data centres and processes data exclusively in the United States. There is no European option for us to switch on: Authentication is not one of the Firebase services that offer a choice of data location.

That transfer relies on the UK Extension to the EU–US Data Privacy Framework — a finding by the UK government that data sent to a US company on that framework's list gets a level of protection it accepts as adequate. Google LLC holds a certification under that extension, which we checked on the framework's own list before publishing this; its present period runs to 13 September 2026 and is renewed annually. Our contract with Google is its Cloud Data Processing Addendum, which covers both Firestore and Authentication and lets Google adopt an approved transfer mechanism of this kind. If the certification lapses, the transfer falls back to the standard contractual clauses and UK Addendum in that same addendum, and this section will say so.

Two smaller US transfers, for completeness. Expo receives your device's IP address and app version when the app checks for an update, and Cloudflare receives an IP address when you read these pages — both under the same kind of framework or contractual terms, and neither carries any travel data.

6. How long we keep it

• Coordinates: deleted the moment they become a country. Any that never geocode are deleted the next time you open the app, signed in, more than seven days later.
• Your account and stays: kept while your account exists, and deleted when you delete it (see section 7).
• Check-ins: seven years, counted from the date of each check-in. They are the evidence your day counts are derived from, and the bound is the one your records are actually for: Schengen counting needs 180 days plus margin, and tax record-keeping windows across the UK and EU run to about six or seven years. We will also give you a setting to shorten it. This is not yet enforced automatically — today it is a commitment rather than a mechanism, and we would rather write it down and be held to it than leave the question open.
• Deleted trips: see the note in section 2 — currently retained until account deletion.
• Your date of birth: the app currently offers a date-of-birth field in Settings and syncs it, but nothing in the app uses it. It should not be collected if it is not used, and we are removing it. It is not an age check, we do not use it as one, and we have no plan to.

7. Your rights

You can exercise any of these by emailing privacy@leafbit.uk. It is free, and we will reply within one month. Where the app can already do it for you, we have said so.

1. To be informed — what this notice is for.
2. To get a copy of your data (access). Ask us and we will send you everything we hold.
3. To correct it (rectification). You can edit any stay — its dates and its country — in the app yourself. For anything you cannot reach, ask us.
4. To have it deleted (erasure). Settings → Delete account works in a fixed order, and it is worth knowing the order because it decides what you are left with if a step fails. Your stays and your check-ins go first, and we ask the server to confirm those are really gone. Your profile record — your settings, and the details you entered about yourself — is deleted immediately afterwards, with no confirming check of its own. Only then is your sign-in account deleted, and only then is the copy on your phone wiped. If deleting your sign-in account fails — for security, it sometimes requires you to have signed in recently, and the app will tell you so — your synced data has already been deleted, while your account and the copy on your phone are still there. Sign in again and repeat the deletion to finish it. A failed deletion also leaves background tracking switched off: the app stops recording before it starts deleting and does not start again by itself, so until you turn it back on in Settings, Links only checks in while it is open, with a "Tracking is off" banner on Today meanwhile. The synced data becomes inaccessible the moment it is deleted. Google then clears the residual copies on its own published schedule: roughly two months for its active systems, and within six months — 180 days — for its backups. You can also delete individual trips in the app, subject to the limitation described in section 2.
5. To restrict what we do with it. Ask us to pause processing while a dispute about accuracy or lawfulness is sorted out.
6. To take it with you (portability). You can export a CSV report from the app today, but we will be straight with you: that report is a per-country summary we calculated, not the underlying data, and a summary is not what this right is about. A full export — every stay, every check-in, your settings — does not exist yet. Until it does, email us and we will produce one by hand, inside the same one month that applies to every other request in this section.
7. To object. You can object to processing we do under legitimate interests. You can also stop background tracking outright at any time: Settings → Location tracking, or iOS Settings → Privacy → Location Services. The app keeps working; you add stays by hand instead. Turning it off must be as easy as turning it on, and it is one tap.
8. Rights about automated decisions and profiling. We do not make automated decisions with legal or similarly significant effects, so there is nothing here to object to — but if that ever changes, this notice changes first.

You can also withdraw permission for location access and for notifications at any time in iOS Settings, without affecting anything we did before you withdrew it.

Complaints. If you are unhappy with how we have handled your data, tell us first at privacy@leafbit.uk — we will acknowledge within 30 days and tell you the outcome. You do not have to come to us first, and you can complain to the UK's Information Commissioner's Office at any time:

• Online, at https://ico.org.uk/make-a-complaint/
• By telephone, on 0303 123 1113, Monday to Friday between 9am and 5pm excluding bank holidays. If you use a textphone, dial 18001 followed by that number.
• By post, at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are in the EU or EEA, you can complain to your own national data protection authority instead.

8. Children

Links is for adults. It is not designed for, or directed at, anyone under 18, and you should not use it or create an account if you are under 18. If you believe someone under 18 has an account, email privacy@leafbit.uk and we will delete it.

9. When this notice changes

We will keep this notice matching what the app actually does. When something material changes — a new recipient, a new purpose, a retention period we have finally settled — we will update the date at the top. We intend to tell you in the app before or when the change takes effect rather than leaving you to find it, but that in-app notice has not shipped yet: until it does, the version published here is the record. Older versions are available on request.