Security and privacy
Common questions about what LinkACode keeps, what it never sees, and how it protects the addresses behind your codes. The full detail is in the privacy policy.
Is LinkACode secure?
It is built to hold as little as possible, and to protect what it does hold. The address behind a code is encrypted (AES-256) before it is stored, with a key that is not kept in the database. The site is only served over an encrypted connection. Passwords are never stored, only a slow, salted hash of them, and you can turn on two-step sign-in with an authenticator app. The site loads no scripts, fonts or trackers from anywhere else.
Can I email you my DNS or server address?
No, never. Do not send us your DNS, server address, URL, username or password, by email or any other way, not even in a screenshot. We will never ask for it, and any email that contains one is deleted without being acted on. Enter or change the address yourself on the code's page in your account: it is free, at any time, and it is encrypted before it is stored. An email is not: it sits readable in your sent mail, our inbox and the servers in between, and it cannot be called back.
What does LinkACode keep about me?
Your email address, a hash of your password, your codes, the addresses you point them at, and your orders. That is all an account is. You pay on the card processor's own page (SumUp), so your card details never reach us.
What does it record about the people who use my codes?
A daily total per code, so you can see it is being used, and nothing else. There is no log of who looked a code up or when, so we cannot tell you or anyone else. To stop people guessing codes, wrong guesses are limited using a hashed form of the address they come from, never the address itself.
Can LinkACode see my username, password or anything I play?
No. A code stands for a server address (a host, and a port if it has one) and nothing else. The username and password go from the app straight to the server, never to us, and nothing you play passes through LinkACode.
Who can look up the address behind a code?
Only apps we have approved for access, such as Vizi Player, which uses the address to connect and never shows it. A code that is mistyped, switched off or expired gets exactly the same answer as one that never existed, and repeated wrong guesses are blocked. The address is private rather than secret: the device still connects to it, so someone technically skilled could find it by inspecting their own device's network traffic.
What if someone got hold of a copy of your database?
They would not see anybody's server address: addresses are encrypted, and the key is not in the database. Passwords are stored only as slow, salted hashes, and sign-in sessions only as hashes, not as anything that can be used to sign in directly.
Do you track visitors or sell data?
No. There is no analytics or tracking script on this site, no advertising, and we sell no data. Cloudflare hosts the service, Resend delivers our email and SumUp takes card payments.
How do I see or delete what you hold about me?
Your account page shows everything we hold about you, and lets you change it or close the account, which deletes it. For anything else, email support@linkacode.com, without any server address in it.
Whose server can a code point at?
Yours, or one you are authorised to use. A code is a shortcut to an address you already have the right to connect to. It does not come with content, and it does not give you access to anything you could not already reach.
How do I report a security problem?
Email support@linkacode.com with "security" in the subject, and please give us a reasonable chance to fix it before publishing. We will not threaten you for telling us. Leave out any server address of your own.