Privacy Policy

Effective October 8, 2026 · Updated October 27, 2026: HandleClub is now called Bounley, at bounley.com and bounley.me; nothing about what we collect or how we use it changed, and the preview cookie described before is gone (section 2). October 20, 2026: checking the spelling and grammar of an email you write, when you tap Check (sections 2, 4, 6 and 10). October 14, 2026: how you found Bounley, recorded once when you make your page (sections 2, 3, 6 and 11). October 13, 2026: a page’s view and click totals are visible only to its owner (section 2). October 12, 2026: how we help search engines find your page, through Google Search Console (sections 4 and 5). October 8, 2026: answers to forms on people’s pages, notifications about new answers, and view totals for forms and pages (sections 2 and 6). October 7, 2026: notifications you ask for, for a sign-up code or when your email goes live (sections 2, 4 and 6). October 6, 2026: email is only at your own domain, with no @bounley.com addresses (section 2). October 5, 2026: added the waitlist (sections 2, 3, 6, 7 and 8), named the providers that handle email correctly (section 4), and described confirming a waitlist address (sections 2 and 6)

1. Who we are

Bounley. For people in the European Economic Area and the United Kingdom, we are the “controller” of the personal information described here. Contact us about privacy at privacy@bounley.com.

2. What we collect

When you make an account

• Your email address and password. Passwords are handled and stored by Google Firebase Authentication; we never see them. If you tap Forgot password?, Firebase makes a one-time reset link and we email it to you through our email provider; the link works once, for an hour, and we don’t keep it.
• If you sign in with Google: your name and email address from your Google account. We use your name only to suggest a page name.
• An account ID that Firebase assigns.
• That you confirmed your age. We ask for your birth month and year once, to check that you are old enough to have an account. We keep only the result — that you confirmed you are 13 or older — not your birthday.
• That you agreed to our Terms, which version, and when.
• How you found Bounley. When you make your page, we record once how you arrived: the campaign tags in the link you followed, if it had any (such as utm_source or utm_campaign), the name of the website that sent you (just the site, such as google.com, never the full address), the first Bounley page you opened, and the Bounley page that sent you, if you came from someone’s page. Until you sign up, this is held only in that browser tab and is gone when you close it. We don’t use cookies or your IP address for it, it isn’t shown on your page, and only Bounley staff can see it. If your browser sends a Global Privacy Control signal, we don’t record it.

What you put on your page

Your display name, bio, photo, header image, links, the accounts and embeds you add, your theme and layout, your schedule, and anything you put on your business card (which can include an email address, phone number, company, location and time zone). Everything on your page is public.

When anyone visits Bounley or a page on it

• Totals of page views and link clicks, per page and per day, and a total of views for each form or page someone makes, so page owners can see their stats. Only the page’s owner can see them. These are counts only; they aren’t connected to any visitor. To count a reload only once, the address the view came from is used for about half an hour and then forgotten; it isn’t stored with the count.
• Anonymous visit statistics. We use Cloudflare Web Analytics to see how many people visit Bounley and its pages: which pages, from which countries and kinds of device, and which site sent them. It doesn’t use cookies or any storage on your device, doesn’t fingerprint your browser, doesn’t follow you to other sites, and gives us totals rather than a record of any one visitor.
• Technical information our hosting provider processes to deliver pages and protect the Service — such as IP address, browser type and the address requested. Cloudflare handles this under its own policies.
• IP address, briefly, to prevent abuse. A few features, such as finding a YouTube channel, are limited per IP address. Those limits live in a short-lived cache for about an hour and aren’t connected to any account.
• Storage on your device. We use your browser’s local and session storage to keep you signed in (through Firebase), to remember your age answer on that device, and to remember things like drafts and preferences. We don’t use advertising or tracking cookies.

If you connect your own domain

The domain name, and the DNS records needed to point it at your page. If you buy a domain through Bounley, we register it for you with our domain registrar, which also receives the registration details the domain system requires.

If you use Bounley email

The messages you send and receive at your own domain (senders, recipients, subject, content and attachments), stored so they appear in your inbox, and a monthly count of how many you have sent and received so we can apply the limits. To show a picture for the people who email you, our servers look up the sender’s public Gravatar (using a one-way hash of their address, never the address itself) or, for a work address, their company’s website icon; the result is cached for a day and nothing about you is sent. If you make an animated profile picture, we store it and it is public at your page’s address, like your photo. Deleting a message removes it and its stored original. Turning email off stops new mail; messages already received stay in your inbox until you delete them or your account.

If, while making a Google account for your address, you tap Send me the code as a notification, your browser gives us a push address for this device (an address at your browser maker’s push service, such as Google, Apple, Mozilla or Microsoft, with the keys to encrypt to it). When a sign-up code reaches your inbox, we send it to that address, encrypted so only your device can read it. We keep the push address for at most two hours, and remove it as soon as you leave that step or the push service says it no longer works. If you tap Notify me when it’s live while your email is being set up, we keep it the same way for up to two days, and use it once, to tell you your email works.

If you tap Check while writing an email, we send what you have written in that email (its subject and text, not your signature, the conversation or anything else) to LanguageTool to find spelling and grammar mistakes, and show you what it suggests. It happens only when you tap Check, never while you type. We don’t store what you wrote or the suggestions, and we don’t log them; nothing about your account goes with the text.

If you switch on Tell me when someone answers for your forms, we keep that device’s push address (up to five devices) until you switch it off, the push service says it no longer works, or you delete your account. Each notification says only that a form got a new answer and the form’s title, never what anyone wrote, and is encrypted so only your device can read it.

Things you ask us to fetch

When you import links from another link page, or ask us to fill in a photo or name from one of your public social profiles, we fetch that public page for you. Some networks refuse requests from our servers, so we may fetch the page or photo through a public fetching service (such as r.jina.ai, wsrv.nl or DuckDuckGo’s image proxy). They receive only the public address of that page or photo, never your account details. The photo is then stored with your page.

When you turn a link into a link card, our server visits that website once, when you ask, to read the title, preview picture and icon it publishes for sharing (it identifies itself as BounleyBot). We keep a copy of the picture and icon in your page, so people who view your page load them from Bounley and that website learns nothing about them unless they tap the card. We don’t keep anything else from the website.

If you answer a form on someone’s page

Pages on Bounley can have forms their owners make (contact forms, sign-up lists, RSVPs and the like). When you send one, we keep your answers, the time you sent them and the words of the box you ticked (so the owner can show what you agreed to), and show them only to the page’s owner. Each form says what the owner will use your answers for. The owner decides what the form asks and what they do with your answers, and is responsible for that (they are the “controller”); we store the answers for them (as their “processor”). Sign-up lists are only for people 16 or older, because they are consent to receive emails; every other form is for people 13 or older. We don’t keep your IP address with your answers (it is used briefly, about an hour, to stop floods of spam). The answers are kept until the owner deletes them, deletes the form, or deletes their account. To get your answers changed or deleted, ask the page’s owner, or email privacy@bounley.com and we’ll pass it on or delete them. Forms must not ask for passwords or payment details, so never enter those; if one does, report it.

If you join the waitlist

Your name, your email address, which of “creator”, “influencer”, “personal brand” or “other” describes you best, that you agreed to hear from us about the launch, the wording you agreed to, and when. We email you once to confirm the address, and keep whether and when you confirmed it. We don’t keep your IP address or anything about your device with it.

When you contact us

Your message and your email address. Some well-known names are held for the people and brands they belong to; if you ask us for one held for you, we note your sign-in email (or account ID) against that name so that only your account can claim it, and nobody else can see it.

3. How we use it

We use your information to run the Service — host your page, create its link-preview image and business card, show embeds and show you your stats; to keep accounts secure and prevent abuse; to enforce our Terms; to reply when you contact us; and to meet our legal obligations, such as reporting child sexual abuse material to NCMEC as federal law requires.

How you found Bounley is used only to understand which links, posts and websites bring people to Bounley, so we know where to spend our time.

For people in the EEA and UK, our legal bases are: performing our contract with you (running your account and page), our legitimate interests (security, preventing abuse, counting totals, understanding how people find us, improving the Service), and legal obligation (complying with the law).

The waitlist is used only to email you about Bounley’s launch and your place on the waitlist, and to understand, as totals, what kinds of people are waiting. Our legal basis is your consent, which you can withdraw at any time; withdrawing doesn’t affect anything we did before.

We don’t use your information for advertising, we don’t sell it, and we don’t make automated decisions about you that have legal or similarly significant effects.

4. Who we share it with

Service providers

These companies process information on our behalf so we can run Bounley:

• Google Firebase (Google LLC) — sign-in and our database.
• Cloudflare (Cloudflare, Inc.) — hosting, delivering pages, security, and anonymous visit statistics (Cloudflare Web Analytics).
• Amazon Web Services (Amazon Web Services, Inc.) — sending and receiving Bounley email (Amazon SES), including password-reset emails.
• Mailgun (Sinch Mailgun) — sending and receiving email for some mailboxes.
• LanguageTool (LanguageTool GmbH, Germany) — checking the spelling and grammar of an email you write, only when you tap Check. It receives that text only.
• Porkbun (Porkbun LLC) — registering domains bought through Bounley.
• Google Search Console (Google LLC) — getting public pages into Google Search. It receives page addresses and domain names only (see section 5).
• Your browser maker’s push service (Google, Apple, Mozilla or Microsoft, whichever your browser uses) — delivering a notification you asked for. It carries the message encrypted and cannot read it.

Fonts, platform icons and the code that draws QR codes are served from our own servers, so no font, icon or code provider receives any information about visitors.

Content page owners add

Embeds a page owner adds — such as Twitch, YouTube (in its privacy-enhanced mode), Spotify, SoundCloud or X — load directly from those companies when someone views the page. They may set cookies and collect information under their own privacy policies. For visitors in Europe, an embed loads only once they tap it. To show a creator’s latest post or videos, our servers ask those services for public content; we don’t send them anything about visitors. A picture a page owner brings in from another platform, such as a banner, may load from that platform’s servers when someone views the page.

When the law requires it, or to keep people safe

We disclose information when we believe we are legally required to — for example by a subpoena or court order — and we report child sexual abuse material to NCMEC as federal law requires. We may also disclose information to protect someone’s safety, or to protect our rights or the Service.

If the business changes hands

If Bounley is merged, acquired or sold, your information may move with it. We will tell you before it becomes subject to a different privacy policy.

We don’t sell personal information, we don’t “share” it for cross-context behavioural advertising, and we don’t use it for targeted advertising, as those terms are defined in US state privacy laws.

5. Your page is public

Anyone can see, copy or save what is on your page, and search engines may list it. “Hide from search engines” asks them not to, but it can’t make them. Only put things on your page, including your business card, that you are happy for anyone to see.

Helping search engines find your page. When your page has something on it, we tell search engines where it is: Google through Google Search Console, where our account registers bounley.me and any domain you connect to your page and submits its sitemap, and Bing and others through IndexNow. They receive the page’s public address and domain, nothing private. Google tells us whether your page is in its results, when it last visited, and how often it was shown and clicked in Google Search (totals, not who searched); we show you whether it’s listed in your dashboard. A page hidden from search engines is never submitted. When you disconnect a domain, or it stops showing your page for 14 days, we remove it from our Search Console account.

Discover. When you agree to our Terms, your page is listed in Discover, Bounley’s directory of pages: its name, photo, bio and link, and whether it has the verified check. If you tell us you’re under 18, it isn’t listed unless you turn Discover on yourself (we keep only that choice, never your birthday). We record that you agreed and when, and if you leave Discover, we remember that so you aren’t listed again. You can leave Discover at any time (More → Discover), and you are removed straight away; deleting your account removes you too. Pages hidden from search engines or with a content warning are never listed.

6. How long we keep it

• Your account and page: until you delete your account. Deleting it removes your page, preview image, card, stats and login from our live database straight away. Copies can take up to 30 days to clear from our providers’ backups and caches.
• How you found Bounley: until you delete your account, when it is deleted with it.
• Email: until you delete a message or your account. The stored original of a message (kept so its attachments can be downloaded) is deleted when you delete the message.
• An email you ask us to check for spelling and grammar: not kept by us; it is passed to LanguageTool and the suggestions come straight back to you.
• Cached copies of public pages at Cloudflare usually expire within minutes.
• Answers to a form on someone’s page: until the page’s owner deletes them, the form, or their account.
• A push address for a notification you asked for: two hours for a sign-up code, up to two days for “your email is live”, and removed once it’s used; for new answers to your forms, until you switch it off or delete your account.
• Abuse-prevention limits: about an hour.
• The waitlist: until you leave it, or 12 months after Bounley launches publicly, whichever comes first. An address that isn’t confirmed within 30 days of the confirmation email is deleted then. If you make an account, your waitlist entry is deleted when you leave the waitlist or after that period, separately from the account.
• Emails you send us: as long as we need them to deal with your message and any follow-up.
• When the law requires us to keep something — for example, federal law requires material reported to NCMEC to be preserved for one year — we keep it for as long as required.

Copies other people make, such as screenshots or copies saved by search engines, are outside our control.

7. Your choices and rights

Everyone

• Change or remove anything on your page at any time from your dashboard.
• Download a copy of your page: Link & privacy → Download a copy.
• Delete your account: Link & privacy → Delete my account.
• Leave the waitlist: use the unsubscribe link in any email we send you, or email privacy@bounley.com from the address you signed up with, and we delete your entry.
• Or email privacy@bounley.com and we will help.

If you are in the EEA, UK or Switzerland

You have the right to access, correct, delete, restrict or object to our use of your personal information, and to receive it in a portable format. You can also complain to your local data protection authority.

If you are in a US state with a privacy law

Depending on where you live — for example California, Virginia, Colorado, Connecticut, Texas or Oregon — you may have the right to know what personal information we have about you, to get a copy, to correct it, to delete it, and to opt out of its sale, sharing or use for targeted advertising (which we don’t do). We won’t treat you differently for using these rights. You can make a request yourself, or through an authorised agent, by emailing privacy@bounley.com. We verify requests using the email address on the account. If we turn down a request, you can appeal by replying with “Appeal” in the subject line.

We respond within 30 days, or tell you if we need more time where the law allows it.

8. Children

Bounley is not for children under 13, and we don’t knowingly collect personal information from them. We ask for a birthday before anyone can create an account, and we don’t let anyone under 13 sign up. The waitlist is also only for people 13 or older. If we learn that we have collected personal information from a child under 13, we delete it and the account. If you are a parent or guardian and think your child under 13 has an account, email privacy@bounley.com and we will delete it.

People aged 13 to 17 need a parent or guardian’s permission to use Bounley. They can remove anything they have posted, or delete their whole account, at any time from their dashboard — or email us and we will do it for them.

9. Security

Every page is served over HTTPS. Passwords are handled by Firebase Authentication, and access to our database is controlled by security rules. No system is perfectly secure, but if a breach affects your information we will tell you as the law requires. To report a security problem, email security@bounley.com.

10. International transfers

Most of our providers are based in the United States (LanguageTool is in Germany) and process information there and in other countries. When information about people in the EEA or UK is transferred, we rely on our providers’ safeguards, such as the EU Standard Contractual Clauses and the EU–US Data Privacy Framework where it applies.

11. Do Not Track and Global Privacy Control

We don’t track visitors across other websites, and we don’t sell or share personal information, so there is nothing for these signals to switch off. We still treat a Global Privacy Control signal as a valid request to opt out, and when your browser sends one we don’t record how you found Bounley.

12. Changes to this policy

When we change this policy we will post the new version here with a new effective date. If a change matters, we will tell you before it applies.

13. Contact

Email privacy@bounley.com.