← Back to LinkITLegal

ApeXhit LinkIT — Privacy Policy

Effective Date: January 1, 2026 · Last Updated: July 24, 2026 (v2.0 — complete rewrite: adds two-factor authentication data, public share links and view counts, share bookmarking, and the server-side Word/.docx export step)

ApeXhit LLC ("ApeXhit," "we," "us") respects your privacy. This Privacy Policy explains what data LinkIT collects, where it's stored, who else (if anyone) ever sees it, and your choices. We wrote this to be genuinely readable, not just legally defensible — if anything here is unclear, email us.

1. Summary (Plain Language)

  • You can use LinkIT as a

    Guest

    with zero signup — in that mode, your pages, categories, links, Sticky Notes, and Journals are stored only on your own device, and nothing about your usage or content is ever sent to or stored on our servers.
  • Signing up (Google Sign-In or email/password) creates a real account: we store your email, name, hashed password and/or PIN (never in plain text), your two-factor authentication status and secret (if you enable it), role, and license tier in our database.
  • On the free Lite tier, your User Content (pages, notes, journals) still stays local-only, same as Guest mode — only your account/license record lives in our database.
  • On Pro tier and above, your group's User Content is also stored in a database we operate (currently hosted on Neon/PostgreSQL) so it stays in sync across your devices and group members — this is in addition to, not instead of, any optional Google Drive backup you separately enable.
  • We do not sell your personal data, and we do not read the content of your links, notes, or journals ourselves for any purpose other than providing the sync feature you enabled.
  • If you generate a public share link, anyone who has that link can view the shared content without signing in — that's the intended design of that feature, so only share what you're comfortable making publicly viewable, and revoke a link once you no longer need it.
  • If you enable Google Drive sync, your data is sent directly between your browser/device and your own Google Drive account using a narrow, app-restricted Google API scope — we do not separately copy or retain that content on ApeXhit servers.
  • If you use an AI-powered feature (image text extraction/"OCR", voice/speech transcription, or the Translate tool), the specific image, audio clip, or text you submit for that action is sent to our AI processing provider (Google Gemini) to generate the result and is not stored by us afterward.
  • If you export a note, sheet, or drawing as a Word document (.docx), the content you're exporting is sent briefly to our own server to generate that file and is not stored afterward.
  • For Guest/Lite accounts, the biggest realistic risk to your data is local (a compromised or shared device, or importing a backup file from a source you don't trust); for Pro-and-above accounts, your synced content is also protected by our database access controls — see Section 9 (Security) for specifics and how to protect yourself.
  • We collect minimal technical/usage data to keep the app running and improve it.

2. What We Collect

A. Data you create (User Content)

— stored locally in your browser, primarily in IndexedDB (with a few small preference values, like your active page, theme, or writing-mode formatting choices, in localStorage): pages, categories, links (URLs + custom names), Sticky Notes (including checklists, hyperlinks, masked/hidden text, and any embedded images, drawings, or voice/audio recordings you choose to attach), labels (including which items you've marked "Private"), Journals/tabs/sheets, and archive/trash contents. IndexedDB has a much larger practical capacity than older browser storage, which lets LinkIT hold substantially more data — including images, drawings, and audio — without hitting a storage limit as quickly. This data never leaves your device unless you (a) manually export a backup file, (b) enable optional cloud sync, (c) create a public share link (Section 2B), or (d) use one of the AI-powered features or the Word export described below (and even then, only the specific content involved in that action is transmitted).

Sensitive content you choose to store:

Because LinkIT lets you attach images, drawings, and voice/audio recordings to Sticky Notes, and lets you mark any item "Private" (which blurs it in the interface after a period of inactivity or on reload), you are responsible for deciding what sensitive content to store. We do not access, view, or listen to this content ourselves — it is processed entirely on your own device, except where you explicitly invoke an AI feature, the Word export, or a public share link.

B. Public Share Links and Bookmarks

— When you create a public share link (for a page, journal, sheet, sticky note, category, drawing, or a combined "bundle"), we store the shared item's content (or a reference to it), a unique share ID, whether it has been revoked, and a running count of how many times it has been viewed. We do not identify or track who views a share link beyond standard technical/usage data (Section 2D). If you (as a Pro-tier-and-above signed-in viewer) bookmark a shared journal or one of its tabs/sheets, we store that bookmark against your own account so you can find the link again — the bookmark record does not grant you any access beyond what the public link itself already provides.

C. AI Feature Processing (OCR, Voice Transcription, Translation) and Word Export

— LinkIT includes on-demand AI tools (extracting text from an image, transcribing a voice recording to text, translating text or speech) and a server-generated Word (.docx) export for notes, sheets, and drawings. When you use one of these, the specific image, audio clip, text, or note/sheet/drawing content you submit is sent from your browser to our server, which — for the AI tools — forwards it to Google's Gemini API for processing and returns the result to your browser, or — for the Word export — converts it directly into a downloadable .docx file and returns that to your browser. We do not log, store, or retain the image, audio, text, or export content, or the result, on our servers or databases in either case — the request exists only for the duration of that call. AI feature requests are rate-limited per IP address to prevent abuse; that rate-limit bookkeeping is held briefly in server memory and is not personal data about you beyond your IP address. Google's own handling of data it processes on our behalf is governed by Google's API terms and privacy policies.

D. Cloud Sync Data (when enabled)

— When you connect Google Drive, LinkIT uses Google's OAuth to request permission to read/write only the files LinkIT itself creates in your Drive (the least-privileged "app data" style scope), used solely to store your LinkIT backups for sync across your devices. We do not request access to your general Drive files, Gmail, contacts, or other Google data, and your Drive access token is kept only in your browser's memory for that session — it is never sent to or stored on ApeXhit servers. Any use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

E. Technical/Usage Data

— Standard web logs (IP address, browser type, device type, pages/features accessed, timestamps) collected automatically for security, debugging, and analytics purposes, consistent with standard hosting provider logging. We do not use invasive tracking, third-party ad networks, or cross-site behavioral advertising trackers in LinkIT.

F. Support Communications

— If you email us, we retain that correspondence to respond to and improve our support.

G. Account, Security & License Data (accounts only — not Guests)

— If you create a real account, we store in our database: your email address; display name (if provided); a one-way hashed password and/or PIN (we never store or can retrieve your actual password/PIN); whether you've enabled two-factor authentication (2FA) and, if so, your encrypted TOTP secret and hashed backup recovery codes — never a plain-text copy of either; your role (Root Owner, Co-Owner, or Member); your group's license tier and status; and, if you sign up or sign in with Google, your Google account's email, name, and a unique identifier ("sub") used to link that login to your LinkIT account — we never receive or store your Google password. We also keep a security audit log of sensitive account actions (e.g., license changes, PIN-protected actions, 2FA enable/disable, sign-ins) for security and support purposes. Guest mode never creates any of this data.

H. Synced User Content (Pro tier and above only)

— If your group's license tier includes database sync, your pages, categories, links, Sticky Notes, and Journals are also stored in a database we operate (currently hosted on Neon, a managed PostgreSQL provider) so that content stays consistent across your devices and group members. Guest mode and the Lite tier never have this data leave your device. Restore Points (Team tier and above) are snapshots of this same synced content, stored the same way, so you can roll back an accidental change.

3. How We Use Data

  • To provide, maintain, and improve LinkIT's features (local storage, sync, backup/restore, multi-device merge review, public sharing, AI-powered OCR/transcription/translation, Word export, etc.);
  • To diagnose and fix bugs (e.g., garbled text/sync issues) and secure the Service;
  • To respond to support requests.

We do not use your User Content to train AI models, and we do not sell or rent personal data to third parties. Content you submit to an AI feature or the Word export is used only to generate the immediate result you requested.

4. Legal Basis / Consent

Where required (e.g., GDPR for EU/EEA users), our legal bases are: performance of a contract (providing the Service you requested), legitimate interests (security, debugging), and consent (for optional cloud sync, public sharing, and optional AI/export features, all of which you affirmatively enable/invoke).

5. Data Sharing

We do not sell personal data. We may share limited data with:

  • Infrastructure/hosting providers, strictly to operate the Service — this includes our database provider (Neon/PostgreSQL), which stores account/license/security data for all real accounts and synced User Content for Pro-tier-and-above groups, and our application hosting provider;
  • Google, in three independent ways: (a) Google Sign-In, only when you choose to sign up or sign in with Google, to authenticate your account; (b) Google Gemini API, only when you actively use an AI feature (OCR, transcription, or translation), and only for the content of that single request; and (c) Google Drive, only if and when you choose to connect Google Drive sync, and only per the app-restricted scope you authorize;
  • Anyone holding a public share link you create — by design, that content is visible to whoever has the link, until you revoke it;
  • Law enforcement or regulators, only where legally compelled.

Guest mode and the free Lite tier never share your User Content with any of the above, since it never leaves your device (unless you choose to create a public share link, which is available on those tiers too and works as described in Section 2B).

6. Data Retention and Deletion

Local data persists on your device until you clear it, uninstall the app, or delete it via in-app archive/trash → permanent delete. Cloud-synced data persists in your own Google Drive account until you delete it there or disconnect the sync feature in-app. Public share links persist until you revoke them. AI feature requests and Word-export requests (Section 2C) are not retained by us at all — there is nothing to delete on our end. You may request deletion of any server-side technical logs we hold by emailing apexhit00@gmail.com; we will respond within a reasonable time.

7. Children's Privacy

LinkIT is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (in line with COPPA). If you believe a child has provided us data, contact us for removal.

8. Your Rights

Depending on your location (e.g., California/CCPA, EU/UK GDPR), you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Because virtually all LinkIT data lives on your own device, your own Google account, or is only ever transiently processed, you can typically exercise these rights directly via export/delete/disconnect/revoke features in the app. For anything else, contact us at apexhit00@gmail.com.

9. Security

We use reasonable technical and organizational measures (e.g., HTTPS, standard hosting security practices, per-IP rate limiting on AI feature endpoints) to protect data in transit and to reduce abuse of shared infrastructure. No method of storage or transmission is 100% secure, and we intentionally do not publish exact technical detail about our internal defenses beyond what's useful for you to protect yourself — publishing that detail would primarily help attackers, not users.

Guest mode and the free Lite tier never touch a server-side database for your User Content

— that data is only as secure as the device and browser profile it lives on. For those, the realistic risks are local, not remote:

  • Anyone with access to your unlocked device or logged-in browser profile can see or modify locally stored data — use your device's screen lock, disk encryption, browser profile separation for shared computers, and LinkIT's own PIN lock (tap "Lock LinkIT") when stepping away.
  • Only import backup files or accept multi-device sync/merge data from sources you trust. LinkIT runs all imported/synced rich-text content (Sheet Notes) through an allowlist-based HTML sanitizer, both when it's imported and again immediately before it's rendered, stripping scripts, event handlers, and unsafe URLs — this substantially reduces (though, as with any software, can never perfectly eliminate) the risk from a tampered backup file.
  • Google Drive sync access is scoped to app-created files only, and your access token never leaves your browser session, which limits the blast radius even if that token were somehow exposed.
  • A public share link is, deliberately, viewable by anyone who has it — treat the link itself like a password, and revoke it once you no longer want it accessible.

For accounts on Pro tier and above, your group's synced User Content and account/license data live in a database we operate. We use hashed (never plaintext) passwords, PINs, and 2FA backup codes; encrypted connections to that database; session cookies scoped to your account; optional two-factor authentication; and PIN confirmation on sensitive Root-Owner actions to reduce risk. No online storage is 100% immune to compromise, but this is a materially different (and monitored) risk profile than a purely local device.

If you discover a security issue in LinkIT, please report it responsibly to apexhit00@gmail.com rather than testing it against other users' accounts or data, so we can investigate and fix it promptly.

10. International Users

LinkIT is operated from the United States. If you access the Service from outside the U.S., you understand your data (to the extent transmitted to our infrastructure, e.g. for an AI feature request or Word export) may be processed in the U.S.

11. Changes to This Policy

We may update this Privacy Policy periodically; the "Last Updated" date will reflect changes. Material changes will be flagged in-app where feasible.

12. Contact

ApeXhit LLC — apexhit00@gmail.com

Privacy Policy | LinkIT