Privacy Policy
Last updated: 8/18/2026
What this policy covers
This policy explains what data Mefolio collects, why we collect it, how it is used and protected, and the choices you have. It applies to everyone who uses the Mefolio service, whether you have an account or you simply visit a public page. Mefolio is currently a free service and does not process payments.
Account information
When you create an account we collect your email address, chosen username and a password. Passwords are stored only as a salted hash (bcrypt) and are never readable. You may also add profile information such as a display name, bio, avatar, social links, theme and the links and media that appear on your public page. You control what is public: your page is public by default so that the people you share it with can see it.
Visitor analytics
When someone visits a public page, we record analytics events: page views, link clicks, the time of the event, a referrer label (for example direct, search or social), device and browser type, and approximate geography. Raw IP addresses are never stored: the IP address and user-agent are combined with a server-side secret and hashed before anything is written to the database. Unique-visitor counts are de-duplicated per hashed IP-and-device within a 24-hour window.
How long analytics data is kept
Raw analytics events are kept for a limited period (by default 90 days) and are then pruned automatically. Daily summary statistics are kept so you can see long-term trends without retaining raw events. The 90-day figure is a default and can be changed by the operator of a deployment through its configuration.
Email capture and broadcasts
If you enable the email capture form on your page, we store the email addresses visitors choose to submit so you can contact your list. We also store broadcast messages you send through the service and delivery records (for example whether a message was sent or bounced). Every broadcast includes an unsubscribe link, and unsubscribing stops further broadcast emails to that address. Subscriber lists can be exported as a CSV from your dashboard.
Cookies and sessions
We use an HTTP-only session cookie to keep you signed in, and a separate CSRF token cookie to protect forms and API requests. We do not use advertising cookies or third-party tracking cookies. If you use the optional 'remember me' sign-in, a refresh token is stored in an HTTP-only cookie. Sessions can be ended by signing out.
Data you import
If you use the import feature to bring existing links from another profile, we fetch the public page you provide and extract the links from it. The links are then stored as part of your account data. We do not import or store data from pages you are not authorised to access.
Optional AI assistance
Some dashboard features offer optional AI writing helpers (for example bio suggestions, link titles or email drafts). These features are only used when you explicitly trigger them, and only the text you submit is sent to the AI provider. They require the operator to configure an AI provider key; if no key is configured, the features are unavailable. Do not submit information through AI helpers that you are not comfortable sharing with a third party.
Third-party services
Mefolio uses third-party providers to operate the service: a database provider (PostgreSQL) for your data, media storage (Cloudinary) for uploaded images and videos, an email provider (SMTP) for sending account and broadcast emails, and an optional rate-limiting store (Upstash Redis). Geography lookups are performed locally from a bundled dataset, not by sending IP data to a third party. We do not sell your data to anyone.
How we protect data
We use industry-standard measures including password hashing, HTTP-only cookies, CSRF protection, rate limiting, account lockout after repeated failures and minimal storage of sensitive data (for example, hashed rather than raw IP addresses). No system is perfectly secure, and we cannot guarantee absolute security of data in transit or at rest.
Your choices and rights
You can view and edit your profile information at any time from your dashboard. You can export a copy of your account data from the dashboard (GDPR-style export). You can permanently delete your account and its associated records from your dashboard settings at any time; deletion requires your password and removes your account, links, media references, theme, social links, subscribers and related records. You can also ask us questions or raise concerns using the contact details below, and we will respond as soon as we reasonably can.
Children
Mefolio is not directed at children. Our Terms require users to be at least 13 years old, and if local law requires parental consent for online services, that consent must be in place before creating an account. If you believe a child has provided us personal data without consent, contact us and we will take steps to remove it.
Jurisdiction and international users
Mefolio is operated with attention to users in Pakistan and South Asia, and is available internationally. Your data may be processed on servers located in other countries, including through the third-party providers listed above. If you are outside the country where the service is hosted, your data may be transferred to and processed in that country. We take reasonable steps to protect data wherever it is processed.
Changes to this policy
We may update this policy as the service evolves. Material changes will be posted on this page with an updated date. Where required, we will ask for your consent to new uses of your data.
Contact
For privacy questions or requests, email privacy@your-domain.example (replace with the operator's real support address before launch). We aim to respond within a reasonable time.
About this document
This is a plain-language draft written to match the data handling in the current Mefolio codebase. It is not legal advice and has not been certified by a lawyer or any government authority. Before launch, replace the placeholder contact address and have this policy reviewed by a qualified legal professional for your operating jurisdiction.