Privacy Notice

Last updated 24 September 2026.

The short version: this site loads nothing from a third party, stores counters rather than people, and keeps no log of what you typed into a tool.

What we store

Data	Why	Kept for
Account details: name, email, hashed password, optional username	To run your account and let you sign in	Until you delete the account
Project configuration: repository, environment variable names, domains, deployment history	To deploy and operate your projects	Until you delete the project
Aggregate metrics: daily visit, install and active-user counts per project	To show you traffic and conversion	Rolling window; 30 days on Free, 90 days on Pro
Contact messages: name, email, topic, message body	To answer you	24 months, then deleted
Salted, daily-rotating hash of an IP address, for rate limiting	To stop form abuse without identifying anyone	15 - 60 minutes, per bucket
Operations audit log: staff action, target, summary	Accountability for administrative access to the platform	12 months

What we deliberately do not store

• What you type into a tool. No tool input or output is written to the database. The tool pages process in your browser and post aggregate counters only.
• Visitor identities. There is no visitor id, no fingerprint, no cross-site identifier, and no way to reconstruct an individual's session from the metrics we keep.
• Secret values in the browser. Environment variables marked as secret are stored server-side and are masked in the dashboard; the value is never included in the HTML.
• Third-party trackers. There is no analytics provider, advertising pixel or CDN. This is enforced by the site's Content-Security-Policy, which permits no external origin.

Cookies

Two cookies exist, both functional and both first-party:

• lyralink_sid — the session, so the site remembers you are signed in. HttpOnly, SameSite=Lax, Secure over HTTPS.
• lyralink_session — the account session token, only set after you sign in, stored as a hash server-side.

There are no advertising or analytics cookies, so there is nothing to consent to.

Where data lives

Application data is stored in a MySQL database and a file store operated for Lyralink by ARXD LLC. Database credentials are held outside the web root in a file that is not reachable over HTTP.

Security

Passwords are stored using a modern one-way hash and are never logged or emailed. Administrative access to the platform requires two-factor authentication. Uploaded files are validated by content, stored under generated filenames, and are never executed. If you find a security problem, please report it to security@lyralinkai.com.

Your choices

• Export your project configuration and metrics at any time from the dashboard.
• Delete a project, which removes its configuration, metrics and deployment history.
• Delete your account, which removes your account record and every project attached to it.
• Request a copy of anything held about you by emailing support@lyralinkai.com.

Children

Lyralink is not directed at anyone under 16, and accounts for children are not knowingly created.

Changes

Material changes to how data is handled are notified to account holders before they take effect.