Privacy policy

Privacy, in plain English.

Biotrail is built to collect as little as possible. This page explains what we keep about creators who make pages, and about the people who visit them.

Last updated 20 October 2026

If you have a Biotrail account

To run your account and your page we keep:

  • Account details: your email address, username and password. Passwords are stored only as a bcrypt hash, so we can't read them.
  • Your page: name, bio, photo, links, design choices and anything else you add. This is public, because that's what a link page is for.
  • Uploads: images and files you upload, stored on our servers so your page can show them.
  • Social planner: posts you write and schedule, and, when you connect a network, the access token it gives us. Tokens are encrypted (AES-256-GCM) and used only to post what you scheduled.

Your login email is never shown on your page. Only contact details you type into a block (such as a business card or media kit) are public.

If you visit a Biotrail page

We count visits and clicks so creators can see how their page is doing, without cookies and without storing who you are:

  • When you open a page or tap a link, we make a one-way hash from your IP address, browser type, the page and the date, mixed with a secret. Only the hash is stored, and because the date is part of it, the same person gets a new, unlinkable value every day. Your IP address itself is never stored.
  • We also record the site you came from (domain only, such as instagram.com), your device type (mobile, tablet or desktop) and which link you tapped.
  • If you arrived from a post made with the Social planner, the page remembers that for the rest of your visit in your browser's session storage, which is cleared when you close the tab. It isn't a cookie and isn't sent to anyone.

If you fill in a form on a creator's page (email signup, contact form, gated download, business card details or a poll), what you enter goes to that creator. See Data you give to a creator.

Data you give to a creator

When you join a creator's email list, send them a message or share your details from their business card, the creator decides what to do with that information. We store it for them, show it only in their dashboard and let them export it. We don't email you, sell it or use it ourselves.

To have it removed, ask the creator, or contact us at hello@biotrail.app and we'll pass the request on and help.

Cookies

Visitors to creator pages and our marketing pages get no cookies from Biotrail.

If you have an account, we set two cookies when you log in, both strictly necessary:

  • bt_session: keeps you signed in (httpOnly, 30 days).
  • biotrail_in: a simple “signed in” flag with no personal data, so our menu can show “Open editor” instead of “Sign up”.

Both are deleted when you log out.

Third parties on creator pages

  • Google Analytics: a creator can add their own Google Analytics ID in their settings. On that creator's page, Google Analytics then runs under the creator's account and Google's policies, and may set cookies. It's off unless the creator turns it on.
  • Videos, music and maps: YouTube, Spotify, map and similar embeds only load after you press play or show. Until then, at most a preview image is shown. Once loaded, the provider's own privacy policy applies.
  • Links: links on a page take you to other websites, which have their own policies. We never add affiliate tags or hidden redirects to a creator's links. Tracking (UTM) tags are added only if the creator switches them on in their settings or uses the Social planner's tracked links.

How we use data, and what we never do

We use the data above only to run Biotrail: to show your page, count visits, send your scheduled posts, keep the service secure and answer you when you contact us.

  • We don't sell or rent personal data.
  • We don't show ads or share data with advertisers.
  • We don't use page content or visitor data to train AI models.
  • We don't read your messages or subscriber lists except when you ask us to help, or when we must to investigate abuse under our rules.

We use a small number of service providers to operate Biotrail, such as our hosting provider and database host. They process data only on our instructions.

Your controls: export and delete

  • Export: download your data (page, links, settings, short links, subscribers and the last year of statistics) as a file from your account menu at any time, including while suspended.
  • Delete: Settings, then Delete account, deletes your account, page, links, every file you uploaded, subscribers, messages and statistics from our servers straight away. Copies that visitors' browsers or caching services already saved can remain until those caches expire, and database backups roll off within 60 days.
  • Hide from search: Settings lets you ask search engines not to index your page.

Depending on where you live (for example under the GDPR or CCPA), you may also have the right to access, correct, restrict or object to how your data is used, and to complain to your data protection authority. Email hello@biotrail.app and we'll respond within 30 days.

Security and retention

Pages are served over HTTPS, passwords are hashed, social tokens are encrypted, and sign-in sessions are signed. We keep account data for as long as your account exists. Visit statistics are kept so you can see your history, and are deleted with your account.

Children

Biotrail accounts are for people aged 13 or over, or older where your country requires it. If you believe a child under that age has an account, contact us and we'll remove it.

Changes and contact

If we change this policy in a way that affects you, we'll update the date above and, for significant changes, show account holders a notice in the dashboard before it takes effect.

Questions or requests: hello@biotrail.app.