Privacy Policy

What this extension is

Cardlink is an independent browser extension for Chrome and Firefox that turns the text you type into a styled image card, hosts a link-preview page for it, and hands you back a link to paste into a social media post. It currently supports Threads. It never posts on your behalf, and no content script ever runs on the platform's own site — it only talks to its own backend and, optionally, to the platform's own login flow. It is not made by, affiliated with, or endorsed by Meta Platforms, Inc.

What data is collected

You don't need an account to use the extension. Every time you use "Generate share link," the following is sent to our backend and stored so the link keeps working:

• The text you typed into the card
• The image generated from it (rendered entirely in your browser, on your device, before it's uploaded)

We also briefly use your IP address to enforce rate limits (capping how many cards one connection can generate per hour/day, to deter abuse) — it's used as a short-lived counter key and isn't stored as part of the post itself or kept beyond the rate-limit window.

If you connect your account (optional)

The extension offers an optional "Connect account" feature via the platform's own login (OAuth) — you're never asked to type a password into the extension. If you use it:

• Your username and profile picture are fetched once and cached on our server, so cards you choose to include them on don't need to re-fetch them each time
• Your access token is used once, immediately, to fetch that username/picture — it is not saved anywhere afterward, and is never used to post, like, comment, or take any other action on your behalf
• A separate proof-of-ownership token is generated and stored only in your browser, so the extension can prove a later card really came from you before we'll stamp your name/photo onto it

Including your name/photo on a card is an explicit toggle, off by default until you connect, and it's yours to leave off per-post even once connected.

Generated pages are public links

Each card gets its own link (thread-preview.dentedprinter.workers.dev/p/<id>) — this is the whole point, so it can unfurl as a link preview when pasted into a social media post or elsewhere. Anyone who has or guesses that link can view the page. If you chose to include your name/photo on that card, the page's header links your username and photo out to your real, public profile on that platform, same as any other visible byline.

Short links

To save space in your post, each card's link is shortened with 4w1z.io, a link shortener that Dented Printer also runs. Our server (not the extension) sends 4w1z only the card's page address and its card ID — plus, if you're connected, a scrambled reference to your connection that can't be turned back into your username. 4w1z never receives your username, profile picture or card text.

When someone opens the short link, 4w1z counts the visit in aggregate totals and checks the destination against link-safety services, then forwards the visitor to the card. 4w1z itself sets no cookies and doesn't store visitors' IP addresses (its web host keeps standard access logs). Details are in the 4w1z privacy notice.

Short links are deleted along with their cards (see below), and a deleted short address is never reused for anything else. Cards made before 4w1z short links were introduced were shortened with TinyURL, a third-party service: we can't delete those TinyURL links, but once the card is deleted they only lead to a "not found" page.

What the backend stores, and where

Unlike some of our other projects, this one doesn't run on our own server — it runs on Cloudflare Workers, with images in Cloudflare R2 and everything else (the post text, timestamps, rate-limit counters, and the cached username/photo described above) in Cloudflare KV. Dented Printer operates this Cloudflare account but the data itself lives on Cloudflare's infrastructure, not a server we host directly. Short-link records live on 4w1z.io, hosted by DreamHost in the United States. Both providers may store data outside Canada.

This data is never sold, shared with advertisers, or used to build an advertising profile of you.

Data retention & deletion

Generated cards are handled in two ways, depending on whether anyone's actually viewed the link:

• A card that's never viewed (nobody opened the link, and no crawler ever fetched it to build the unfurl) is automatically deleted after 14 days — this is meant to clean up cards that were made but never actually posted anywhere
• A card that has been viewed is kept as a working, permanent link — with one exception: everything is deleted after 420 days regardless, as a distant backstop in case the cleanup above ever misbehaves, not as an intended expiry for real posts
• A card's 4w1z short link is deleted whenever its card is: by the 14-day cleanup, by Delete my data, or at the 420-day backstop at the latest

Your cached username/photo (if you've connected your account) doesn't expire on its own — it stays cached until you ask us to remove it. Disconnecting in the extension's popup removes the connection from your browser immediately, but by itself only affects your browser — it doesn't delete anything on the server, since your username/photo may still be attached to cards you've already created and shared.

To actually delete your data from our server, open the extension popup while connected and click Delete my data (next to Disconnect), then confirm. This is self-serve and immediate — no email required. It deletes your cached username/photo and every card you created while connected — the text and the image both, not just the byline — and those cards' 4w1z short links. Links to those cards will stop working afterward. If 4w1z is briefly unreachable, the short-link deletion is retried automatically each day. This is one-way and cannot be undone.

If you no longer have the extension installed, or run into any issue with the in-popup deletion, email dylan@dentedprinter.com and we'll help by hand — including deleting a specific card outright.

Contact

Questions about this policy: dylan@dentedprinter.com