About this domain

1.What happens when you click one of these links

You are redirected to the real destination: someone’s GitHub profile, LinkedIn page, portfolio, or similar. That is the whole of what you experience, and it happens immediately.

At the same time, depending on where you are, we record a small amount of context, only the click and the time, or nothing at all:

Where recording is switched on

• that a click occurred, and when
• the country and city your network appears to be in
• whether you were on a desktop, phone or tablet
• your browser family, such as “Chrome”
• what kind of site you came from (an email client, an applicant tracking system, or directly) as a category, never the address itself
• whether the click looked automated, such as an email security scanner, judged partly from published lists of the networks those services use
• any labels the person who made the link put in the link address itself, such as a campaign name

Where a reduced mode applies

We record only the click and the time. No location, no device, nothing else.

Where recording is switched off

We record nothing. The redirect still happens, and that is all.

Today recording is switched on only for clicks from the United States, Canada, Australia, New Zealand, Singapore, Hong Kong and India: places whose privacy law we have checked. It is switched off in the EU, the EEA and the UK, and in every other country. The reduced mode applies to anyone whose browser sends a Global Privacy Control signal (section 8).

2.What we do not do

We think this list matters more than the one above.

• We do not set cookies and we do not read anything stored on your device.
• Clicking a link runs no code in your browser. The redirect is a plain server response: no script, no tracking pixel, no fingerprinting.
• We do not know who you are. We do not store your IP address or your full browser string. For about three minutes after a click we hold a scrambled form of your network address, made with a key that changes every day, so that a burst of repeat requests (often a security scanner) counts once. It is never written to our database. After that we cannot tell that two clicks came from the same person, and we cannot connect a click to a name, an email address, or an account.
• We do not identify your employer. If the person who created the link labelled it with a company name, that label is theirs. We did not work out where you work, and we cannot.
• We do not sell or share this data, we do not use it for advertising, and we do not give it to data brokers. We only use it to improve warmhop's own check for telling people from bots, not to train anyone else's models or AI.
• We do not track you anywhere else. This domain sees one click and never sees you again. This page itself has no analytics.

3.What the person who created the link sees

They see that a link they created was clicked, when, and, where recording is switched on, the coarse context listed above. They see a category, not you.

They cannot see your name, your email address, your employer, your exact location, or any other link you have ever clicked.

4.How long we keep it

• After 180 days we delete the city and the browser, keeping only the country and the device type.
• After 365 days we delete the remaining detail, keeping only that a click happened and when.
• After 24 months we delete it entirely.

It goes sooner if the person who made the link deletes it or their account, or if you ask us to (section 7).

5.Why we are allowed to do this

Where recording is switched on, we rely on legitimate interests (Article 6(1)(f) of the GDPR where it applies, and the equivalent basis in local law): giving someone visibility into whether material they shared professionally was engaged with, and telling human clicks apart from automated scans. We have carried out and documented a balancing assessment, and we can provide it on request.

Where a reduced mode applies we deliberately do less, so that the only thing recorded is the click and its time. Where recording is switched off, there is nothing to justify, because nothing is kept.

6.Who is responsible for what

warmhop™ is responsible for the click records described on this page. The person who made the link is responsible for what they wrote on it, such as its name or a tag with a company or a person’s name, and for telling you about the link where their law requires it. Our Terms require them to.

7.Your rights, and one honest limitation

You have the right to object to this processing, and to ask what is held about you.

The limitation: because we keep no identifier for you, we genuinely cannot look you up. If you ask what we hold, there is nothing we can search by, which is a consequence of collecting so little, not an excuse. Article 11 of the GDPR covers this situation and does not require us to start collecting identifying information in order to be able to answer.

What we can do: if you tell us the specific link you clicked, the warmhop.com/r/... address, we can delete the records for that link. If you were sent a document containing one and want it dealt with, send us the link and we will.

You may also complain to your local data protection authority.

If you create links yourself, see our Privacy notice.

8.Global Privacy Control

If your browser sends a Global Privacy Control signal, we record your click in the reduced mode: the click and the time, nothing else. We are not required to do this, since GPC applies to selling and sharing data and we do neither. We do it anyway.

9.Contact

Who runs warmhop

warmhop is run by an individual founder based in the United States. It is not yet a registered company.

Contact

privacy@warmhop.com

Report a link

abuse@warmhop.com

EU representative (Article 27)

None appointed yet. Signups and click recording are switched off for the EU, the EEA and the UK until one is.