Support

1. How to reach us

When writing in, please include: your xid (card page address), when the problem happened (with timezone), screenshots, and the traceId from the API error response if there was one. These shorten diagnosis considerably. Never email us recovery codes, sign-in links, or any keys.

2. Scope and response times

Response times depend on your subscription tier and are counted in business days from when we receive the ticket. "Response" means the first human reply; fully resolving complex issues can take longer.

The following are prioritized on every tier: compromised or suspected compromised accounts, blocked data export/deletion requests, security vulnerability reports, and misbehaving false-rejection guardrails.

Out of scope: writing code for third-party tools or your own agents, custom development, and network troubleshooting unrelated to alink.

3. Availability

Our published availability objectives (SLOs — targets, not contractual warranties):

• Card pages and read-only protocol endpoints: 99.9% (edge-cached, so card pages stay readable through most incidents);
• Assistant Inbox and API: 99.5%.

Planned maintenance and incident updates are announced on the status page. Backups are daily encrypted snapshots plus an independent-provider cold copy; the disaster-recovery objective (RTO) is under 4 hours.

4. FAQ: account and sign-in

Magic-link email not arriving?

Check in order: spam and "promotions" folders (we send from al.ink); confirm you entered your registered email; wait a minute and resend. Links are single-use and short-lived — use the newest one. On corporate mailboxes, ask IT to allowlist al.ink.

Passkey not working / new device?

You can always sign in with an email magic link instead, then add a passkey for the new device and remove old credentials in settings. Passkey biometrics live only on your device — we cannot and need not reset them.

Lost your recovery code?

As long as you can still sign in via passkey or magic link, your account is fine — contact hi@al.ink for help updating recovery credentials. Recovery codes are shown once at generation and rotate after use; we store only a hash and cannot recover the original — print it or keep it in a password manager.

Why am I asked to verify again for some actions?

Handle rebinding, account deletion, materially loosening your Contact Contract, granting a delegate seat, and full export all require step-up re-verification. This anti-takeover design is fixed and cannot be disabled.

Changing your login email?

Changes take effect after a 7-day delay; both old and new addresses are notified and either can abort. If you suspect someone else initiated it, abort immediately via the link in the old mailbox and contact hi@al.ink.

5. FAQ: card page, handle and works

What is the difference between xid and handle?

The xid is your permanent identifier (non-transferable, never recycled) — every credential and relationship anchors to it. A handle is just a vanity name pointing at your xid, alive while your subscription is. Stop paying and you lose only the vanity name, never the identifier.

Will someone grab my handle the moment my subscription lapses?

No. The sequence is: a grace period of at least 30 days (still resolves; only you see the renewal prompt) → a cooldown of at least 90 days (externally disabled, redeemable only by you upon resuming your subscription) → only then is the name publicly released. Your xid and data are unaffected throughout.

How often can I change handles?

At most 2 rebinds per calendar year; the old handle goes straight into a 90-day cooldown.

Someone is impersonating me / my brand with a handle?

Well-known person and brand names are on a protected list; claiming them requires identity verification. Report impersonation to hi@al.ink with evidence. Note that card pages always show the xid alongside the verified display name — the xid is the identity, the handle is not.

Can the owner see me when I visit someone's card page?

Signed out, you are fully anonymous — you only enter aggregate counts that contain no identity. Signed in, your display name and handle are visible to the owner by default. To browse anonymously, turn on Console → Account & security → Incognito browsing: it is a persistent account-level preference — set it once and it applies to every card page you visit from then on, and you can switch back anytime. In stealth mode you are counted only in anonymous aggregates and no identity is recorded.

Can I see who visited my card page?

You see your card page's "encounter" signals: visits, intent views, conversations started, submissions and so on (what is counted is identical for every visitor; payment only affects how much detail you see). Anonymous visitors are counted, never identified — you see aggregate counts by referral channel, time bucket and request category; signed-in, non-stealth visitors appear with their display name and handle. We never do reverse-IP lookups, browser fingerprinting or company identification, and never sell or provide visitor-identity inference.

How do I publish works on my card page?

On the console "Works" page, upload a single web file, a folder with an index.html entry, or a zip; your connected personal AI can also publish through MCP. The published address is al.ink/<your handle>/works/<slug> — anyone can open it, no sign-in needed. alink has no "generate a work" feature: creation happens in your own tools.

A work link I shared no longer opens?

Three common causes: you changed the work's short name (old links are not redirected — check before renaming); the work was deleted, unlisted, or taken down; and for up to about 5 minutes after a takedown or deletion, some visitors may still see cached content — that is normal propagation delay, not a failed operation.

Is what visitors type inside a work safe?

Works are hosted on a separate domain and run in an isolated browser environment: a work cannot read a visitor's alink sign-in state, and nothing a visitor types inside it can be sent to any third party. Every work page shows fixed author attribution; the content is the publisher's responsibility and does not represent alink.

Will my published works disappear if I downgrade?

No. If you exceed the new plan's quota we only block new uploads and replacements; published works and the links other people hold keep working until you delete them or they are taken down for violations.

How do I report a work?

Every work page has a report entry (in the top ··· menu); no registration needed. For infringement or copyright matters (including DMCA notices) you can also email hi@al.ink with the work's address, the basis of your claim, and your contact details.

6. FAQ: subscription, billing and quotas

Where do I manage my subscription or download invoices?

Console → "Subscription & Usage" → "Manage subscription (Stripe Portal)" for upgrades, downgrades, cancellation, payment methods and invoices. Taxes are computed automatically by Stripe.

Refund policy?

Annual plans: full no-questions refund within 14 days of payment (any bound handle is unbound into cooldown). Monthly plans: the current period is non-refundable; after cancellation, service runs to period end. The trial is a 14-day no-card Pro trial — no charge, automatic fallback to Free.

Does protection vanish if my payment fails?

No. Days 0–7 everything works; days 8–30 AI triage drops to the Free quota while rule-layer filtering, the Inbox, approvals and export keep working; from day 31 you fall back to the Free tier. Paying at any point restores everything. We never wave requests through because of arrears.

What happens when my AI triage quota runs out?

Requests beyond the quota fall back to rule-layer filtering and still reach your Inbox (marked "not AI-triaged"), with a summary note in your daily digest. Protection never disappears; AI triage resumes after an upgrade or the monthly reset.

Will a request flood burn through my quota?

No. Abnormal spikes are detected and handled by anti-abuse measures, not billed against your normal quota.

How do settlement cards and payment QR codes work?

After a request is released, a Pro user can send a settlement card in the private conversation with their own payment link or merchant collection QR code. The amount and method never appear on the public card, before release, or in gateway decisions. alink does not handle the funds or verify who a QR code points to. Check the payee in your payment app before paying. On mobile, save the QR image first, then choose your payment app's option to scan from photos.

What if a settlement card looks suspicious or there is a payment dispute?

Use the card's “Report” action first. For a refund, chargeback, or transaction claim, contact the payment channel actually used. You can also export the settlement dossier from the conversation as a factual timeline. alink may remove a card or restrict an account, but it does not decide who paid or performed. Never send a bank password, SMS verification code, private key, or account recovery code.

Filtering feedback (false rejections / false approvals)

• Overturn (false rejection): in the Inbox's "auto-declined" list, one click re-approves; the feedback flows straight into your policy tuning;
• Flag a false approval: one click on any approved request that turned out to be harassment;
• If your false-rejection rate exceeds the threshold, auto-decline is suspended automatically and downgraded to "archive + visible in the daily digest" — that is the guardrail working, not a malfunction.

7. FAQ: data sovereignty

What is in the export bundle?

Contact Contracts, relationship records, request data, and the audit chain with its verification proof — always all data within retention, on every tier. Start it from Console → "Data & Revocation" (step-up verification required).

How do I delete my account?

Start deletion on the "Data & Revocation" page → a 7-day cooling-off period (cancelable anytime) → then cryptographic erasure (your encryption key is destroyed; all ciphertext becomes permanently unreadable). Billing data is kept at least 7 years by law; your handle enters a 90-day cooldown. Deletion is irreversible — export first.

Can I delete just one relationship record?

Yes — any record, anytime; its search index and ciphertext are purged along with it.

8. Requester help (submitting needs no signup)

How long is my conversation with the card page assistant kept? Can the owner read it?

Conversation transcripts are stored encrypted and deleted automatically within 30 days. The owner cannot see the transcript — it serves the anti-abuse audit process only. Only a structured request you explicitly confirm in the conversation reaches the owner's Inbox. The assistant answers using only what that card page has made public, and every reply carries an AI identity label and a "this is not a commitment by the person" footer.

Lost your status link?

The status link appears exactly once, on the submission receipt page — save it right there (bookmark or copy). It is a read-only authorization link; do not forward it. Your request's progress, and the reply if it is declined, all live on that page.

Your request was accepted — what now?

Submitted with email: You receive one email (the only one we will ever send you about this request): the release notice with the entry link to the in-site conversation. Open it to talk to the receiver directly — entering the conversation for the first time automatically opens an alink account with your reply email (the email says so), and signs you in on that device.

Claimed with Passkey (no email): We never send any email. Once released, sign in with the Passkey account you used to claim the request, and you will see the recipient's response and conversation under your "Sent" list.

Why do I suddenly have an alink account?

Whether opened automatically on your first email conversation entry or created when claiming with a passkey, an alink account is provided for you. The account lets you manage conversations and have your own card page; it has exactly the same rights as a self-registered account — if you do not want it, delete it anytime on the console's Data & Revocation page. If your email already had an alink account, we only link the conversation to it and never sign it in automatically.

Lost your conversation entry link?

For email submissions: On your status page, click "Re-send entry link" (once per hour). The new link only goes to the reply email you submitted, and the previous link stops working. For requests submitted without email: no link can be sent. Sign in with the Passkey account that claimed it; if not yet claimed, the claim entry on the receipt page remains valid for 7 days.

Your request was declined?

The reply is shown on your status page (we send no decline emails). If invited to "add context and retry", you may do so once. Admission rules are set by the receiver — we do not interfere with personal admission decisions, and please do not probe with repeated submissions.

Want the information you submitted deleted?

Request data is cleaned up automatically after the receiver-tier retention of 90–180 days. For earlier deletion, use the channel in your receipt or email hi@al.ink with "Privacy" in the subject (attach your status link so we can locate it; we will verify ownership of your reply email first). If you have opened or claimed an account, you can also simply delete the account from the console.

Recorded as a contact by a user and want it removed?

Email hi@al.ink with "Privacy" in the subject — we provide a response process (see Section 7 of the Privacy Policy).

Tired of alink emails?

Every notification email supports one-click unsubscribe (List-Unsubscribe). Transactional security emails about your account are exempt.

9. Agents and MCP

• Integration guide: the in-app "For Agents · MCP" page;
• Access tokens can be revoked in the console at any time; agent authority (ConsentGrant) can be withdrawn instantly;
• Duty mode allows multiple connections to receive from the same inbox. Only the first valid reply is accepted; alink takes over if no one replies within 60 seconds or an agent passes the letter back;
• alink will never ask for your private key or recovery code — any such request is phishing; forward it to hi@al.ink with "Security" in the subject.

10. Security vulnerability reports (responsible disclosure)

We welcome reports from security researchers:

1. Send to hi@al.ink with "Security" in the subject, including reproduction steps and an impact assessment; we acknowledge within 3 business days and keep you posted on the fix;
2. Please follow coordinated disclosure: no public details before we ship a fix (normally within 90 days);
3. Research boundaries: test only your own account and data; no access to others' data, no denial-of-service testing, no social engineering, no spam submissions;
4. Good-faith research within this process will not be pursued legally;
5. A formal bug bounty is in preparation; for now we thank contributors on an acknowledgments list.

11. Changes

Features, quotas and policies are governed by in-product announcements, the Terms of Service and the Privacy Policy. This page evolves with the product; the update date is shown at the top.