The latest features, improvements, and fixes shipped to MASK.
October 2026
Security
Everything you publish passes one safety check before it goes live
Short links, QR codes, Bio Pages and CVs now pass the same safety check before they go public, however they are published, including bulk tools and the API. A brand-new account's link to a site MASK does not yet know may be held for a short review before it starts working, while established accounts publish as before. A held link or page shows a neutral not-available-yet message until it is reviewed, and repeated confirmed abuse now restricts an account automatically.
Improvement
New accounts tell us how they plan to use MASK
When you create an account, MASK now asks a couple of quick questions about how you plan to use it and shows a short summary of the acceptable use policy. It takes a few seconds and never stops you signing in.
Security
Two-step verification holds on password and email-link sign-in, and suspended accounts are signed out everywhere
Signing in with a password to an account with two-step verification always asks for the second step, and an email sign-in link no longer signs such an account in: it asks for the password and verification code instead. A sign-in that is waiting for its verification code can no longer be used as a session. A suspended account can no longer sign in by any method or use an existing API key, and suspending an account signs it out everywhere at once. A link MASK locks for safety stops working within about a minute even when part of the caching layer is unavailable.
Security
Content locked for safety stays locked until its review lifts it
A page, link or account that MASK has locked for safety is now switched back on only when its review is resolved. Editing a link, upgrading a plan or other admin actions no longer switch it back on early, and locked content no longer reappears for a few minutes after the lock. Upgrading your plan also no longer brings back links you had deleted.
Bug Fix
A custom domain's home page stays with its own workspace
When a page or a custom domain moves to another workspace, the domain's home page now shows only a page that belongs to the domain's current workspace. A move that would separate a domain from the page or links it serves is refused, so they move together or not at all.
Security
Custom domains show only their own CVs and online ordering
Public CVs and online ordering, including menus, branches, time slots, promo codes, orders and order tracking, now answer on a customer's own domain only for that domain's workspace, as shared reports and statistics already do. On mask.pk they work as before.
Bug Fix
Creator profiles list only pages that are live
A creator's public profile no longer lists pages that are locked for safety, archived, unpublished or in a suspended workspace, and it shows each page's published title. A suspended account's profile is no longer shown, listed in the creator directory or returned by the profiles API.
Security
Custom domains answer only for their own workspace's shared data
Shared reports, shared analytics and public statistics requested through a customer's own domain, including the data behind those pages, now answer only for resources that belong to that domain's workspace, as the pages themselves already did. A leftover preview address that could show where a protected, deleted or switched-off short link pointed has been removed, and public statistics and reports never show a password-protected link's destination.
Bug Fix
Public workspace statistics have an address of their own
Public statistics for a workspace now live at an address unique to that workspace. Workspaces that shared the same short name could previously reach the same address.
Improvement
Sign-in always happens on mask.pk
Opening a sign-in or sign-up page on a custom domain or on mask.bz now takes you to mask.pk, keeping where you were heading, so every sign-in method works. When a sign-in doesn't finish, the sign-in page now says why and whether trying again will help.
Bug Fix
Content locked for safety stops showing everywhere at once
When MASK locks a page or link for safety, or suspends an account, the content now stops showing on custom domains, in public reports and statistics, and as a page avatar at the same moment it stops on mask.pk, and is shown again everywhere when it is restored.
Improvement
Saving a Bulk QR list again no longer makes its codes twice
In the same browser tab, the Bulk QR tool now remembers which codes from your recent lists are already in MASK. Saving a list again answers those codes as already in MASK instead of making new copies, and they are not counted against your limits again. A code you deleted from MASK stays deleted: it is shown as deleted, and Create again makes a new one only when you ask. When MASK could not confirm a save, its codes are shown as possibly already in MASK, and saving again settles it without making copies. Each code shows what happened to it, and the summary counts codes made, already in MASK, deleted and not saved separately.
Bug Fix
Custom domains keep the address's parameters
Pages served on your own domain now receive the parameters in their address, such as campaign tags, and a mask.bz address that opens a page keeps them on the way. A shared report opened on its owner's own domain honours its share link and date range. Reports, pages and statistics are shown on a custom domain only when they belong to that domain's workspace, and a password in an old report link is removed on every domain.
Bug Fix
Deleting or changing a link takes effect at once
Deleting, disabling or editing a link just after MASK started a new server could leave its old redirect cached for up to five minutes and report the cleanup as incomplete. MASK now waits briefly for its cache to be ready before clearing it, so the change applies straight away. The same applies to page and plan changes. Retry cleanup now appears only when something really failed.
Bug Fix
Trying sign-in again keeps your choice
If signing up with Google or Microsoft hit a temporary error, trying again now keeps the plan you chose and an approved Founding Creator invitation, instead of starting over.
Improvement
Your default domain is used for every new link
When you set a domain as Default for new links, every new link now uses it unless you choose another: links made on the Links page, in a bulk import, for a QR code made from an address, from the free tools, and through the API. A link keeps the domain it was created on. If the default domain is no longer active, new links use mask.bz. The API now returns each link's full short URL, so it always shows the right domain.
Security
Report passwords stay out of links
A password-protected shared report now asks for its password on the report page and sends it privately, never in the address, then remembers it on that device for an hour. Links that include a password are no longer accepted. Changing the password or regenerating the share link means everyone has to enter the password again.
Improvement
Signing up keeps what you were doing
If you pick a template, duplicate a page or start a free tool before you have an account, signing up with email, Google or Microsoft now brings you back to it, with the same template, page or tool ready to continue. Nothing is created until you confirm it.
Bug Fix
QR code fixes
Extra QR codes you made for a bio page can now be deleted; the page's own code stays. Saving many QR codes at once in the Bulk QR tool is now safe to retry after a lost connection: codes that were already made are not made again or counted twice.
Bug Fix
Only the controls you can use
The page preview offers Publish only to members who can publish the page, and Retry cleanup after a partly finished link delete appears only for members whose role can run it (owners and admins by default). The unused MASK Directory option is no longer shown in page settings.
Improvement
Switch templates without losing your sections
When you pick another template for a page, MASK now asks what should happen to the sections you already have. Keep my sections applies the new template's colors and style and leaves every section exactly as it is. Replace my sections starts fresh with the template's sections, and says first that your current ones will be deleted. Either way the page keeps its address and the title and description you wrote, and settings such as a hidden Share or Subscribe button and where your social icons sit stay as you set them, including when you change colors in the Theme tab.
Bug Fix
Page editor and Bio Pages fixes
Settings save again on a page that used Growth-only options before a plan change. Taking a live page offline from Settings, and removing your profile photo, now ask first and say what will happen. Publishing from the page preview says why when it can't publish. Duplicating a page, or using a saved template, works for long addresses and keeps the page's description, font and SEO settings. Leaving the editor right after typing no longer warns that a change which is already saving will be lost. MASK AI now says that a page's address can't be changed later, and a page it only partly set up says so in the editor, with a way to retry.
Bug Fix
Links, QR codes and domains fixes
Deleting a redirect rule or a QR code now asks first, and the QR warning says that printed copies will stop working. Switching tabs in the link editor no longer drops unsaved changes on Overview, and a QR card's Link analytics opens that link's analytics. Removing a domain that still has links explains what is in the way instead of offering a delete that would be refused. Copy buttons on Domains and WhatsApp links say Copied only when the copy worked. The new-link form starts on your default domain, and short links show their own domain on Home and in Analytics.
Bug Fix
Team, broadcasts and payments fixes
Changing a member's role now asks first and says when it will revoke their API keys. On Team, your own row offers Leave instead of Remove, and members who can't manage the team see a read-only list. An invitation whose email could not be sent says so. Broadcast send and schedule controls show only to owners and admins, a test email is sent only after you save your changes, and drafts no longer show 0 recipients. Marking a contact message unread now sticks, subscriber totals match the list, payments totals cover your whole history, you can clear the bio and category on your creator profile, and the developer quick start names the right API address.
Bug Fix
Analytics, campaigns and reports fixes
Total clicks on Home and on each link's page no longer go down as old click data is cleaned up, archived pages no longer count toward your page total, and recent links on Home open the link. Revoking or regenerating a share link for stats or reports now asks first, editing a campaign's share link keeps its expiry, and a report you revoke no longer keeps its old approval. Campaign insights compare against the right totals, and goal pages say which conversions they count.
Bug Fix
Public pages and free tools fixes
On public bio pages the Share and Subscribe windows close with Escape and keep keyboard focus, the 18+ notice is readable, and footer links on a custom domain go to MASK. The Email Signature tool copies a signature that pastes formatted, Bulk QR says when no code could be drawn, and free tools explain what to do when an account is suspended or waiting for deletion instead of sending you back to sign up. Template previews keep you switching your existing page, and Duplicate this page uses the title and address you chose.
Bug Fix
No more blank space below the dashboard
On long screens, such as a bio page with many sections, a large campaign or the links list, the window could scroll past the bottom of the app into empty space. The dashboard now scrolls only inside the app.
New Feature
Drag, drop and preview in the page editor
Drag a section from the library to the exact place on your page, or use the + between any two sections. Sections move by drag, by touch or by keyboard, and screen readers hear each position. An open section can be moved without losing what you typed. Undo and redo cover moves, show and hide, and section edits. Preview your page on a phone as you type, or see your saved draft at tablet and desktop width as visitors will. Click a section in the preview to edit it, and the header always says whether your changes are saved, waiting to publish, or need another try.
Improvement
Find anything with Ctrl+K or Cmd+K
Press Ctrl+K (Cmd+K on a Mac) to find links by title, address or destination, and bio pages, campaigns, QR codes, goals and domains in the workspace you are in, then open the exact one. From the same menu you can copy a short link, open a page or its analytics, create something new, switch workspace or browse the free tools. A Create button in the top bar starts a link, page, QR code, campaign or goal, and ? lists every keyboard shortcut. Switching workspace now closes anything you had open, so nothing is saved into the wrong workspace.
New Feature
Select, tag and import links in bulk
On Links, select rows to enable, disable, tag, add to a campaign, export or delete them together, with a clear count of what is selected on the page and an honest result for each link. Your search, filters and page stay in the address, so Back returns to the same view. The Bulk Shortener now takes pasted links or a CSV file with url, title, tags and UTM columns, shows every row before anything is created, checks your plan's allowance, and can be retried after a dropped connection without creating any link twice.
Improvement
Quicker pages, QR codes and campaigns
Bio pages show whether they are published, in draft or waiting to publish changes, with a colour preview and quick copy and open. QR codes can be filtered by target, campaign and state, downloaded together as a ZIP, or used as the design for a new code. In a campaign, filter and sort what it holds, drag a search result onto the right group to add it, remove several at once, and create a new bio page without leaving the campaign. Links can now take an uploaded preview image, and images can be dropped or pasted onto upload fields.
Improvement
A consistent workbench for the free tools
Every free tool now puts copy, download, save and open in the same place, and only offers the actions it really has. Tools that read files accept a dropped file. Saving keeps exactly the result on screen. If you start a tool before you have an account, signing up and verifying your email brings you back to the tool and saves that result once.
Bug Fix
More accurate forms, reports and public stats
Subscribe and contact forms only accept messages while their page is published and available. Signing up again to a list that asks for confirmation sends a fresh confirmation email, and broadcasts only reach people who are still subscribed when the email goes out. Scheduled reports count clicks and page views in your schedule's own time zone when that detail is still kept, and say so when they fall back to whole UTC days. Public campaign stats now match the campaign page, including QR code scans.
New Feature
Campaigns for links, QR codes and pages
A campaign can now hold QR codes and bio pages as well as links. Add them with a search, create a new link (or a QR code for one of the campaign's links) without leaving the campaign, and see what each one is doing and how it performed. Campaigns can start and end at a date and time you set in your own time zone, and show as Scheduled, Active or Ended everywhere they appear, including shared reports. Every link, QR code and page also shows which campaigns use it.
Improvement
Campaign tags that leave your address alone
Applying a campaign's UTM tags to a link now keeps the rest of the address exactly as you wrote it, including its other parameters and anything after the #. When the address already has a UTM tag, you choose whether to keep it or use the campaign's value, and you see the result before you save. The UTM builder and the campaign planner no longer rewrite the address you type.
New Feature
Automatic signups and leads
On Growth and Enterprise, MASK now counts two things it sees happen on your bio pages as conversions: a new subscriber is a signup (once they confirm, when your page asks them to), and a contact-form message is a lead. They count toward your goals and your campaign results with nothing to install. Each one records the page, and the campaign when exactly one running campaign includes that page, and never anything about the visitor. Goals can now also cover a bio page, and start from ready-made templates. Conversions your own systems send through the API work as before.
New Feature
Campaign results, compared
Each campaign page now shows its clicks, page views and conversions for the period you choose next to the period before it, with the conversion rate where it can be measured, top referrers, countries and devices, which links, QR codes and pages did best, and the progress of goals that cover the campaign. Short notes point out what changed, each one based on the numbers on the page. When a number is not available, for example from before analytics were kept, the page says so instead of showing zero.
Improvement
Message notices and a quicker Home
When someone sends a message through a bio page contact form, the members of your workspace who manage your audience now get a notice in MASK and, unless they turn it off in their profile, an email. The notice names the page, never the sender or the message. Home now starts with what needs you: a running campaign, this week's conversions and your nearest goal, unread messages, and your next scheduled report. The message inbox and its export now show the campaigns each message's page belongs to.
Bug Fix
Reports and alerts reach every recipient
Scheduled reports and alerts addressed to more than one person now send each person their own email; a schedule with several addresses was previously not delivered. Scheduled reports now also compare each period with the one before it and list your top campaigns, and the weekly digest now goes to every owner of a workspace who has it switched on.
Security
Stronger workspace isolation and role permissions
Every read and write is now checked against the workspace you have selected and the items it owns, and what a member can do follows their role rather than the plan. When a member is removed or their role is lowered, their API keys and pending invitations stop working at once. Members can now also leave a workspace themselves.
Improvement
A clearer, more accessible dashboard
The dashboard now works on narrow phone screens and with assistive technology where it fell short. A screen that cannot load now says so, instead of looking empty or asking you to upgrade; an action that is refused says why; and schedule forms use your local time, including across daylight-saving changes. Settings and product pages no longer describe controls that MASK does not yet enforce.
September 2026
Security
Destination safety checks
When you add or change a destination on a link, a bio page or a QR code, MASK now checks it against its own blocklist and Google Web Risk. A destination known to host malware, phishing or unwanted software cannot be used, and you are told so when you save it. Published destinations are checked again regularly.
Security
Safer sign-in and password-protected links
Repeated wrong two-factor codes now pause sign-in to the account, and the account owner is emailed each time that happens. Password-protected links now work on custom domains, include a reCAPTCHA check, and temporarily stop a visitor who keeps entering the wrong password. The forms on bio pages now share the same spam protection.
New Feature
Content review and appeals
MASK now reviews links, bio pages and QR codes that break its rules. Anyone can report abuse from the Report abuse page. If something you published is restricted, visitors see a notice instead of it, you are told why by email, and you can appeal the decision.
Improvement
Free links no longer expire
Links on the free Hobby plan now keep working until you change or delete them. The old 7-day limit is gone, and links it had already expired have been restored at the same address, with the same QR codes and history. The free plan is limited in how many links you have, not in how long they last. You can still set your own expiry date or click limit on any link.
New Feature
Invite clients to their workspace
Agencies can now invite a client into that client's own workspace, as a viewer who sees results or an approver who also signs off work, and the client list shows which client needs your attention. Client workspaces are part of Enterprise.
New Feature
Scheduled reports and email alerts
Enterprise workspaces can now have a performance report emailed every week or every month, on a schedule in their own time zone. Every workspace can turn on email alerts for when a custom domain finishes verifying or a page is published, and the Real-Time Intelligence add-on adds an alert for unusual activity on a link.
August 2026
New Feature
Goals and conversions
Send the outcomes that matter to you, such as signups, leads, purchases, bookings and downloads, from your own systems through the API, and set goals on them. Each goal counts the conversions that match it, for your whole workspace or for chosen links, QR codes or campaigns, and shows its progress toward a target. New conversions and changes to goals are also available as webhook events. Part of Growth and Enterprise.
Improvement
Reliable webhooks
Webhook events are now saved before they are sent and retried automatically if your endpoint is unavailable, so a short outage on your side no longer loses an event. The list of events you can subscribe to now matches exactly what MASK sends: 20 event types, each with a published payload.
Improvement
More reliable account emails
Account emails, including verification, sign-in links, invitations and subscription confirmations, are now queued and retried when a first attempt fails, instead of being lost if the mail service is briefly unavailable.
Bug Fix
More accurate click counts
Fixed an issue where some clicks could go uncounted during busy periods, and where a click could be recorded at the time it was processed instead of the time it happened. Your analytics now count every click at the time it was made.
Improvement
Accessibility improvements
Every control on the main dashboard screens now has an accessible name, the bio page editor's labels are connected to their fields, and animations follow your device's reduced-motion setting. A button that is unavailable now says why, and a delete confirmation says exactly what will be removed.
New Feature
A library of 27 free tools
The free tools are now one library of 27, for links, QR codes, marketing, social profiles, images, developers and file formats, thirteen of them new. Tools that only work on what you type run entirely in your browser, so what you type never reaches MASK. Using the tools needs a free MASK account.
July 2026
Security
Mask AI safety improvements
Mask AI now stays strictly on task. Bio page and CV drafting only ever return the document you asked for, and treat everything you type as content to write about, never as instructions. Off-topic or abusive prompts are declined, and AI drafting is limited to paid plans.
Improvement
New solution and industry pages
New guides for how MASK fits specific fields: Real Estate, Musicians and Artists, Course Creators, Nonprofits, and Salons and Local Services. Each shows the blocks, templates, and workflow that suit that audience.
Improvement
Redesigned dashboard navigation
The dashboard sidebar is now grouped into clear sections that expand one at a time, so the menu stays tidy as you move between links, pages, analytics, and apps. The public menu also gained a dedicated Apps section for our built-in business tools.
New Feature
Five new bio page templates
Five more starting points: a real estate property showcase, a photographer portfolio, an author page, a tutor page, and a maker or small-shop page. Each is a complete layout you can publish and edit in minutes.
New Feature
CV Maker
Build a professional CV in minutes. Draft it from a short description with Mask AI or fill it in yourself, choose a clean template, and publish it on a single link you can password protect. Export to PDF any time. Available as a paid add-on.
New Feature
MASK for Real Estate
A new Property Listing block for bio pages with price, beds, baths, area, and a call to action, plus a real estate landing page and a free mortgage calculator. Everything an agent needs to turn a yard-sign QR code into a lead.
New Feature
Table QR ordering for Food Orders
Print a QR code for each table so dine-in guests scan, browse the menu, and order from their seat. Orders arrive in your queue tagged with the table number.
New Feature
SMS order updates for Food Orders
Keep customers posted by text at each step, from accepted to out for delivery, sent through your own Twilio account. Bring your own number and sender.
Improvement
Order notification sounds
Choose a notification sound for new orders and other events, with Standard, Premium, and Kitchen sound libraries, a per-event picker, preview, and volume control, so a busy kitchen never misses a ticket.
Improvement
Delivery zones, tips, tracking, and reorder for Food Orders
Four upgrades for Food Orders: per-branch delivery zones with smart fees resolved at checkout, optional tips with preset percentages or a custom amount, a public order tracking page customers open with their code and phone, and one-tap reorder for regulars.
New Feature
Promo Codes for Food Orders
Create discount codes customers enter at checkout: a percentage off, a fixed amount off, or free delivery. Set an optional minimum spend, a per-customer limit, a total usage cap, and a start and end date. Every discount is calculated on our servers from your menu, so totals can never be tampered with, and the discount shows on the checkout, the order queue, and the confirmation email.
Improvement
Scheduled Orders & Kitchen Pacing
Let customers schedule an order for later from time slots built out of each branch's opening hours and prep time. You can also set a maximum number of active orders so the kitchen pauses new "as soon as possible" orders when it is at capacity, while scheduled pre-orders keep flowing. Both are optional and configured per workspace, with a per-branch pacing override.
New Feature
Food Orders
Take orders straight from your bio page. Build a menu with categories, photos, variants, and modifiers, add one or more branches with their own hours and delivery fees, and let customers order for pickup or delivery. There is no online payment: orders are paid by cash or card on delivery. A live dashboard queue and kitchen display show new orders in real time, with accept/reject and ETA, driver assignment, and role-based access so kitchen staff only see what they need. Available as a paid add-on.
New Feature
Payments
Accept card payments straight from your bio page. Add a Pay block, set a price, and customers check out by card. Payments run on your own connected Stripe account, so the money lands with you and you keep the customer relationship. Every payment is tracked in a payments dashboard. Available on Growth and above. Correction (September 2026): card payments are not switched on yet. You can connect Stripe and build Pay blocks, but a visitor cannot pay by card until MASK completes commercial validation.
New Feature
Event Check-in
Check attendees in at the door with unique QR tickets, a phone-based scanner, race-safe duplicate detection, and a live headcount. Generate numbered tickets or import your guest list, then download or print them. Included on Enterprise and available as a per-event add-on.
New Feature
QR Code Designer & Bulk QR
Design branded QR codes with custom colors, gradients, dot and corner styles, and a center logo, then download as PNG, SVG, or PDF. Need lots at once? Generate up to 20 in a batch from a list or CSV, in both the tool and the API. Codes are rendered in-house, so your links never leave MASK.
Improvement
Link Expiry, Renewal & Language Routing
Set links to expire by date or click count, and renew an expiring link from your dashboard with a quick password confirm. Smart links also gained language-based routing. Send visitors to the right destination by their browser language, alongside device, country, schedule, and A/B rules. (Renewal was retired on 2026-09-19, when free links stopped expiring.)
New Feature
UTM Templates & Bulk UTM
Save reusable UTM campaign templates and generate tagged URLs in bulk from a CSV. Build a whole campaign's links in one pass, then export the results.
Improvement
Campaign Tracking on Every Plan
Campaign tracking is now available on the free Hobby plan (one campaign), with 10 on Growth and unlimited on Enterprise. Group your links and measure performance from day one.
New Feature
Zapier & Expanded Integrations
Zapier support lands. Send MASK events to 6,000+ apps through a "Webhooks by Zapier" Catch Hook. WordPress, Webflow, Stripe, and custom webhooks join Slack, Google Sheets, and Shopify, each with per-event delivery logs and one-click replay. Correction (September 2026): the named integrations (Slack, Google Sheets, Shopify, WordPress, Webflow, Stripe) do not receive events yet. Webhooks are live and deliver MASK events to any URL you control, including a Zapier Catch Hook.
Improvement
Trust & Transparency
A new Subprocessors page, plus clearer Privacy, Cookies, and Terms, including how data is handled for AI features, bot protection, and email sending.
New Feature
Mask AI: Instant Bio Pages
Describe your page in a sentence and Mask AI drafts a complete bio page: headline, bio, and buttons, ready to edit and publish. Available on Growth.
New Feature
Email Broadcasts
Send newsletters and announcements to your subscribers from your own sending domain. Bring your own SMTP or email provider. Compose, schedule, and track every send.
Improvement
Redesigned Bio Page Editor
A rebuilt drag-and-drop editor with smooth section reordering, autosave, and separate draft and published states. Nothing goes live until you publish.
Security
Account & Data Security Hardening
Two-factor authentication, encrypted integration credentials at rest, hashed link and report passwords, and SSRF-protected outbound requests.
June 2026
New Feature
Founding Creators Program
A founding program for early adopters: selected creators, freelancers and small businesses can apply for Growth access free for their first twelve months.
March 2026
Improvement
Affiliate Payouts
Choose how you are paid, by bank transfer, PayPal or Wise, and see each payout and your pending, approved and paid commissions in your affiliate dashboard.
New Feature
Affiliate & Referral Program
Earn 20% recurring commission by referring new users to MASK. Track referrals, payouts, and conversions from your dashboard.
New Feature
Client Workspaces for Agencies
Manage each client in its own workspace, with client-viewer and client-approver roles for sharing results and collecting sign-off. Client workspaces are part of Enterprise.
New Feature
Real-Time Intelligence (Add-on)
Live click alerts for sudden traffic spikes and unusual geographic activity, so you can react while a campaign is peaking. Available as a Growth add-on.
New Feature
Subscribers
Collect email subscribers through bio page sign-up forms, then manage your audience from the dashboard.
New Feature
Free Tools
A suite of quick generators: short links, QR codes, UTM URLs, WhatsApp click-to-chat links, and email signatures, usable with a free account.
