Home · Privacy policy

Privacy policy

Last updated 30 August 2026

The short version: we store what is needed to run the links and count the clicks, nothing more. No advertising, no tracking cookies, no selling data to anybody.

On this page

What we collect
What we record when someone clicks a link
Cookies
Why we process this data
Who we share it with
How long we keep it
Your rights
Security
Children
Contact

1. What we collect from account holders

Email address — to identify your account and let you recover access.
Username — shown on your account and used in page addresses you choose.
Password — stored only as a bcrypt hash. We never see or store the password itself.
Your links and bio pages — destinations, slugs, titles and settings you enter.
API keys — stored only as SHA-256 digests. The key itself is shown once at creation and never again.
Sign-in timestamp — the time of your most recent login.

2. What we record when someone clicks a link

When a short link is visited, one row is written so the link's owner can see their statistics. That row contains:

A salted hash of the IP address — not the address itself. It exists only to tell repeat visits apart, and cannot practically be reversed.
Browser, operating system and device type — derived from the user-agent string, and deliberately coarse ("Chrome", "Android", "Mobile").
Referring domain — the site the visitor came from, if any. Only the hostname is kept, never the full URL.
Country — only if the hosting provider supplies it. No lookups are made against third-party services.
Timestamp — the date and time of the click.
A bot flag — whether the request looked like a crawler or a chat-app link preview.

We do not store raw IP addresses, we do not fingerprint browsers, and we do not follow visitors across sites. There is no advertising network involved at any point.

3. Cookies

One cookie is used: a session cookie that keeps you signed in to the dashboard. It is HttpOnly, SameSite=Lax, and marked Secure over HTTPS. It is removed when you sign out.

Visitors who merely click a short link are not given a cookie at all. There are no analytics or advertising cookies anywhere on the service.

4. Why we process this data

To provide the service — a link cannot redirect without its destination stored.
To give link owners their statistics — the feature people come for.
To keep the service working — rate limiting and abuse prevention.
To secure accounts — hashed passwords and hashed API keys.

Where GDPR applies, the lawful basis is performance of a contract for account data, and legitimate interests for coarse, non-identifying click statistics and abuse prevention.

Nobody. Data is not sold, rented or shared with advertisers or data brokers. The only third party involved is the hosting provider that runs the server, and a web font service used to load the page typeface.

We may disclose information if legally required to do so by a valid legal process.

6. How long we keep it

Account data — until you delete your account.
Links and bio pages — until you delete them.
Click records — deleted along with their link. Deleting a link removes its entire click history immediately.
Rate-limit counters — discarded automatically after 24 hours.

7. Your rights

Depending on where you live, you may have the right to:

Access the personal data held about you.
Correct anything inaccurate — email and username are editable from your account.
Delete your data. Deleting your account removes your links, pages and click history permanently.
Export your data. Everything about your links and pages is retrievable through the API in JSON.
Object to processing, or lodge a complaint with your local data protection authority.

8. Security

Passwords use bcrypt. API keys are stored as SHA-256 digests and shown only once. All database access uses prepared statements. Destination URLs are validated to block non-HTTP schemes and private network ranges, so the redirector cannot be used to probe internal systems. Sessions are regenerated on login and protected with CSRF tokens.

No system is perfectly secure. If you find a vulnerability, please report it privately via the contact page.

9. Children

The service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, get in touch and it will be removed.

10. Contact

Questions about this policy, or a request about your data, can go to the address on the contact page. See also the terms of service.