Privacy Policy

Last updated: January 30, 2026

1. Information We Collect

We collect information you provide directly to us when you:

  • Create an account (name, email, password)
  • Create shortened URLs
  • Add notes to your links
  • Contact us for support

1.1 Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

  • Contract Performance: Processing necessary to provide our URL shortening service
  • Legitimate Interest: Improving our service, preventing fraud, and ensuring security
  • Consent: For analytics and marketing cookies (where applicable)
  • Legal Obligation: Compliance with applicable laws and regulations

2. Analytics Data

When someone clicks on a shortened URL, we automatically collect:

  • IP address
  • Browser type and version
  • Operating system
  • Device type (mobile, tablet, desktop)
  • Referrer URL
  • Geographic location (country/region)
  • Timestamp of the click

3. How We Use Your Information

  • To provide and maintain our service
  • To provide analytics for your shortened URLs
  • To communicate with you about your account
  • To improve our service
  • To detect and prevent fraud or abuse

4. Data Security

We implement industry-standard security measures including:

  • Bcrypt password hashing
  • HTTPS encryption for all connections
  • CSRF protection on all forms
  • XSS prevention on all outputs
  • SQL injection protection
  • Rate limiting to prevent abuse

5. Data Retention

We retain your data as follows:

  • Account Data: For as long as your account is active or as needed to provide services
  • Link Analytics: Indefinitely, unless you request deletion
  • Cookies: As specified in our cookie policy (typically 1 year)
  • Backup Data: Up to 90 days in encrypted backups

You can request deletion of your account and associated data at any time by contacting us.

6. Third-Party Services

We may use third-party services for:

  • IP geolocation (to determine visitor location)
  • Payment processing (for Gold and Platinum plan subscriptions)
  • Email delivery

6.1 Payment Information

We use trusted third-party payment processors to handle subscription payments:

  • PayPal: For PayPal payments, you will be redirected to PayPal's secure platform. We do not store your PayPal credentials.
  • Stripe: For credit/debit card payments, we use Stripe. Card information is processed directly by Stripe and never stored on our servers.

When you make a payment, we share necessary information (name, email, subscription details) with these processors to complete the transaction. Both PayPal and Stripe are PCI-DSS compliant and maintain industry-standard security measures.

We retain transaction records (amount, date, subscription type) for accounting and customer support purposes, but we do not store full payment card details.

7. Cookies

We use cookies to:

  • Maintain your login session
  • Remember your preferences
  • Provide CSRF protection

7.1 Cookie Categories

Essential Cookies: Required for authentication, security, and core functionality. These cannot be disabled.

Analytics Cookies: Help us understand how visitors use our service to improve user experience.

Preference Cookies: Remember your settings and preferences for a better experience.

8. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right to Access (Article 15): Request a copy of your personal data
  • Right to Rectification (Article 16): Correct inaccurate or incomplete data
  • Right to Erasure (Article 17): Request deletion of your data ("Right to be Forgotten")
  • Right to Restrict Processing (Article 18): Limit how we use your data
  • Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format
  • Right to Object (Article 21): Object to processing based on legitimate interests
  • Rights Related to Automated Decision-Making (Article 22): We do not use automated decision-making or profiling

To exercise any of these rights, please contact us.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions for data transfers to countries with adequate protection
  • Encryption and security measures during transit and storage

10. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your GDPR rights, please contact us.