Privacy Policy

At ShortLink (“we”, “our”, or “us”), we take your privacy seriously. We operate with a core commitment to data minimization and privacy by design: we do not sell your personal information, we do not engage in invasive cross-site user fingerprinting, and we collect only the minimal data strictly necessary to shorten URLs, provide click analytics, serve advertisements, and protect our infrastructure from abuse.

This Privacy Policy explains what information we collect when you visit our website, use our shortening tools, generate QR codes, or click on a shortened link created via ShortLink, and how you can exercise your privacy rights.

1. Information We Collect

2. How We Use Your Information

We process collected information for the following legitimate purposes:

• URL Redirection: Resolving requested short slugs and delivering immediate HTTP 308 Permanent Redirects to destination URLs.
• Aggregate Analytics: Generating high-level click counters and analytics graphs (total clicks, daily timeline, device breakdown, top countries) accessible to the creator.
• Abuse & Threat Mitigation: Identifying and filtering automated bot traffic, crawlers, DDoS attacks, spam links, malware, and phishing attempts before logging clicks or routing traffic.
• System Reliability: Monitoring server performance, debugging operational errors, and ensuring high service availability.

3. Cookies and Local Storage

4. Data Sharing and Third-Party Vendors

We never sell, trade, or monetize your personal data. We share information only with trusted service providers who help us operate our infrastructure:

• Cloud & Hosting Infrastructure: Global edge compute providers (e.g., Vercel) and managed PostgreSQL cloud databases (e.g., Neon) that host our services under strict data processing agreements.
• Advertising Partners: Third-party ad networks that serve non-invasive display banners on our pages.
• Legal Compliance: When required by a valid court order, subpoena, or applicable law, or to investigate and protect against malicious cyber attacks or fraud.

5. Data Retention & Security

Short links remain active indefinitely unless they are set to expire, deleted, or removed due to an abuse report or terms violation. Aggregated click statistics are stored alongside the link record.

We implement industry-standard technical safeguards, including TLS 1.3 encryption in transit, strict rate limiting, cryptographic hashing of IP addresses, database firewalls, and least-privilege administrative access controls to safeguard all data.

6. Your Rights Under GDPR & CCPA/CPRA

Depending on your location (including the European Economic Area, United Kingdom, and California), you may have statutory privacy rights regarding your personal data, including:

• The right to access and receive a copy of data we hold about you.
• The right to rectify or update inaccurate personal information.
• The right to request deletion (“Right to be Forgotten”) of your links or submitted data.
• The right to object to or restrict certain types of data processing.
• The right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, please email us at privacy@shortlink.com. We will verify and process your request within statutory timeframes.

7. Children’s Privacy

ShortLink is not directed to children under the age of 13 (or under 16 in the EEA). We do not knowingly collect or solicit personal information from children. If you believe a child has provided us with personal data, please contact us immediately so we can promptly delete the information.

8. Changes to This Policy

We may periodically update this Privacy Policy to reflect enhancements to our service, security practices, or changes in legal regulations. When changes are made, the revised policy will be posted on this page with an updated “Last Updated” date.