Privacy Notice

Last updated: July 19, 2026

This Privacy Notice explains how url shortner ("we", "us", "our") collects, uses, and shares personal data when you use our link-shortening service (the "Service"). url shortner is the data controller of the personal data described here.

1. Personal data we collect

• Account data: name, email address, hashed password, authentication provider identifiers (Google, GitHub).
• Link data: destination URLs, custom aliases, UTM parameters, expiration settings you create.
• Usage/telemetry: click events on your short links, including timestamp, referrer, device type, browser, operating system, and coarse geolocation derived from IP.
• Support messages: any information you provide when contacting us.
• Billing data: collected and processed by our Merchant of Record, Paddle (see below).

2. Purposes and legal bases

• Provide the Service (account creation, redirects, analytics): performance of contract.
• Security and fraud prevention: legitimate interests.
• Product improvement and aggregated analytics: legitimate interests.
• Customer support: performance of contract / legitimate interests.
• Marketing emails (only if you opt in): consent, withdrawable at any time.
• Legal obligations (tax, accounting, responding to lawful requests): legal obligation.

3. Sharing and subprocessors

We share personal data only with:

• Service providers / subprocessors: hosting, database, email delivery, analytics tooling.
• Merchant of Record — Paddle: Paddle.com Market Ltd handles payments, subscription management, invoicing, and sales tax compliance for all purchases.
• Professional advisers: legal, accounting, insurance.
• Authorities: when required by law or to protect our rights.

4. International transfers

Personal data may be processed outside your country of residence, including in the United States and the EEA. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

5. Retention

We keep account data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations. Click analytics are retained for up to 24 months and then aggregated or deleted. You can delete your account at any time by contacting us.

6. Your rights

Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, or port your personal data, to object to processing, and to withdraw consent. EEA/UK users may lodge a complaint with their local supervisory authority. We respond to verified requests within one month.

7. Security

We apply appropriate technical and organisational measures including encryption in transit, hashed credentials, role-based access control, and row-level security on our database.

8. Cookies

We use strictly necessary cookies to keep you signed in and to remember preferences. We do not run third-party advertising cookies. Where analytics cookies are used, you can manage them through your browser settings.

9. Contact

For privacy questions or to exercise your rights, contact us through the in-app support channel.