ShortURL, the URL shortening and link analytics service at shorturl.so, console.shorturl.so and shrt.example, is operated by ShortURL's operator (details to be confirmed), based in to be confirmed ("we", "us", "our"). We are the controller of the personal data described in this policy. For privacy questions and requests, write to hi@shorturl.so. This Privacy Policy explains what data we collect, why we collect it, how we use it, where it is stored, and your rights in relation to it.
Payments are handled by Paddle.com, our Merchant of Record. If you buy a paid plan, Paddle processes your payment and billing data as an independent controller, and your card and bank details are entered on Paddle's checkout and never reach our servers. What we keep about a purchase is listed in section 1.6. This policy applies now to every purchase made from today, and to all other use of the Service from the effective date above.
1. Data We Collect
1.1 Account data (registered users)
When you create an account, we collect:
- Email address: used for authentication and service communications.
- Password: stored as a hashed credential via AWS Cognito. We never store plain-text passwords.
- Account creation timestamp and basic account metadata, including your workspace, your role in it and its current plan.
- First and last name, if you choose to add them on your profile page. These are optional and you can clear them at any time.
- Your answer about marketing email, together with the date you gave it, so that we can show what you chose and when.
We do not collect your phone number or postal address for your account. If you buy a paid plan, Paddle collects payment details as described in 1.6.
1.2 Link data
When you create a short link, we store:
- The destination URL you provide.
- A generated short slug (e.g.
shrt.example/abc123). - An optional title for the link.
- The creation timestamp.
- Whether the link is active or inactive.
For guest links (created without an account), we additionally store an anonymous guest token, a random 32-character string, in your browser's local storage. This token is used solely to allow you to claim the link into a registered account later. It is not linked to any personal identity.
1.3 Click analytics data
Every time someone clicks one of your short links, we automatically record the following data associated with that click event:
- IP address: the visitor's IP address, stored in full with the click record and kept for as long as that record (section 6).
- Country and city: estimated from the visitor's IP address by our network provider, Cloudflare, which passes them to us with the request. We do not record region, postal code or coordinates.
- Device type: e.g. Mobile, Desktop, Tablet.
- Browser: e.g. Chrome, Safari, Firefox.
- Operating system: e.g. iOS, Android, Windows, macOS.
- Referrer URL: the page the visitor came from (if provided by the browser).
- User-agent string: used to parse device/browser/OS data.
- Source: whether the click came from scanning the link's QR code.
- Timestamp of the click.
This click data is visible to the members of the link's workspace in the console. It is not shared publicly or sold to third parties.
1.4 Usage and technical data
We use Vercel Analytics and Vercel Speed Insights on our website and console. These tools collect anonymised usage data such as page views, web vitals (LCP, FID, CLS), and referrer information. No personally identifiable information is shared with Vercel beyond what is strictly necessary for these tools to function.
We also use PostHog (PostHog, Inc., on its US-hosted cloud) for product analytics on shorturl.so and console.shorturl.so. It records the pages you view, the buttons and links you click (such as "Shorten", "Copy" or a sign-up link), how far you scroll, page performance (web vitals) and errors in the page, together with your browser, device, approximate country and the site that referred you. It also uses these clicks and scrolls to produce heatmaps of our pages. If you sign up, the activity of your visit is linked to your account so we can see how people find and use ShortURL.
The analytics events we send PostHog do not include the destination URLs you shorten, your short links or their slugs, the text you enter into our free tools, or the contents of a report made through the grievance form (only the category you picked), and they do not include link passwords, API keys or guest tokens. Session recordings, described next, are different.
Session recordings. PostHog also records your visits to shorturl.so and console.shorturl.so (session replay): the pages as you saw them, your mouse movements, clicks and scrolls, and what you type into our forms. These recordings are not masked, except the password you type to log in, sign up or set a new password, which is hidden. Otherwise they capture what is on the screen and what you type, which can include your email address, the links you create, and link passwords or API keys entered or shown on our pages. Card and bank details are typed into Paddle's checkout, which our recordings cannot capture. We watch recordings only to find and fix problems and to improve the Service.
We use this data only to understand and improve the Service; it is not used for advertising and is never sold.
Standard server logs may include IP addresses for security and debugging purposes. These are retained for a limited period and are not used for tracking.
1.5 Surveys and support chat
In the console we sometimes ask a short question, such as how likely you are to recommend ShortURL, and offer a Feedback tab. If you answer, your answers are stored with PostHog together with the usage data described in section 1.4.
shorturl.so and console.shorturl.so also have a support chat, run on PostHog. When you write to us there, your messages and the email address (and name, if you give one) that you enter in the chat form are stored with PostHog so that we can answer you. The conversation is linked to the usage data of your visit (the pages you viewed and the events described in section 1.4), so that we can see what went wrong.
What you write in a survey answer or a chat message reaches PostHog as you wrote it, so please don't include passwords or API keys.
1.6 Payment and billing data (paid plans)
Paid plans are sold through Paddle.com ("Paddle"), our online reseller and the Merchant of Record for all our orders. When you buy a paid plan, Paddle collects the details it needs to take the payment and calculate tax, such as your email address, country, postal code and card details, on its own checkout. Paddle processes that payment and billing data as an independent controller, under its own privacy notice. No card data touches our servers.
We store only:
- Paddle identifiers: the ids Paddle gives your customer record, subscription, price and latest transaction.
- Subscription status: the plan, billing cycle, current billing period, and whether the subscription is active, cancelled or ended, with the workspace it belongs to and the account that bought it.
- The checkout email: the email address you paid with, used to attach the purchase to your ShortURL workspace.
We also log each notification Paddle sends us about a subscription (its type, the subscription id and when it arrived), not the payment details.
2. How We Use Your Data
- To operate the Service: creating and resolving short links, displaying analytics dashboards, and managing your account and workspace.
- To authenticate you: verifying your identity when you log in via AWS Cognito.
- To provide analytics to you: showing you click data for your workspace's links.
- To sell and run paid plans: passing your order to Paddle, applying your plan's limits, setting up the features provided with support, and handling renewals, cancellations, refunds and billing support.
- To keep accounting and tax records that the law requires.
- To answer your support requests: using the messages and contact details you give us by email or in the support chat.
- To improve the Service: using usage data and session recordings to understand how the platform is used and to fix problems.
- To ensure security: detecting abuse, spam links, and malicious activity.
- To communicate with you: sending account and billing emails, such as email verification and notice of changes to plans, prices or these policies. We do not send marketing emails without your consent.
3. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, our legal bases for processing your data are:
- Contract performance: processing your account data, links and subscription to provide the Service and the plan you have requested.
- Legitimate interests: security monitoring, fraud prevention, and service improvement using analytics and session recordings.
- Legal obligation: retaining billing and other records where required by law, such as for tax and audit.
- Consent: sending you marketing email, only if you agreed to it. You can withdraw your consent at any time.
4. Data Sharing & Third Parties
We do not sell your personal data. We share data with third parties only as follows:
- AWS (Amazon Web Services): our infrastructure provider. Your account data is stored in AWS Cognito (authentication) and a PostgreSQL database on Amazon RDS; our cache and server logs also run on AWS. All of it is in AWS's us-east-1 region, in the United States. AWS processes data under its own privacy and security standards.
- Vercel: hosting for our website and console frontends. Vercel Analytics and Speed Insights collect anonymised performance data.
- PostHog (PostHog, Inc., United States): product analytics, heatmaps, session recordings and error tracking for our website and console, and our in-product surveys and support chat, hosted on PostHog's US cloud. It receives the data described in sections 1.4 and 1.5, under its own privacy and security standards.
- Cloudflare: our network provider for the short-link domain, the website and our API. It estimates each click's country and city from the visitor's IP address and passes them to us; it is our only source of location data. The IP address itself is also stored with the click record (see 1.3).
- Paddle (Paddle.com): our online reseller and Merchant of Record (see 1.6). It sells our paid plans and processes your payment and billing data as an independent controller, under its own privacy notice. To prefill the checkout we send it the plan you choose and your email address (and your country, if we know it), and we attach our ids for your workspace and account to the order as custom data. It collects your payment details directly and tells us the result.
No other third parties receive your personal data, except where the law, a court order or a government notification requires us to disclose it.
Where your data is stored, and transfers across borders. We are based in to be confirmed. Our database, cache and logs are stored in the United States (AWS us-east-1), and analytics and session recordings in PostHog's US region; Paddle processes payment and billing data under its own privacy notice, in countries that may be outside your own. Your data is therefore transferred to and processed in countries other than your own, which may have different data protection laws. We use providers that protect data under their own contractual and security commitments.
5. Cookies & Local Storage
We use minimal client-side storage:
- Authentication cookie (
shorturl_token): a JWT token set when you log in. Used to authenticate your requests to the API. It is a session-level cookie with no persistent tracking purpose. - Guest link local storage (
shorturl_guest_link): stores your guest link data in your browser's local storage so your link persists across page refreshes. This is never sent to our servers unless you choose to claim the link. - Analytics cookie (PostHog,
ph_…_posthog): a first-party cookie, with a copy in local storage, set on.shorturl.soand shared by shorturl.so and console.shorturl.so. It holds a random anonymous ID and the current session, so a visit to the website and a later sign-up in the console count as the same visitor. It lasts up to one year. When you create a link without an account, this anonymous ID is also sent with that request so the link can be counted for the same visitor. - Checkout session storage (
shorturl:activation:<transaction id>): after you pay on shorturl.so, the plan, the billing cycle, the time of payment and the email address you paid with are kept in your browser's session storage under that payment's transaction ID, so reloading the page shows the payment's status instead of offering to pay again. It is read only by that page, which uses it to ask our API whether the plan is active, and it is cleared when you close the tab. - Paddle checkout: when you pay, Paddle's checkout opens on shorturl.so (and on our console once Paddle approves that domain) and may use its own cookies and storage for payment security and fraud prevention, under Paddle's policy.
We do not use advertising cookies or tracking pixels. Beyond Vercel's anonymised performance tooling, the only analytics storage is PostHog's first-party cookie described above.
6. Data Retention
- Account data: retained for as long as you have an account. To close an account, write to us and we will do it by hand, after cancelling any paid plan on its workspace. We keep a record of the registration afterwards for as long as applicable law requires.
- Link data: retained for the lifetime of your account or until you delete the link.
- Click analytics data, including the IP address stored with each click: retained while your account is active and the link exists. Your plan decides how far back the console's analytics dashboard reaches: Free 30 days, Pro 90 days, Premium 6 months, Team 1 year, Enterprise lifetime. Each link's own statistics and click list cover all its clicks. Older click data is retained, not deleted, and the dashboard reaches it again if the workspace moves to a plan with a longer history.
- Billing records: the Paddle identifiers, subscription history and checkout email are kept for about 8 years for tax and audit purposes. If your account or workspace is deleted, they are kept detached from it until that period ends.
- Guest link data: retained for a reasonable operational period. Unclaimed guest links may be deleted after an extended period of inactivity.
- Server logs: retained for up to 30 days for security purposes.
- Reports about links: kept after we have acted on them, so that we can account for what we did if we are asked about it later.
We may retain information for longer where a law, a court order, or a government notification requires it, or where it is needed to investigate abuse of the Service.
7. Security
We take reasonable technical and organisational measures to protect your data, including:
- All data in transit is encrypted via HTTPS/TLS.
- Passwords are managed by AWS Cognito and are never stored in plain text.
- Database access is restricted to authenticated application processes only.
- Card and bank details are entered on Paddle's checkout and never reach our servers.
No system is completely secure. If you believe your account has been compromised, please contact us immediately at hi@shorturl.so.
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Rectification: request correction of inaccurate data.
- Erasure: request deletion of your account and associated data.
- Portability: request your data in a machine-readable format.
- Objection: object to processing based on legitimate interests.
- Restriction: request that we limit how we process your data.
To exercise any of these rights, email us at hi@shorturl.so. We will respond within 30 days. Billing records we must keep by law (section 6) are kept until their retention period ends, even after an erasure request.
9. Children's Privacy
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, for registered users, send a notification to your registered email address before the change takes effect.
11. Grievance Officer
If you have a complaint about how we handle your personal data, you can write to our Grievance Officer. We acknowledge a complaint within 24 hours and resolve it within 15 days.
Grievance Officer, ShortURL
Email: grievances@shorturl.so
12. Contact
For any privacy-related questions or requests, please contact us at hi@shorturl.so. The Service is operated by:
ShortURL
Operated by: ShortURL's operator (details to be confirmed)
Location: to be confirmed
Support and billing: support@shorturl.so
General and legal: hi@shorturl.so
Grievances: grievances@shorturl.so
See also our Terms of Service.