1. Introduction
This Privacy Policy explains how the linkshrtn service (“linkshrtn”, “we”, “us”) handles personal data when you use linkshrtn.com, create an account, shorten a URL, follow a short link, or contact us. The service is operated from Arndstrasse 8, 33602 Bielefeld, Germany. This policy applies to the website, account dashboard, short-link redirects, contact forms, and administration functions.
2. Information we process
Account information
We process the name, email address, securely hashed password, account role and status, registration time, and last login time that are needed to provide and protect an account. We do not store plaintext passwords.
Shortened URL data
When you create a link, we process its destination URL, short code, title, notes, folder, tags, access rules, active state, and aggregate click count. A link password, when used, is stored as a one-way password hash.
Link-click analytics
For a successful redirect we record the link, time, referrer when supplied by the browser, a limited user-agent string, and derived browser, device, and operating-system categories. For unique-visitor estimation, the visitor IP address is transformed immediately with a secret-keyed HMAC hash. The application does not retain the raw IP address in click analytics. The hash is not designed to identify a natural person and changes if the application secret changes.
Technical and session information
We use a secure session identifier to maintain authentication and protect requests. Server logs may temporarily contain technical request information where necessary to diagnose errors, maintain availability, or investigate abuse. Application error logs are protected from public access and are not intended to contain passwords, database credentials, or application secrets.
Contact submissions
If you contact us, we store your name, email address, subject, message, submission time, and review status so we can respond and maintain an abuse-report record.
3. Purposes and legal bases
We process data to perform the service you request, create and secure accounts, deliver redirects, provide analytics and QR functionality, answer messages, enforce our Terms and Anti-Spam Policy, prevent fraud and abuse, maintain service integrity, comply with law, and establish or defend legal claims. Depending on the context, the legal basis under the GDPR may be performance of a contract or steps requested before a contract (Article 6(1)(b)), our legitimate interests in a secure and reliable service (Article 6(1)(f)), compliance with a legal obligation (Article 6(1)(c)), or consent where specifically requested (Article 6(1)(a)).
4. Cookies
linkshrtn uses an essential session cookie for authentication, request security, and short-link password access. The public interface also stores your cookie-banner choice in browser local storage. We do not implement advertising cookies, Google Analytics, Facebook Pixel, or third-party marketing trackers. See our Cookie Policy.
5. Retention
Account and link data are normally retained while the account remains active and thereafter only as reasonably necessary for security, dispute resolution, legal obligations, or backup integrity. Click analytics are subject to the administrator-configured retention period, which defaults to 365 days; routine removal may be performed by an administrator. Password-reset tokens expire after one hour and are unusable after a successful reset. Contact messages and abuse reports are retained only as long as necessary to respond, document action, and protect the service. Server backups may retain deleted data for a limited rotation period before being overwritten.
6. Service providers, disclosure, and transfers
Hosting, infrastructure, email delivery, backup, or professional support providers may process limited data on our behalf under appropriate obligations. The default application does not send core analytics to an external analytics API. We may disclose information when required by applicable law, a valid legal process, to protect users and the public, to investigate abuse, or in connection with a legitimate service reorganization subject to suitable safeguards. Where data is transferred outside the EEA or UK, we use an applicable legal transfer mechanism where required.
7. Security
Measures built into the application include password hashing, prepared database queries, CSRF protection, secure session cookies, output escaping, rate limits, domain blocking, role checks, protected configuration and log folders, security headers, and keyed visitor hashing. No online service can guarantee absolute security. Account holders must use a unique password and keep their credentials confidential.
8. Your rights
Subject to applicable law, including the GDPR, EEA, and UK GDPR where relevant, you may request access, rectification, deletion, restriction, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also lodge a complaint with the competent data-protection authority. Some rights are subject to identity verification and legal exceptions.
Residents of US states with applicable privacy laws may have rights to know, access, correct, delete, or obtain a portable copy of covered personal information, and to appeal a denied request. linkshrtn does not sell personal information and does not share personal information for cross-context behavioral advertising. We do not discriminate for exercising an applicable privacy right.
9. Children
The service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided data, contact us so we can review and remove it where appropriate.
10. Changes and contact
We may update this policy to reflect service, legal, or security changes. The “Last Updated” date identifies the current version. Material changes will be communicated where required. For questions or rights requests, email info@linkshrtn.com or write to linkshrtn, Arndstrasse 8, 33602 Bielefeld, Germany.