Privacy Policy
ashrt.link ("we", "us") is a link tracker: it creates short links that record a visit before forwarding it. This policy explains what we collect, why, and your choices. By using the service you agree to this policy.
Information we collect
- Account information. When you sign up we store your email address and name. If you register with a password, we store it only as a salted bcrypt hash, never in plain text. If you sign in with Google or GitHub, we receive your basic profile (name, email, and a provider account ID).
- Links you create. The destination URL, the short code or alias, an optional name, campaign and tags, and the creation time. We also store a one-way hash of the IP address the link was created from, which is used only for rate limiting and abuse investigation.
- Click data. When someone follows a short link we record the time, a per-day tally, and the country, device type, browser, operating system and referring site taken from the request. We do not build advertising profiles of visitors.
- Visitor identifiers. To tell a repeat visit from a new one we compute a one-way HMAC of the visitor's IP address and user agent, keep only the first 16 characters, and store that. We do not store raw IP addresses anywhere. The hash is salted with a secret that is specific to this deployment, so it cannot be matched against a precomputed table or compared across services. It is not reversible, and we cannot use it to identify anyone.
- Bot traffic. Automated requests (link previews from Slack, X, Facebook and similar, plus search and AI crawlers, monitors and scripts) are identified from the user agent and counted separately. No visitor identifier is computed for them.
- Abuse reports. If you report a link we store the report, the reason, any detail you write, and a one-way hash of your IP address so the same person reporting repeatedly is not counted as many.
- Cookies. A signed, HttpOnly session cookie keeps you logged in. Visitors who create a link without an account also get a signed, HttpOnly cookie containing a random identifier; it exists only to give each browser its own rate-limit allowance and to offer your links to you if you later sign up. It contains nothing about you. We do not use third-party advertising or tracking cookies, and the short links themselves set no cookie on the people who click them.
- Payment information. If you subscribe to Pro, payment is handled by Stripe. We never see or store your card number. We keep only a Stripe customer/subscription reference and your plan status.
How we use your information
- To operate the service: create and resolve short links and show you click statistics.
- To authenticate you and keep your account secure.
- To process subscriptions and manage your plan.
- To respond to support requests.
We do not sell your personal information.
Service providers
We rely on a few processors to run the service:
- Vercel for hosting.
- Upstash / Vercel KV for storing accounts, links, and stats.
- Stripe for billing on the Pro plan.
- Google and GitHub for optional sign-in.
Data retention
We keep your account, links, and their stats until you delete them or close your account. You can delete individual links from your dashboard at any time. To delete your account and associated data, contact us at the address below.
- Links created without an account are kept for 30 days and then stop working. Save one to a free account and it is kept until you delete it.
- Per-day click history on a link is kept for the most recent 730 days. How much of it your plan shows you is a separate question, set out on the pricing page. Lifetime totals are kept for as long as the link is.
- Visitor identifier hashes are stored in a probabilistic counting structure, which holds an approximation of how many distinct visitors there were rather than a list of them. Individual visits cannot be retrieved from it.
- Abuse reports and administrative records are kept while they are relevant to keeping the service safe.
What we cannot tell you about a visitor
It is worth being explicit, because link tracking is often assumed to do more than it does. We cannot tell you a visitor's name, email address, employer, or exact location, and we do not attempt to. We do not fingerprint browsers, we do not set cookies on people who click your links, and we do not follow anyone across sites. What you get is aggregate: how many, roughly where, on what kind of device, and from which referring site.
Your rights
You can access and delete your links from your dashboard, and request a copy or deletion of your account data by emailing us. Depending on where you live, you may have additional rights under laws such as GDPR or CCPA; we honor valid requests.
Children
The service is not directed to children under 13, and we don't knowingly collect their information.
Changes
We may update this policy. Material changes will be reflected by the "last updated" date above, and where appropriate we'll notify you.
Contact
Questions? Email support@ashrt.link.