This policy explains what Shorturlfy collects, why, who else sees it, and what you can ask us to do about it. It covers two different groups of people: those who hold a Shorturlfy account, and those who simply click a Shorturlfy short link. We have tried to describe what the service actually does rather than what is customary to say.
1
Who Runs Shorturlfy
- –Shorturlfy is operated by Gyanendra Singh, an individual sole proprietor based in India. There is no incorporated company behind the service.
- –For the purposes of India's Digital Personal Data Protection Act, 2023, Gyanendra Singh is the data fiduciary responsible for the personal data described in this policy.
- –Postal address: Sector 107, Noida, Uttar Pradesh 201301
- –Privacy contact: privacy@shorturlfy.com
2
Information We Collect From Account Holders
- –Account details: your email address, a username, and — if you register with a password — a hashed version of that password. We never store your password in readable form.
- –Social sign-in: if you sign in with Google or Facebook instead, we receive and store your email address, your name as that provider reports it, the provider's name, and the provider's ID for you. We do not receive your password, and we do not post anything to those accounts.
- –Email verification: a short numeric code sent to your email address, stored until it is used or expires.
- –Links you create: the destination URL, the short code, when it was created, and any expiry date or click limit you set.
- –API keys: if you create one, we store the key's name, its first few characters, and an irreversible SHA-256 hash of the key itself — never the key. We also record when it was created, last used, and revoked.
3
Information We Collect From People Who Click Short Links
- –This section is about visitors, not account holders. If you click a Shorturlfy short link, we record the visit even though you do not have an account with us.
- –For each click we store: the time, the full IP address of the visitor, the browser user-agent string, the referring page if the browser sends one, and the device type, browser, and operating system we derive from the user-agent.
- –We may also store an approximate country and city, worked out from the IP address by ip-api.com, a third-party location service. This means that when location analytics are switched on, visitor IP addresses are sent to that provider. It is off by default, and when it is off nothing is sent to anyone.
- –We store a 'visitor hash' so a link's owner can see roughly how many distinct people clicked, rather than only a raw total. It is a SHA-256 hash of the IP address, the user-agent, the current date, and a secret value we hold. Because the date is part of it, the hash changes every day and cannot be used to follow anyone over time or across different websites.
- –We process this data to operate the redirect, to give the link's owner their click statistics, and to detect abuse of the service. If you are in a jurisdiction that requires a legal basis, we rely on our legitimate interest in running and protecting the service.
- –An IP address can be personal data. If you clicked a Shorturlfy link and want the records relating to you deleted, email us at privacy@shorturlfy.com with the approximate date and the short link, and we will locate and remove them.
4
Cookies & Tracking
- –Shorturlfy sets no cookies at all — not for sessions, not for analytics, not for advertising.
- –We do not embed Google Analytics, advertising pixels, or any third-party tracking or session-recording script. There are no third-party scripts on our pages.
- –When you log in, your session token is stored in your browser's local storage on your own device. It is sent to us only when your browser makes a request to Shorturlfy, and clearing your browser data signs you out.
- –Unique-visitor counts on your links are worked out on our server using the daily-rotating hash described above. No identifier is written to a visitor's browser.
5
How We Use Your Information
- –To run the service: resolving short links, showing your dashboard, and enforcing expiry dates and click limits you have set.
- –To produce the analytics shown to you as a link owner: click totals, approximate unique visitors, referrers, devices, browsers, and time-of-day patterns.
- –To send you transactional email: your email verification code, and administrative messages about your account.
- –To enforce plan limits: we count how many links you have created in the current month, and we count anonymous link creation per IP address to limit automated abuse.
- –To keep the service safe: identifying spam, phishing, malware, and other misuse of short links.
- –We do not sell, rent, or trade your personal information, and we do not use it for advertising.
6
Who Else Processes Your Data
- –Application hosting: Render, which runs our backend service.
- –Database hosting: Neon, which stores the data described in this policy.
- –Website hosting: Netlify, which serves the Shorturlfy website and dashboard.
- –Email delivery: Resend, which delivers our transactional email. Only your email address and the content of the message are shared with them.
- –Sign-in providers: Google and Facebook, but only if you choose to sign in with one of them.
- –Location lookup: ip-api.com. When location analytics are switched on, we send them the visitor's IP address and they return an approximate country and city. The IP address is the only thing sent — not the link that was clicked, not the referring page, and nothing about the account that owns the link.
- –These providers operate servers outside India, including in the United States and Europe, so your data may be stored and processed outside your country of residence.
- –We currently have no payment processor. Paid plans are arranged by email and activated manually, and we do not collect or store card or bank details anywhere in the service.
7
How Long We Keep It
- –Account data is kept for as long as your account exists.
- –Links and their click records are kept for as long as the link exists. We want to be direct about this: we do not currently run an automatic deletion schedule, so click records — including visitor IP addresses — are retained indefinitely until the link or the account is deleted. We intend to introduce a fixed retention period and will update this policy when we do.
- –Email verification codes expire shortly after they are issued.
- –Records of administrative actions taken on the service, including the acting administrator's email address, are kept as a security audit trail.
- –When we delete an account, its links and the click records attached to them are deleted with it.
8
Your Rights & How To Exercise Them
- –Access: you can see your links and their analytics in your dashboard at any time. For a copy of everything else we hold about you, email privacy@shorturlfy.com.
- –Correction: email us and we will correct inaccurate account details.
- –Deletion: go to Settings and choose Delete account. This immediately and permanently removes your account, every link you created, and all click records attached to those links — including the visitor IP addresses. It cannot be undone, and your short links stop resolving straight away. If you would rather we did it for you, email privacy@shorturlfy.com from the address on your account and we will complete it within 30 days.
- –Portability: Pro accounts can export analytics as CSV, and bulk-created links can be downloaded as CSV. For a full export of your account data, email us.
- –Withdrawing consent: if you signed in with Google or Facebook, you can disconnect Shorturlfy from your account with that provider at any time. Doing so prevents future sign-ins but does not by itself delete data we already hold — ask us to delete it if that is what you want.
- –If you are in the European Economic Area or the United Kingdom, you also have the right to object to processing and to complain to your local data protection authority.
- –If you are in India, you may raise a complaint with the Data Protection Board of India, and you may nominate another person to exercise your rights in the event of death or incapacity.
9
Security
- –Passwords are stored using a one-way hash. API keys are stored only as SHA-256 hashes and are shown to you exactly once, at creation.
- –All traffic between your browser and Shorturlfy is encrypted in transit over HTTPS.
- –Access to the administrative console is restricted, and administrative actions are recorded in an audit log.
- –No service can promise perfect security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.
10
Children
- –Shorturlfy is not intended for children. Under India's Digital Personal Data Protection Act, 2023, a child is anyone under 18, and we do not knowingly process a child's personal data without verifiable parental consent.
- –If you believe a child has created an account, contact us at privacy@shorturlfy.com and we will remove it.
11
Changes To This Policy
- –We will post any changes on this page and update the date shown at the top.
- –If a change materially affects how we handle your personal data, we will tell account holders by email before it takes effect.
12
Contact & Grievances
- –Privacy questions and requests: privacy@shorturlfy.com
- –Grievance Officer: Gyanendra Singh, contactable at grievance@shorturlfy.com. In line with India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we will acknowledge a complaint within 24 hours and resolve it within 15 days of receipt.
- –Gyanendra Singh, sole proprietor trading as Shorturlfy · Sector 107, Noida, Uttar Pradesh 201301 · India