Privacy Policy

Last updated October 24, 2026

shrtcd ("we", "us") is a private link shortener at shrtcd.com. Accounts are by invitation only. It also serves short links on custom domains that account holders connect to it, such as 4gb.us and fgr1.us. This policy explains what we collect, why, and what you can do about it.

If you click a short link

When you open a short link we redirect you to the address its owner chose and record a click. A click record holds:

• the time and which link was clicked;
• a one-way, salted hash of your IP address, used only to count unique visitors. We do not store your IP address itself;
• your approximate location (country, region and city), looked up from your IP address in an offline database at the moment of the click;
• your browser, operating system and device type, read from your browser's user-agent header;
• the website you came from (its domain name only, not the full page address);
• your browser's preferred language;
• any utm_source, utm_medium and utm_campaign values in the link;
• whether the request looked like it came from a bot or link-preview service.

Clicking a short link does not set any cookies, and we do not try to identify you or follow you across other websites.

The person or business that created the link can see click statistics for it. If they have set up a webhook, they also receive a notice of each click containing the time, the link, your country, device, browser and operating system, the referring domain, whether it looked like a bot, and the query string of the link you opened (for example a tracking code they added to an email they sent you). What the link's owner does with that information, and what happens on the site you are redirected to, is covered by their privacy policy, not this one.

If you have an account

We store your email address, your name if you give one, your password as a salted hash (never in readable form), when your account was created and when you last signed in, the links, custom domains, API keys and webhook settings you create, and who invited you. API keys are stored only as hashes. We use this to run your account and the service. We don't send marketing email.

Why we process this information

• To provide the service: redirecting links and showing link owners how their links perform.
• To keep the service secure and prevent abuse, including rate limiting and investigating reports of harmful links.
• To meet legal obligations.

Where privacy laws such as the GDPR apply, our legal basis is our legitimate interest in running and protecting the service (for click records and security), and our agreement with you (for account data).

Who we share it with

We do not sell or rent personal information, and we do not share it for advertising. We use no third-party analytics or advertising trackers. Information is shared only with:

• The link's owner, as described above.
• Cloudflare, which carries all traffic to the service and protects it from attacks. Cloudflare processes your IP address and request details to do this.
• MongoDB Atlas, which hosts our database.
• Authorities, when the law requires it, or when needed to protect people from harm or to enforce our Terms.

How long we keep it

• Click records are deleted automatically 24 months (730 days) after the click.
• Account data is kept while the account exists, and deleted within 30 days of a request to close it, apart from anything we must keep by law.
• Sign-in sessions expire after 30 days.

Your choices and rights

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to access, correct, delete or get a copy of your personal information, and to object to or restrict how we use it. Email [email protected] to make a request. We'll reply within 30 days and won't treat you differently for asking.

Because we never store IP addresses or set cookies on link clicks, we usually can't tell which click records relate to a particular visitor. If you're an account holder, we can export or delete everything tied to your account.

Security

All connections are encrypted with HTTPS. Passwords and keys are hashed, and access to our systems is restricted. No system is perfectly secure, but we work to protect your information and will notify affected people of a breach as the law requires.

Children

shrtcd is not directed at children under 16, and we don't knowingly collect their information.

Changes

If we change this policy we'll update the date above. For significant changes we'll also tell account holders by email.

Contact

Privacy questions and requests: [email protected].