Privacy Policy

1. Introduction

We aim to collect as little as possible and to be plain about what we do collect. This policy applies to the urlr website, dashboard, and API.

2. Information We Collect

• Account information — your email address, an optional display name, and a securely hashed password.
• Link data — the destination URLs you shorten, any custom aliases, expiration settings, and the short codes we generate.
• Click / analytics data — for each redirect we record a timestamp, the referring website, an approximate country derived from the visitor's IP address, and a device/browser type parsed from the user-agent string. We store a one-way hash of the IP address, never the raw IP.

3. How We Use Information

We use this information to operate the service: to create and resolve short links, to show you analytics for your own links, to secure your account, and to prevent abuse. We do not sell your personal information or your click data.

4. Cookies & Tracking

We use strictly necessary cookies to keep you signed in (a session/auth cookie) and to protect forms against cross-site request forgery. We do not use third-party advertising cookies. See our Cookie Policy for details.

5. Data Retention

We retain account and link data for as long as your account is active. Click analytics are retained to power your dashboard. When you delete a link or your account, the associated data is removed from our active systems.

6. Third-Party Services

We keep third parties to a minimum. Geolocation is performed with a local database that runs on our own servers, so visitor IP addresses are not sent to an external geolocation provider. We rely on standard infrastructure providers (hosting, database, and an email provider used only to send password-reset messages).

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. You can delete your account and all associated links from your account settings, or contact us to make a request.

8. Data Security

Passwords are hashed with bcrypt, sessions use signed, http-only cookies, and traffic is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.

9. Children's Privacy

urlr is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will remove it.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate we will notify you.

11. Contact Us

Questions about this policy? Email privacy@urlr.io.