Privacy

1. What we collect when you make a link

The destination address you paste, the short code we mint for it, and when it was made. If you're signed in, it's attached to your account; if you're not, it's attached to an anonymous token in a cookie so we can hand you your links if you sign up later.

We also fetch the destination's public preview data (its title, description, and preview image) so link previews and our own preview page can show what's there, and we check the address against Google Safe Browsing.

2. What we collect when someone clicks a link

Per click, we record: the time, the referring site (if the browser sends one), the device type and browser parsed from the user-agent, the country from network geolocation, and an irreversible IP hash salted with a key that rotates every day.

That last part matters. We never write the raw IP address to disk. The daily salt means the same visitor looks like the same person for one day — enough to count approximate uniques — and stops being linkable the next. It cannot be reversed into an address, by us or by anyone who takes our database.

We don't fingerprint browsers, we don't run trackers on the interstitial, and we don't build profiles across links.

3. How long we keep it

Individual click rows are kept for 90 days, then deleted. Before they go, they're rolled into anonymous daily totals — clicks per day, per country, per referrer, per device — which we keep indefinitely so your all-time chart doesn't develop amnesia. Those rollups contain no per-visitor rows and no hashes.

Links and account records are kept until you delete them.

4. Cookies — and why there's no banner

We set exactly two kinds of cookie, both strictly necessary: a session cookie that keeps you signed in, and an anonymous claim token so links you made before signing up can follow you into your account. Password and email gates set a short-lived cookie recording that you already passed one, so you aren't asked twice.

No advertising cookies, no analytics cookies, no third parties riding along. That's the entire reason this site doesn't throw a consent dialog at you: there's nothing to consent to. If we ever add a third-party ad network, that changes, and we'll say so here before it does.

5. Ads

Free links show an interstitial with an ad slot. At launch that slot only ever contains our own house ads — us telling you about the $3 and $12 upgrades. There is no third-party ad network, so no outside company is watching the interstitial or learning anything about the people who see it.

6. Email

If you make an account, we have your email address. We use it to sign you in (that's the whole point of a magic link), to send receipts, and to tell you things you'd want to know about your own links. Transactional email is sent through Postmark, which processes it on our behalf. We never ask for a password, a name, or anything else.

If a link you created captures emails from visitors, those addresses belong to you and are shown only to you — we don't market to them.

7. Payments

Payments are processed by Stripe. Card numbers go directly to Stripe and never touch our servers — we couldn't show you your own card number if you asked. What we keep is what a receipt needs: which upgrade you bought, when, how much, and Stripe's reference for it.

8. Who else touches the data

Only the services it takes to run this: our hosting and database providers, Stripe for payments, Postmark for email, and Google Safe Browsing for destination screening. We don't sell data, we don't share it for advertising, and we hand it over to anyone else only if the law actually requires it.

9. Your data, your call

From your account page you can export everything we hold about you, and delete your account — which removes your links, your captured emails, and your account record. Deletion is real deletion, not a hidden flag. Anonymous daily rollups survive, because by then they're not about anyone.

If you're in the EU or UK, those are your GDPR access, portability, and erasure rights, and the buttons are right there — you don't have to email anyone to use them.

10. Questions

Privacy questions and data requests: support@itsonthis.link. Abusive links: abuse@itsonthis.link. We'll update this page when what we collect changes, and the date at the top will say when.