Privacy

1. What we collect when you make a link

The destination address you paste, the short code we mint for it, and when it was made. If you're signed in, it's attached to your account; if you're not, it's attached to an anonymous token in a cookie so we can hand you your links if you sign up later.

We also fetch the destination's public preview data (its title, description, and preview image) so link previews and our own preview page can show what's there, and we check the address against Google Safe Browsing.

2. What we collect when someone clicks a link

Per click, we record: the time, the referring site (if the browser sends one), the device type and browser parsed from the user-agent, the country from network geolocation, and an irreversible IP hash salted with a key that rotates every day.

That last part matters. We never write the raw IP address to disk. The daily salt means the same visitor looks like the same person for one day — enough to count approximate uniques — and stops being linkable the next. It cannot be reversed into an address, by us or by anyone who takes our database.

Our redirect analytics does not fingerprint browsers or build profiles across links. The separately controlled PostHog and Google Ads measurement is described below.

3. How long we keep it

Individual click rows are kept for 90 days, then deleted. Before they go, they're rolled into anonymous daily totals — clicks per day, per country, per referrer, per device — which we keep indefinitely so your all-time chart doesn't develop amnesia. Those rollups contain no per-visitor rows and no hashes.

Links and account records are kept until you delete them.

4. Cookies and measurement choices

We set exactly two kinds of cookie, both strictly necessary: a session cookie that keeps you signed in, and an anonymous claim token so links you made before signing up can follow you into your account. Password and email gates set a short-lived cookie recording that you already passed one, so you aren't asked twice.

The limited PostHog product analytics described below stores its anonymous session ID in local browser storage rather than a cookie. Google Ads measurement may use cookies or similar browser storage. We treat measurement consent as implied only when a fresh network-country check returns the United States or Canada. Everywhere else, we show a disclosure and do not load the Google tag unless you choose Allow. If the country check fails, Google stays off. Global Privacy Control and the device opt-out below override either path.

5. Privacy-masked product analytics

PostHog first checks whether the network location is in the United States or Canada. That country check receives the request's IP address because country cannot be calculated without it. If the check is anywhere else, fails, sees Global Privacy Control, or finds a device opt-out, analytics and replay remain off.

Eligible sessions are sampled at 100% so product failures aren't hidden by a random sample. Before anything leaves the browser, all visible text and form values are replaced with a fixed mask; images, video, canvas, frames, and element attributes are blocked or masked. Console logs, exception capture, network timing and payload capture, URL query strings and fragments, referrers, campaign parameters, heatmaps, and person profiles are disabled. Pages carrying a query string or fragment are not recorded at all.

Replay and pageview uploads go through our server without forwarding the visitor's IP address. PostHog retains replays for 30 days. We use them only to diagnose broken or confusing product experiences, never for advertising or cross-site profiling.

6. Ads

Free links show an interstitial with an ad slot. At launch that slot only ever contains our own house ads — us telling you about the $3 and $12 upgrades. No third-party ad network chooses or serves that content. Separately, the Google Ads tag measures campaign and site activity under the country and consent rules above.

7. Email

If you make an account, we have your email address. We use it to sign you in (that's the whole point of a magic link), to send receipts, and to tell you things you'd want to know about your own links. Transactional email is sent through Postmark, which processes it on our behalf. We never ask for a password, a name, or anything else.

If a link you created captures emails from visitors, those addresses belong to you and are shown only to you — we don't market to them.

8. Payments

Payments are processed by Stripe. Card numbers go directly to Stripe and never touch our servers — we couldn't show you your own card number if you asked. What we keep is what a receipt needs: which upgrade you bought, when, how much, and Stripe's reference for it.

9. Who else touches the data

Only the services it takes to run this: our hosting and database providers, Stripe for payments, Postmark for email, Google Safe Browsing for destination screening, and PostHog for the limited U.S./Canada product analytics described above. Google Ads also processes consent-controlled campaign measurement. We don't sell data, and we hand it over to anyone else only if the law actually requires it.

10. Your data, your call

From your account page you can export everything we hold about you, and delete your account — which removes your links, your captured emails, and your account record. Deletion is real deletion, not a hidden flag. Anonymous daily rollups survive, because by then they're not about anyone.

If you're in the EU or UK, those are your GDPR access, portability, and erasure rights, and the buttons are right there — you don't have to email anyone to use them.

11. Questions

Privacy questions and data requests: support@itsonthis.link. Abusive links: abuse@itsonthis.link. We'll update this page when what we collect changes, and the date at the top will say when.