Privacy Policy
1. Who we are
yourshortsite.link is a URL shortening service operated from the United Kingdom. References to "we", "us", or "our" in this policy refer to the operator of yourshortsite.link. For data protection enquiries contact privacy@yourshortsite.link.
2. Data we collect
2.1 Guest users (no account)
When you shorten a URL without an account we collect:
- The destination URL you submitted
- Your IP address (used solely for weekly rate limiting — not stored permanently against individual links)
- The time the link was created
- A click counter that increments each time your link is visited
We do not collect visitor IP addresses when people click short links.
2.2 Registered users (free and Pro)
In addition to the above, registered accounts store:
- Email address
- Bcrypt-hashed password (we never store plaintext passwords)
- Account creation date
- Plan type (free or Pro) and subscription expiry date
- Stripe customer ID (if subscribed — used to manage billing)
- UTM attribution data captured at signup (see section 5)
2.3 Usage data
For each link click we record:
- An increment to the click counter on that link
We do not log individual visitor IP addresses, browser fingerprints, or geographic data per click.
3. Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| ysl_session | Keeps you logged in — contains a random session token | 30 days |
| ysl_utm_source | Records the marketing source that brought you to the site (e.g. "google", "discord") | 30 days |
| ysl_utm_medium | Records the marketing medium (e.g. "cpc", "social") | 30 days |
| ysl_utm_campaign | Records the campaign name | 30 days |
| ysl_utm_term | Records the campaign keyword | 30 days |
| ysl_utm_content | Records the ad variant | 30 days |
| ysl_referrer | Records the external domain that referred you (if no UTM source is present) | 30 days |
UTM cookies are only set when UTM parameters are present in the URL you arrived from (e.g. from a marketing link). They are used solely to attribute signups to marketing campaigns and are not shared with third parties. We do not use advertising cookies or third-party tracking pixels.
4. How we use your data
- Providing the service — storing links, counting clicks, managing your account
- Rate limiting — preventing abuse by limiting the number of links created per IP per week
- Billing — processing Pro subscription payments via Stripe
- Marketing attribution — understanding which channels bring new users to the service (internal use only)
- Security — detecting and preventing misuse
We do not use your data for automated decision-making, profiling, or targeted advertising.
5. UTM attribution
If you arrive at yourshortsite.link via a link that contains UTM parameters (e.g. ?utm_source=discord&utm_campaign=ad), those parameters are stored in cookies for up to 30 days. If you create an account during that session, the UTM values are permanently associated with your account record so we can understand which marketing efforts are effective. This data is visible to you in your account dashboard and is not shared with third parties.
6. Third-party services
- Stripe — processes Pro subscription payments. Stripe's privacy policy applies to data processed during checkout: stripe.com/privacy
- api.qrserver.com — generates QR code images. The destination URL is sent to this service to create the QR code. No personal data is transmitted.
- Google Fonts — loads the Syne and DM Mono typefaces. Google may log the request IP: policies.google.com/privacy
No advertising networks, analytics platforms, or social media tracking scripts are loaded on this site.
7. Data retention
- Short links — retained indefinitely (we aim to keep links permanent)
- Account data — retained while your account is active; deleted upon request
- Rate limit data — automatically pruned weekly; no permanent record
- Session tokens — invalidated on logout; expire after 30 days of inactivity
8. Your rights (UK GDPR)
Under UK data protection law you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your account and associated data
- Restriction — ask us to limit how we process your data
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests
To exercise any of these rights, email privacy@yourshortsite.link. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Security
All data is transmitted over HTTPS. Passwords are hashed using bcrypt before storage. Session tokens are 64-character cryptographically random values stored in HttpOnly cookies. Data files are stored outside the public web root where possible and protected by server-level access controls.
10. Children
This service is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete it promptly.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the most recent version. Continued use of the service constitutes acceptance of any changes.
12. Contact
For any privacy-related enquiries: privacy@yourshortsite.link