Privacy Policy

When you create an account we collect your email address and a password hash. When you create short links we store the destination URL, creation timestamp, and optionally a custom slug you provide.

When a short link is visited we log an anonymised request record that may include the referrer, country (derived from IP, not stored), user agent string, and timestamp. We do not store full IP addresses beyond what is needed for rate-limiting.

We use the information we collect to:

• Operate and maintain the Xurl service
• Provide link analytics to the link owner
• Send transactional emails (e.g. email verification, password reset)
• Detect and prevent abuse

We do not sell your data to third parties.

We use a single session cookie to keep you signed in. We do not use advertising or tracking cookies.

Your account data is kept for as long as your account is active. You may delete your account at any time from the settings page; this permanently removes your links and associated analytics. Anonymised aggregate statistics may be retained after deletion.

Passwords are hashed with bcrypt and never stored in plain text. All traffic is served over HTTPS. We apply reasonable technical and organisational measures to protect your data.

Depending on your jurisdiction you may have rights to access, correct, or delete your personal data. To exercise these rights, contact us at the address below.

We may update this policy from time to time. Material changes will be communicated by updating the date at the top of this page.

Questions about this policy? privacy@xurl.fyi