Privacy
What we store, what we do not, and for how long.
What we never store
- No IP addresses. Not of whoever creates a link, and not of whoever clicks one.
- No cookies. The site sets none at all, not even functional ones.
- No accounts, and no names or email addresses except the two cases named below.
What is kept, and for how long
The link itself
- The link you entered.
- The code we gave it.
- When that happened.
That is all, and nothing in it says who created the link. It is kept for as long as the service runs, because a short link that stops resolving is a broken promise to everyone who has already shared it.
Click statistics
On each redirect we record a few coarse things: the code, the country, the datacentre that handled the request, the domain of the referring page, and a rough browser category.
The country comes from Cloudflare's network rather than from an IP address we keep. From the referring page we store only the domain, never the path: a full referrer on a link shortener is close to browsing history.
This is deleted automatically after three months.
Rate limiting counters
To limit abuse we count how many links a client creates. That count is keyed on a one-way hash of the address with a secret key, not the address itself, and the rows are swept once their window has passed.
Abuse reports
If you report a link we keep the code, your explanation, and any email address you choose to leave. The address is optional and is used only to reply to you about that report.
The two have different lifetimes on purpose. The report stays, because a takedown record that does not outlive the link it describes is not a record of anything. The address is cleared after three months, because replying is the only thing it was ever for.
API keys
Creating links through the API needs a key. We store its SHA-256, the first characters so two keys can be told apart, when it was issued, and whether and why it was revoked. The key itself is never stored, so a leak of this database is not a leak of anyone's key.
A key also carries a short label recording what it is for. That is a project or a purpose, never a person: no name, company or address goes in it.
Revoked keys are kept rather than deleted. After a key has been abused, the record of it having existed is exactly what is needed.
Email you send us
Mail to abuse@kortste.link or keys@kortste.link sits in a mailbox like any other mail, with whatever you chose to put in it. It is read, replied to, and deleted when the matter it concerns is closed.
Legal basis
Storing the link itself is necessary to provide the service. The coarse click statistics and the rate limiting rest on a legitimate interest: knowing the service works, and preventing abuse.
Advertising
There is currently no advertising and no ad network is loaded. If that changes, a consent notice comes first, and this page will be updated before anything loads.
The Ko-fi link
Every page carries a link to support this project. It is an ordinary link: nothing is loaded and nothing is recorded unless you click it. If you do, you arrive at Ko-fi, where their own privacy policy applies.
Questions
Questions about your own data can be mailed to abuse@kortste.link. The report form asks for a link code and refuses anything else, so such a question cannot get through it.