Legal Documentation

Privacy Policy

Effective Date: August 1, 2026 • Last Updated: October 5, 2026

At URLSRT (operated by AshParX), we are committed to transparent data practices. This Privacy Policy details the types of information we collect when you use our website, mobile application, APIs, and link management tools, how that information is processed, and the measures we take to protect your privacy.

1. Information We Collect

A. Account Information

When you create an account on URLSRT, we collect:

  • Email Address: Used for account authentication, password recovery, and essential service notices.
  • Password Hash: Cryptographically hashed using industry-standard bcrypt. Plaintext passwords are never stored or accessible by our systems.
  • Name & Avatar URL: Optional profile details provided by you or retrieved if you authenticate via Google OAuth.

B. User-Generated Link Content

To provide our core services, we store the content you create:

  • Destination URLs: The original web addresses you submit for shortening.
  • Custom Slugs: Personalized short codes chosen for your links.
  • QR Code Parameters: Color codes, embedded logos, and style configurations.
  • Link-in-Bio Data: Profile headlines, button titles, target links, and theme preferences configured in our landing page editor.

C. Link Visitor & Analytics Data

When someone navigates to a shortened URL or a public link-in-bio page, our servers receive standard web request headers to compile aggregated analytics:

  • HTTP Referrer: The external platform or page that initiated the click (e.g., Twitter, LinkedIn, Google).
  • User-Agent String: Used to categorize the visitor's device type (Mobile, Desktop, Tablet), operating system, and browser engine.
  • IP Address for Geolocation: Looked up in memory against localized MaxMind GeoIP tables to identify the visitor's two-letter country code (e.g., US, IN). We do not store precise GPS coordinates, street addresses, or personal identifiable viewer identities.
  • Timestamp: Exact date and time of the visit event.

2. How We Use Your Information

Collected data is used strictly to operate and improve the service:

  • To execute fast, seamless HTTP 302 redirections to destination URLs.
  • To display aggregated daily and monthly click performance charts in your private dashboard.
  • To detect, prevent, and mitigate security threats, phishing schemes, and bot abuse.
  • To respond to user inquiries submitted via our contact and abuse reporting forms.
🔒
We Do Not Sell Your Data: URLSRT does not sell, rent, monetize, or trade user account data or visitor browsing histories to advertising brokers or data harvesting networks.

3. Data Retention & Aggregation

  • Account Data: Maintained as long as your account remains active. You can request account deletion at any time.
  • Raw Visit Events: Temporary visit logs in Redis and PostgreSQL are retained for approximately 24 hours to buffer real-time counts.
  • Aggregated Stats: Daily aggregated click summaries (url_daily_stats) are preserved for 30 days, and monthly aggregates are maintained for 12 months for historical trend reporting.

4. Cookies & Local Storage

URLSRT uses minimal, purpose-driven storage mechanisms:

  • Authentication Cookies: Secure access_token and refresh_token JWT cookies used to maintain your logged-in session.
  • Theme Preferences: Stored locally in your browser's localStorage (app-theme: 'dark' | 'light').

For more details, review our Cookie Policy.

5. Third-Party Infrastructure & Processors

We work with trusted cloud infrastructure providers bound by strict data security standards:

  • Database Hosting: Neon PostgreSQL (serverless, encrypted at rest and in transit).
  • In-Memory Cache: Redis Labs Cloud (high-speed caching and rate limiting).
  • Edge & CDN: Cloudflare (DDoS mitigation and SSL/TLS encryption).
  • Authentication: Google OAuth 2.0 (optional single sign-on).

6. Your Privacy Rights

Depending on your jurisdiction (such as GDPR in the EU or CCPA/CPRA in California), you have rights regarding your personal data:

  • Right of Access: Request a copy of the personal data held about your account.
  • Right to Rectification: Update inaccurate account details in your settings.
  • Right to Erasure: Request permanent deletion of your account and associated links.

7. Contact for Privacy Inquiries

For questions regarding this policy or to exercise your privacy rights, please contact:

AshParX Privacy Desk
Email: [email protected] / [email protected]
Online Form: AshParX Support Desk