Legal Pages
Effective Date: March 25, 2026 Last Updated: March 25, 2026
Table of Contents
- Privacy Policy
- Cookie Policy
- Data Processing Agreement
- Acceptable Use Policy
- DMCA / Copyright Policy
- Refund Policy
- Disclaimer
- Contact Information
1. Privacy Policy
1.1 Introduction
Shortly ("we," "us," "our") operates the link management platform at www.shortlylink.com. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.
1.2 Data We Collect
A. Account Data (Provided by You)
| Data | Purpose | Retention |
|---|---|---|
| Full name | Account identification | Until account deletion |
| Email address | Authentication, verification, communication | Until account deletion |
| Password | Account security (stored as bcrypt hash, never in plain text) | Until account deletion |
B. Link and Content Data (Provided by You)
| Data | Purpose | Retention |
|---|---|---|
| Original URLs | Link redirection | Until link or account deletion |
| Link titles, tags, descriptions | Organization and search | Until link or account deletion |
| Campaign names and settings | Campaign management | Until deletion |
| Bio page content (username, bio, avatar, links, social handles) | Public bio page display | Until deletion |
| Webhook URLs and secrets | Event notification delivery | Until deletion |
| Custom domain names | Custom short link domains | Until deletion |
| Retargeting pixel IDs (Facebook, Google, TikTok) | User-configured tracking | Until link deletion |
| Custom JavaScript pixel code | User-configured tracking | Until link deletion |
| A/B test variants and URLs | Split testing | Until test deletion |
| Geo-targeting rules | Location-based redirects | Until link deletion |
| Link passwords | Access control (stored as bcrypt hash) | Until link deletion |
C. Click Analytics Data (Collected Automatically)
When someone clicks a shortened link, we automatically collect:
| Data | Collection Method | Purpose |
|---|---|---|
| IP address | Request headers (X-Forwarded-For) | Geolocation, fraud detection, uniqueness |
| Country, region, city | IP lookup via geoip-lite (offline database) | Geographic analytics |
| Browser and version | User-agent parsing (ua-parser-js) | Device analytics |
| Operating system and version | User-agent parsing | Device analytics |
| Device type (desktop/mobile/tablet) | User-agent parsing | Device analytics |
| Referrer URL and domain | HTTP Referer header | Traffic source analytics |
| UTM parameters | URL query parameters | Campaign attribution |
| Visitor fingerprint | SHA-256 hash of IP + User-Agent | Unique visitor detection |
| Bot detection status | User-agent pattern matching (isbot library) | Fraud prevention |
| Fraud score (0-100) | Analysis of request headers | Fraud prevention |
| Timestamp | Server clock | Time-based analytics |
Important: We do not use browser cookies or localStorage for click tracking. Visitor fingerprinting is performed server-side using a one-way hash that cannot be reversed to reveal the original IP or user-agent.
D. Conversion Data
| Data | Source | Purpose |
|---|---|---|
| Click ID | Appended to destination URL | Conversion attribution |
| Conversion amount | Postback or pixel request | Revenue tracking |
| Conversion status | Postback parameter | Conversion management |
| Conversion source | System-detected (pixel/postback) | Attribution analysis |
E. Feedback Data
| Data | Purpose | Retention |
|---|---|---|
| Name, email, message | Support and product improvement | Stored in database indefinitely |
1.3 How We Use Your Data
We use collected data to:
- Provide the Service: Create and redirect shortened links, display analytics, run A/B tests, deliver webhook notifications, and operate bio pages.
- Detect and Prevent Fraud: Identify bot traffic, calculate fraud scores, detect traffic anomalies, and generate automated alerts.
- Improve the Service: Analyze usage patterns and performance metrics to improve features and reliability.
- Communicate with You: Send email verification links, respond to feedback, and deliver system notifications.
- Enforce Our Terms: Monitor for violations of our Terms of Service and Acceptable Use Policy.
1.4 Data Sharing
We do not sell your personal data. We share data only in these circumstances:
Third-Party Service Providers
| Provider | Data Shared | Purpose |
|---|---|---|
| MongoDB Atlas (AWS) | All stored data (encrypted in transit and at rest) | Database hosting |
| Render.com | Application data in transit | Server hosting |
| SendPulse | Recipient email, name, verification tokens | Email delivery |
| Cloudinary | Logo image | CDN for static assets |
User-Configured Third Parties
When you configure retargeting pixels or webhooks, data is sent to those third-party services according to your configuration:
- Facebook Pixel: Page view events on interstitial pages
- Google Analytics: Page view events on interstitial pages
- TikTok Pixel: Page view events on interstitial pages
- Custom Pixels: Whatever data your custom JavaScript collects
- Webhooks: Click events, conversions, bot detections, anomaly alerts, and link expiration events sent to your configured webhook URLs
You are the data controller for any third-party pixels or webhooks you configure. We act as a data processor executing your instructions.
Click ID in Destination URLs
A unique click ID (cid) is appended to all destination URLs as a query parameter for conversion tracking purposes. This click ID is visible to the destination website.
Legal Requirements
We may disclose data if required by law, court order, or government regulation.
1.5 Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Links and analytics | Until you delete the link or account |
| Click events | Indefinite (tied to link lifecycle) |
| Conversions | Indefinite (tied to link lifecycle) |
| Alerts | Last 50 alerts per user |
| Email verification tokens | 24 hours (auto-expire) |
| API keys | Until you delete them |
| Feedback submissions | Indefinite |
1.6 Data Security
We implement the following security measures:
- Passwords: Hashed using bcrypt with a cost factor of 12 (user accounts) and 10 (link passwords). We never store plain-text passwords.
- Authentication: JWT tokens with 30-day expiration. Tokens are required for all authenticated API requests.
- Webhook Signing: HMAC-SHA256 signatures on all webhook payloads for integrity verification.
- CORS Protection: Strict origin whitelist enforced on all API endpoints.
- Rate Limiting: Redirect endpoint limited to 15 requests per 10 seconds per IP address.
- Transport Security: HTTPS enforced on all production endpoints. MongoDB connections use SSL/TLS.
- Fingerprint Hashing: Visitor fingerprints are SHA-256 hashes, not reversible to raw data.
1.7 Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data stored in our Service.
- Correct inaccurate personal data in your account.
- Delete your account and associated data.
- Export your click and conversion data via CSV export.
- Object to data processing by discontinuing use of the Service.
To exercise these rights, contact us at developer@altruetechnology.com.
1.8 Children's Privacy
The Service is not intended for use by anyone under 18 years of age. We do not knowingly collect data from children. If we discover that we have collected data from a child, we will promptly delete it.
1.9 International Data Transfers
Your data may be stored and processed in the following regions:
- MongoDB Atlas: AWS data centers (as configured in your cluster)
- Render.com: US-based servers
- SendPulse: SendPulse's data centers
By using the Service, you consent to the transfer of your data to these locations.
2. Cookie Policy
2.1 Cookies We Use
Shortly uses minimal cookies:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
token (localStorage) |
Essential | Stores your authentication JWT for session management | 30 days or until logout |
2.2 Cookies We Do NOT Use
- We do not use tracking cookies on redirect pages.
- We do not use third-party advertising cookies.
- We do not use cross-site tracking cookies.
- Visitor fingerprinting for click analytics is performed server-side and does not use cookies.
2.3 Third-Party Cookies
If a link creator configures retargeting pixels (Facebook, Google, TikTok, or custom), those third-party scripts may set their own cookies on the interstitial page. This is controlled by the link creator, not by Shortly. Refer to the respective third-party privacy policies:
3. Data Processing Agreement
3.1 Roles
- You (the User) are the Data Controller for link click data and any third-party integrations you configure.
- Shortly is the Data Processor acting on your instructions to collect analytics, deliver webhooks, and fire tracking pixels.
3.2 Processing Activities
We process data on your behalf to:
- Record click events on your shortened links.
- Generate analytics reports and dashboards.
- Deliver webhook notifications to your endpoints.
- Fire retargeting pixels on your configured links.
- Track conversions via your configured postback/pixel integrations.
- Detect and flag bot traffic and anomalies on your links.
3.3 Sub-Processors
| Sub-Processor | Service | Data Processed |
|---|---|---|
| MongoDB Atlas (AWS) | Database hosting | All stored data |
| Render.com | Application hosting | Data in transit |
| SendPulse | Email delivery | Email addresses, verification tokens |
| geoip-lite | IP geolocation (offline) | IP addresses (processed locally, no external calls) |
3.4 Data Deletion
Upon account deletion or link deletion, we will remove associated data from our active databases. Backup copies may persist for a reasonable period as part of standard backup procedures.
4. Acceptable Use Policy
4.1 Prohibited Content
You may not use Shortly to create links to or promote:
- Malware and Phishing: Software designed to damage, disrupt, or gain unauthorized access to computer systems, or deceptive pages designed to steal credentials.
- Illegal Content: Material that violates any applicable law, including but not limited to child exploitation material, illegal drugs, or weapons trafficking.
- Fraud and Scams: Deceptive schemes designed to defraud individuals, including fake investment opportunities, lottery scams, or pyramid schemes.
- Hate Speech and Harassment: Content that promotes violence, discrimination, or harassment against individuals or groups.
- Copyright Infringement: Content that violates intellectual property rights of others.
- Spam: Mass distribution of unsolicited shortened links via email, messaging, or social media.
4.2 Prohibited Behavior
- Click Fraud: Artificially inflating click counts through automated tools, bots, or coordinated human activity.
- Service Abuse: Attempting to bypass rate limits, exploit vulnerabilities, or overload the Service.
- Account Abuse: Creating multiple accounts, sharing account credentials, or using accounts for purposes other than intended.
- API Abuse: Exceeding reasonable API usage or using the API to scrape or replicate the Service.
- Malicious Pixels: Uploading custom JavaScript pixel code that is designed to harm, track beyond stated purposes, or exploit end users.
4.3 Enforcement
Violations may result in:
- Warning: Email notification of the violation.
- Link Removal: Disabling or deleting offending links.
- Account Suspension: Temporary suspension pending review.
- Account Termination: Permanent removal of your account and all associated data.
We reserve the right to take any action at our sole discretion without prior notice for severe violations.
5. DMCA / Copyright Policy
5.1 Reporting Copyright Infringement
If you believe a shortened link on Shortly directs to content that infringes your copyright, please send a notice to:
Email: developer@altruetechnology.com
Your notice must include:
- Identification of the copyrighted work.
- The shortened URL (e.g.,
shortlylink.com/abc123) that links to the infringing material. - Your contact information (name, email, phone number).
- A statement that you have a good faith belief that the use is not authorized.
- A statement under penalty of perjury that the information is accurate and you are the copyright owner or authorized to act on their behalf.
- Your physical or electronic signature.
5.2 Response
Upon receiving a valid DMCA notice, we will:
- Promptly investigate the claim.
- Disable the infringing link if the claim is valid.
- Notify the link creator of the takedown.
- Provide the link creator an opportunity to file a counter-notice.
6. Refund Policy
6.1 Current Status
Shortly is currently offered as a free beta service. No payments are collected, and no refunds are applicable.
6.2 Future Paid Plans
If paid plans are introduced in the future, a separate refund policy will be published and communicated to users before any charges apply.
7. Disclaimer
7.1 Service Availability
Shortly is provided on an "as is" and "as available" basis. We make no guarantees regarding:
- Continuous, uninterrupted availability of the Service.
- Accuracy of geolocation data, bot detection, or fraud scoring.
- Delivery of emails or webhook notifications.
- Preservation of data in the event of system failure.
7.2 Beta Status
The Service is currently in beta. Features may change, be removed, or experience disruptions without notice. By participating in the beta, you acknowledge and accept these risks.
7.3 Third-Party Links
Shortly is a link management tool. We do not control, endorse, or assume responsibility for the content, privacy practices, or availability of any third-party websites that users link to through the Service.
7.4 Accuracy of Analytics
While we strive for accuracy, analytics data (including click counts, geographic data, device detection, bot scoring, and conversion attribution) may contain inaccuracies due to:
- VPN or proxy usage affecting geolocation.
- User-agent spoofing affecting device detection.
- Ad blockers or privacy tools blocking pixel tracking.
- Network conditions affecting real-time data delivery.
8. Contact Information
For any questions, concerns, or requests related to these legal pages, contact us at:
- Email: developer@altruetechnology.com
- Website: www.shortlylink.com
These legal pages apply to the Shortly platform operated at www.shortlylink.com. By using the Service, you acknowledge that you have read and understood these policies.