Privacy Policy

Last updated: October 30, 2026

This policy explains what personal data ShortLink (the “Service”) processes, why, who receives it, and what rights you have. It covers people with an account and people who open a short link created with the Service. Terms we use here are explained in the Terms of Use.

Who is responsible

The Service is operated by OneToDone (“we”, “us”), who is responsible for your personal data (the “controller”). You can reach us at support@onetodone.com.

What we process

Your account

• Your email address, and a new address while you confirm a change of email.
• Your password, stored only as a bcrypt hash. We can’t read your password.
• When your account was created, when you confirmed your email address, when you last changed your password, when you agreed to the Terms of Use, and when your account was suspended, if it was.
• For each device you are signed in on: the browser’s user agent, the IP address it signed in from, and when the session expires. You can end all your sessions with “Sign out everywhere” in your profile.
• Single-use links we email you to confirm an address or reset your password. We store only a hash of each link; it stops working after 24 hours (confirmation) or 1 hour (password reset).

Your links

For each link: its destination, note, short code, number of clicks, when it was created and changed, when its destination was set and last checked, and whether and why it is disabled.

People who open a short link

When someone opens a short link, we:

• receive their IP address and the details of the request, as every website does;
• check the browser’s user agent and prefetch headers to leave bots and link previews out of the count, without storing them;
• add one to the link’s total number of clicks.

We set no cookies on short links and don’t record who opened a link; its owner sees only the total number. The destination is run by the link’s owner or someone else, and its own privacy practices apply there.

Security and abuse prevention

• We limit how many requests one IP address can make, and count failed sign-ins per IP address and per email address for 15 minutes, to stop password guessing.
• We count how many links each account creates per day, to enforce the daily limit.

Server logs

For every request to the Service we log the time, method, address of the page, IP address, response time, and your user ID if you are signed in. Passwords, tokens and other secrets are masked before anything is logged. We use logs to keep the Service secure, investigate abuse and fix errors.

Emails

We send only the emails your account needs: confirming your email address, resetting your password, notices about changes to your password or email address (a password change notice includes the IP address the change came from), notices when one of your links is disabled or enabled again or your account is suspended or restored, and a notice when your account is deleted. We don’t send newsletters or marketing.

Cookies and local storage

We use only what the Service can’t work without:

• refresh_token: keeps you signed in for up to 7 days after your last visit. It can’t be read by scripts and is sent only to the sign-in endpoints of the Service.
• theme, in your browser’s local storage: remembers whether you chose the light or dark theme. It never leaves your browser.
• analytics-consent: remembers your choice about analytics cookies for 180 days.

Analytics cookies, only if you accept them: _ga and _ga_…, set by Google Analytics for up to two years, unless you withdraw your consent. We don’t use advertising cookies.

Google Analytics

Only if you accept analytics cookies, we use Google Analytics 4, provided by Google Ireland Limited in the EEA, the UK and Switzerland and by Google LLC elsewhere, to understand how the site is used: pages visited, approximate location, device and browser, and the site you came from. When you are signed in, we also send our internal ID of your account, never your email address, so that visits from your different devices are counted together. Google states that Google Analytics 4 doesn’t log or store IP addresses. You can withdraw your consent at any time with “Cookie settings” at the bottom of every page. See Google’s Privacy Policy.

Google Safe Browsing

To protect the people who open links, we may check destinations with Google Safe Browsing when a link is saved and again after it is opened. We send Google the destination address only, not who created the link or who opened it. See Google’s Privacy Policy.

Cloudflare Turnstile

To keep bots away from registration, password reset and repeated failed sign-ins, these forms may use Cloudflare Turnstile, provided by Cloudflare, Inc. It checks your browser in the background and only rarely asks you to click. For this, Cloudflare receives your IP address and technical details of your browser and device; we receive only whether the check passed. Turnstile doesn’t use the data for advertising. See Cloudflare’s Turnstile Privacy Addendum.

Why we process it

• To provide the Service you signed up for: your account, links, click counts and account emails (performance of a contract).
• To keep the Service and the people who open links safe: sessions, server logs, rate limits, bot checks, destination checks, handling abuse reports, and keeping records about links and accounts disabled for abuse (our legitimate interests in security and in preventing abuse).
• To understand how the site is used, only with your consent, which you can withdraw at any time.
• To comply with legal obligations, such as answering lawful requests from authorities.

Who receives it

We don’t sell your data or use it for advertising. We share it only with providers that run parts of the Service for us and process the data on our behalf:

• Vercel Inc. (United States), which hosts this website;
• the providers that host the Service’s servers, database and cache, and keep its server logs;
• our email provider, which delivers account emails;
• Cloudflare, Inc. (United States) and Google, as described above.

We may also disclose data where the law requires it, to answer valid legal requests, or to protect the rights, safety and property of our users, the public or the Service, for example when handling an abuse report. If the Service passes to a new operator, your data passes with it and this policy continues to apply.

Transfers outside your country

Our providers may process data in countries other than yours, including the United States. Where the law requires it, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account data and links, with their click counts: until you delete them or your account.
• Sessions: until you sign out or they expire, at most 7 days after your last visit.
• Failed sign-in counts: 15 minutes. Daily link counts: 24 hours.
• Server logs: for a limited time, usually no longer than 30 days.
• Confirmation and reset links: deleted when they expire, are used, or your account is deleted.
• Analytics data: up to 14 months in Google Analytics.
• Records about links and accounts disabled for abuse, and emails about abuse reports or your requests: as long as needed to handle them and to prevent repeated abuse.

Your rights

Depending on where you live, for example under the GDPR, you have the right to:

• get a copy of the personal data we hold about you, also in a portable format;
• have it corrected; you can change your email address in your profile;
• have it deleted; deleting your account in your profile removes your account, links and click counts at once;
• object to processing based on our legitimate interests, or ask us to restrict it;
• withdraw your consent to analytics at any time with “Cookie settings”;
• complain to a data protection authority, for example in the country where you live or work.

To use these rights, write to support@onetodone.com from the email address of your account. We answer within one month.

Security

Passwords are stored only as bcrypt hashes, sign-in tokens are kept out of scripts’ reach or only in memory, sign-in and other sensitive actions are rate-limited, and secrets are masked in logs. No system is perfectly secure; if you notice a security problem, tell us at support@onetodone.com.

Children

The Service is not for anyone under 16, and we don’t knowingly collect personal data from them. If you believe a child has created an account, tell us and we will delete it.

Changes to this policy

We may change this policy. The date at the top shows when it last changed, and we will tell you about significant changes by email or on the site.

Contact

Questions about this policy or your data: support@onetodone.com.