What we record on a click
When someone follows one of your short links, we write a single event row. It holds the following, and nothing beyond it.
- The link that was followed and the destination it resolved to
- Approximate location: continent, country, and where available region and city
- Device type, browser and operating system, parsed from the user-agent string
- The referring domain and full referring URL, where the browser sends one
- Whether the click came from tapping a link or scanning a QR code
- A timestamp, and which split-test variant was served
IP addresses
We do not store visitor IP addresses. The address is used in memory to resolve an approximate location, then reduced to a one-way SHA-256 hash that cannot be reversed back to the original address. The hash exists so repeat clicks can be recognised as repeats; it is not linked to a person and we do not attempt to link it to one.
We do not set any cookie on a visitor who follows a short link, with one exception: if a link is password protected, a short-lived cookie records that the password was entered correctly so the visitor is not asked twice. It expires after twelve hours.
Conversion tracking
If you use conversion tracking, your own systems send us a lead or sale event containing an identifier you control. We store that identifier as you send it. Do not send us email addresses, names, phone numbers or anything else that identifies a person directly — use an opaque customer ID from your own database instead.
Account data
For workspace members we store an email address, a display name, and a bcrypt hash of the password. We never store the password itself, and we cannot recover it. Sessions are stored as a hash of the session token, so a database leak cannot be replayed as a login.
How long we keep it
Click, lead and sale events are kept for the retention window of the workspace plan: one year on Free, three years on Pro, five years on Business, and as agreed on Enterprise. Older events are deleted automatically. Deleting a link deletes its events immediately.
Getting your data out, or removed
Every plan, including free, can export all links and all analytics as CSV from the dashboard at any time. There is no export paywall. Deleting a workspace deletes its links, its events and its members, permanently and without a recovery window.
Sub-processors
Shortline runs on Modulify, which provides the application hosting, the Postgres database and the object storage behind it. If a geo-IP provider is configured for city-level accuracy, the visitor IP address is sent to that provider at click time and not retained by us. No other third party receives click data, and we do not sell or share it.
