Privacy Policy

Last updated: 7 June 2026. Shrtr is built to need as little of your data as possible. This explains what it stores, why, how long, and the rights you have — plain English over jargon wherever the law allows. Questions: support@shrtr.top.

1. Who is the data controller

The controller for personal data processed through Shrtr is Aliaksandr Palazok, an individual operating from the Republic of Poland. For any data-protection request, email support@shrtr.top. The controller's full address is held with the Polish supervisory authority and provided on request where it is needed to exercise your rights.

If you are in the EEA, the UK, or another jurisdiction with a supervisory authority, you may lodge a complaint there. In Poland this is the Urząd Ochrony Danych Osobowych (UODO).

2. What data we collect

2.1 Anonymous links & clicks (no account required)

Destination URL, short code or alias, and timestamps — stored so the link can redirect. Anyone holding the short code can open its public stats page (total clicks, last-click time, destination), so don't shorten a URL you wouldn't want associated with a shareable code.
Click events — each visit records a one-way hashed IP address (the raw IP is never stored), the user-agent, the referring page, and a timestamp. These power click counts and the owner/admin referrer breakdown. We build no cross-site profiles and never sell or share this.

2.2 Account data (optional)

Email address — your login identifier and where we send sign-in and account notices.
Password (hashed) — only if you choose to set one; stored with Symfony's modern hasher (bcrypt/Argon2id). We never see or log the plaintext. Sign-in can instead be a one-time emailed link.
Display name, signup source, email-verification and last-login timestamps, and a hashed login IP — for the account UI and abuse/security.
Branded-QR uploads (Pro) — a logo image you upload is stored outside the public web root and served only inside the QR you generate.
Theme preference — stored in a non-tracking cookie.

2.3 Bot data (Telegram / Viber)

If you create links through the Telegram or Viber bot, we store your platform user id and display name to attribute and list your links. Your messages also pass through Telegram/Viber, which are separate controllers (see §4).

2.4 Billing data

Stripe customer and subscription identifiers — to reconcile your plan with Stripe. Payments run through Stripe under its Managed Payments (merchant-of-record) arrangement: Stripe is the seller of record and processes card and tax data under its own privacy notice (stripe.com/privacy). We never see or store full card numbers, CVV, or bank details.
Waitlist — if you join the pricing waitlist we store your email and the tier you're interested in until that tier launches.

3. Why we collect it (legal bases)

Under GDPR Art. 6 we process personal data on these bases:

Performance of a contract (Art. 6(1)(b)) — to run the service: link creation and redirects, account management, and billing.
Legitimate interest (Art. 6(1)(f)) — abuse prevention (the hashed-IP rate limiter, the per-destination burst limit, and the DNS-blocklist check on anonymous link creation) and aggregate click counts. We minimise retention against your privacy interests.
Legal obligation (Art. 6(1)(c)) — billing and tax records we are required to keep.
Consent (Art. 6(1)(a)) — only where we ask explicitly; we send no marketing email.

4. Subprocessors

We use these third-party processors to run Shrtr, each acting under our instructions and a data-processing agreement where required:

Stripe — subscription billing, payments, and tax, as merchant of record. Ireland / EU.
Resend — transactional email (sign-in, account, billing). United States, under EU SCCs.
Cloudflare — Turnstile anti-abuse challenge on the create, sign-in, and waitlist forms. Global, under SCCs.
DigitalOcean — VPS hosting and DNS. Frankfurt, EU.

When you use the Telegram or Viber bot, your messages and the links you create flow through those chat platforms at your direction. They are separate controllers governed by their own privacy notices — not our subprocessors.

5. How long we keep data

Links & click events — for the life of the link. Disabling or deleting a link, or deleting your account, scrubs it (see §6).
Account data — while the account exists; removed on deletion (links pseudonymised, the account row hard-deleted).
Security, abuse, and admin-action logs — hashed-IP only; pruned after 90 days.
Billing records — kept for the period tax law requires (typically 5–10 years in the EU), held by Stripe as merchant of record.

6. Your rights

If you are in the EU/EEA/UK or an equivalent jurisdiction, you have the right to:

Access the data we hold about you (Art. 15).
Rectify it (Art. 16) — edit your links, tags, and display name directly; reset your password from the sign-in page; email-address changes are handled by support via support@shrtr.top.
Erase it (Art. 17) — delete your account in Settings; we disable and pseudonymise your links and hard-delete your account row, subject to legal-retention exceptions. Anonymous links carry no identifier tying them to you.
Restrict processing (Art. 18), port your link data in a machine-readable form on request (Art. 20), and object to legitimate-interest processing (Art. 21).
Withdraw consent at any time where processing relies on it (Art. 7(3)).

Email requests to support@shrtr.top; we respond within 30 days and may verify your identity (typically by replying from the address on file) first.

7. Cookies & similar technologies

Shrtr uses cookies sparingly and runs no advertising or third-party analytics trackers. The cookies are:

Session cookie — set only if you sign in; required for login.
CSRF token — protects form submissions.
Theme preference — stores your light/dark choice.

Cloudflare Turnstile (on the create, sign-in, and waitlist forms) and Stripe (at checkout) may set their own cookies needed to function. All of the above are strictly necessary for the feature you requested, so no cookie-consent banner is required under EU ePrivacy.

8. International transfers

Most processing happens within the EU. Where a subprocessor processes data outside the EEA (notably Resend in the United States, and Stripe/Cloudflare globally), the transfer is governed by the European Commission's Standard Contractual Clauses under the agreement we sign with that subprocessor.

9. Children

Shrtr is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a minor has created an account, write to us and we will delete it.

10. Security

We protect personal data with TLS 1.2+ in transit, password hashing, isolated production credentials, rate-limiting and abuse gates against automated misuse, and a hashed-IP scheme so raw IPs are never stored. No online service can guarantee absolute security; if a breach occurs we will notify affected users and the relevant supervisory authority in line with GDPR Art. 33–34.

11. Changes to this Policy

We may update this policy when we add features, change subprocessors, or respond to regulatory change. Material changes affecting account holders are emailed to the address on file before they take effect; the "Last updated" date above reflects the latest revision.

12. Contact

Privacy questions, data-subject requests, or formal notices: support@shrtr.top.