Data Deletion Policy
Clear, transparent procedures for deleting your ShortKing links, account profile, click history, and browser management tokens.
1. Overview
ShortKing empowers developers and creators with full ownership over their data. In compliance with GDPR Article 17 ("Right to Erasure"), the California Consumer Privacy Act (CCPA), and international privacy frameworks, this policy details how data deletion operates across our systems.
2. Deleting Links & URL Data
A. Self-Service Immediate Link Deactivation
Any user holding a link's management token or authenticated account ownership can deactivate the link from the Dashboard or via the REST API (DELETE /api/v1/urls/:id).
B. What Happens When a Link is Deleted?
- Immediate Invalidation: Edge Redis caches are purged instantly; the short code will cease redirecting to the target URL.
- HTTP 410 Gone Status: Future requests to that short code return a semantic HTTP 410 Gone response indicating the link is permanently retired.
- Anti-Reuse Protection: Retired codes are quarantined to prevent subsequent link hijacking.
3. Account & Complete Profile Deletion
When an authenticated user profile is deleted:
- User authentication credentials in Supabase Auth are purged immediately.
- User profile records (name, email, avatar metadata) are cascaded and deleted.
- All owned short links are deactivated across all routing clusters.
4. How to Submit a Formal Data Deletion Request
To request permanent database record erasure or request an audit of data associated with your email or IP hash, email our Data Protection Office: