Privacy Policy
How ShortKing collects, processes, and protects your information as a developer-grade URL shortener and privacy-focused link management platform.
1. Overview & Privacy-First Philosophy
ShortKing ("we", "our", or "us") operates the ShortKing link compression and analytics infrastructure. We are committed to transparency, minimal data ingestion, and robust cryptographic defenses. Unlike legacy link shorteners, ShortKing does not monetize user tracking, sell visitor telemetry to advertising brokers, or deploy invasive cross-site tracking scripts.
2. Information We Collect
A. Account & Authentication Data
When creating an account, we collect your email address and display name via our Supabase authentication service. If you use ShortKing anonymously, no account is created and no personal identifiers are associated with your session.
B. URL & Link Configuration Data
To provide shortening services, we store the destination (original) URL, generated short code, custom vanity alias (if specified), expiration datetime, and link status.
C. Anonymous Link Management Tokens
For links created without an account, ShortKing issues a high-entropy management token (X-Manage-Token). We store only a one-way SHA-256 hash in our database. The raw token remains solely in your browser's local storage.
D. Redirect Telemetry & Click Analytics
When a visitor navigates to a short link, our Fastify edge service parses the incoming request to provide the link creator with aggregate analytics:
- IP Address Anonymization: IP addresses are immediately salted and hashed using SHA-256. Raw IP addresses are never permanently recorded in analytics tables.
- User-Agent Parsing: Coarse device category (Desktop, Mobile, Tablet), operating system family, and browser family are extracted via non-invasive parsing.
- Referrer: HTTP Referer headers are recorded to identify traffic origins.
- Geographic Region: Coarse country-level metadata provided by reverse-proxy headers.
3. How We Use Collected Data
- Fulfilling ultra-low-latency HTTP 307 redirects to target destination URLs.
- Providing click frequency charts, device breakdowns, and referrer statistics.
- Enforcing sliding-window rate limits and stopping automated brute-force attacks.
- Detecting and blocking malware, phishing, and command/SSRF injection attempts.
- Providing abuse reporting and administrative oversight for abusive content.
4. Data Storage, Retention & Security
Our PostgreSQL database and Redis caching layer are protected with row-level security (RLS) and encrypted at rest using AES-256. All web traffic requires TLS 1.3 / HTTPS. Links set with an expiration timestamp return semantic HTTP 410 Gone responses once expired and can be deactivated at any time by their owner.
5. Your Privacy Rights & Data Deletion
You hold full control over your URLs. You can deactivate or delete links anytime via your browser console or dashboard. To submit a formal data deletion or export request under GDPR, CCPA, or UK DPA regulations, refer to our Data Deletion Policy or contact us at privacy@shortking.io.