privacy notice
Short version: we don’t want your data.
re-route.link needs no account, sets no cookies and never writes down the IP address of someone who clicks a link. To fight phishing, it does keep the IP address of whoever creates or edits a link, for 30 days. If you choose to make an account, a few more things are stored; see “If you make an account” below. This page explains exactly what is stored when you make a link and when someone clicks one.
When you make a short link
We store:
| What | Why |
|---|---|
| The long URL | So the short link can redirect to it. |
| The short name | Your alias, or seven random characters. |
| A fingerprint of the edit key | A SHA-256 hash, so we can check the key without keeping it. The key itself only exists in your edit link. |
| Settings and dates | Paused or live, the expiry date if you set one, and when the link was created and last changed. |
| An abuse log entry | Your IP address and browser (user-agent string), with what you did: created, edited, paused, deleted or rotated the edit link, or tried a link that was refused. Kept for 30 days, then deleted automatically. |
Short links are a favourite tool for phishing. The abuse log is how we find who is mass-producing scam links and stop them: we can block a link, block every link to a scam domain, and stop an IP address from making new links. Only the site operator can read the log. We don’t ask for your email or name, and we don’t use the log for anything else.
If you tick “Keep it in this browser”, your edit link is saved in your browser’s local storage so you can find it again. It stays on your device and is never sent to us. Clear your site data and it’s gone.
If you make an account
Accounts are optional. You can always make and manage links without one, exactly as described above. If you do make an account, all it asks for is a username and a password. No email address, no name, no confirmation step. We store:
| What | Why |
|---|---|
| Your username | So you can sign in. It is the only thing that identifies you, so don’t pick your real name unless you want to. |
| A scrambled password | A salted scrypt hash. The password itself is never stored, and we can’t read it or reset it for you. There is no email, so a lost password can’t be recovered. |
| Which links are yours | Links you make while signed in are tied to your account, so you can list, edit, pause and delete them, and see their stats, without the edit link. |
| Sign-in sessions | A random token, stored on our side as a SHA-256 hash, and in your browser’s local storage. It lasts 30 days or until you sign out. It is not a cookie. |
| Dates | When the account was created, last signed in, and last used. |
| The IP addresses and browsers your account used | Recorded when you sign up, sign in, or use the account, with the first and last time each was seen and how often. Kept for 30 days since last use, then deleted automatically. This is part of the abuse log described above: it lets us find and stop accounts that mass-produce scam links. |
Only the site operator can see this. Wrong-password attempts are also written to the abuse log, with the IP address, for 30 days. We can switch an account off if it is used for phishing, malware or spam, which ends its sessions and can block its links.
The username and the account’s link list stay until the account is gone. To have your account and its data deleted, email [email protected] from anywhere and tell us the username. Deleting a link works the same as for anonymous links: the target and stats go, the short name stays reserved.
When someone clicks a short link
They get a redirect to the long URL. Before that happens, the click is reduced to a few coarse counters:
- the hour it happened
- the country, looked up in a database on our own server (never an outside service), after which the IP address is discarded
- the referring website’s domain (for example
instagram.com), never the full page address - device type (mobile, desktop or tablet), browser family and operating-system family, without versions
- the browser’s preferred language (for example
fi)
To count unique visitors per day, we hash the IP address and browser string together with a random salt. The salt is kept only for that day, so that each of our servers uses the same one, and it is deleted and replaced every midnight (UTC). Yesterday’s hashes are deleted at the same time, so they can’t be linked across days or turned back into an IP address. This is the same approach privacy-focused analytics tools such as Plausible use.
Link-preview bots and crawlers (Slack, WhatsApp, iMessage, search engines and the like) are counted separately so they don’t inflate the numbers.
Nothing is stored on the visitor’s device. There are no cookies, no tracking pixels, no fingerprinting and no third-party scripts, and nothing is sent to anyone else.
This website itself
We count visits to this site’s own pages (the home page and this notice) with Plausible Analytics, which we host ourselves at plausible.valvomo.dev. It sets no cookies and stores no personal data. Short-link redirects and the manage page are never part of it.
Who can see the stats
Only someone holding the link’s edit link, or signed in to the account the link belongs to. Stats are never public, and we don’t look at them or sell them.
How long things are kept
Abuse log entries (IP address and browser of whoever created or changed a link, or signed in to an account) and the list of addresses an account used are deleted after 30 days. A link and its counters are kept until someone with the edit link, or its account, deletes it. An account is kept until you ask us to delete it. Deleting removes the long URL, the edit-key fingerprint and all statistics. The short name stays reserved, so nobody can take it over and hijack old printed links. Links with an expiry date stop redirecting after that date, but they aren’t deleted.
Legal basis
Under the GDPR, the click data is either not personal data at all (aggregate counters) or pseudonymous data held for less than a day (the daily visitor hash). The abuse log holds personal data (IP address and browser of whoever creates or edits a link or uses an account) for 30 days, and an account holds a username and password hash, kept to provide the account you asked for (Article 6(1)(b)). For both, we rely on legitimate interest (Article 6(1)(f)): providing statistics, and keeping the service from being used for phishing, malware and spam. You can ask what the log holds about your IP address, or for it to be deleted early, at the address below. No consent banner is needed, because nothing is read from or stored on the visitor’s device.
Abuse and questions
To report a link used for phishing, malware or spam, or to ask about this notice, email [email protected]. Include the short link. Abusive links are switched off, and links to the same scam site are blocked with them.