privacy notice
Short version: we don’t want your data.
re-route.link has no accounts, sets no cookies and doesn’t write IP addresses down. This page explains exactly what is stored when you make a link and when someone clicks one. The code is open source, so you can check every claim here.
When you make a short link
We store:
| What | Why |
|---|---|
| The long URL | So the short link can redirect to it. |
| The short name | Your alias, or seven random characters. |
| A fingerprint of the edit key | A SHA-256 hash, so we can check the key without keeping it. The key itself only exists in your edit link. |
| Settings and dates | Paused or live, the expiry date if you set one, and when the link was created and last changed. |
We don’t store who made the link, your IP address, your email or anything else about you. To stop abuse we count how many links each IP address has made in the last few minutes. That count is kept in memory only, never written to disk, and forgotten when the window ends.
If you tick “Keep it in this browser”, your edit link is saved in your browser’s local storage so you can find it again. It stays on your device and is never sent to us. Clear your site data and it’s gone.
When someone clicks a short link
They get a redirect to the long URL. Before that happens, the click is reduced to a few coarse counters:
- the hour it happened
- the country, looked up in a database on our own server (never an outside service), after which the IP address is discarded
- the referring website’s domain (for example
instagram.com), never the full page address - device type (mobile, desktop or tablet), browser family and operating-system family, without versions
- the browser’s preferred language (for example
fi)
To count unique visitors per day, we hash the IP address and browser string together with a random salt. The salt lives only in the server’s memory and is replaced every midnight (UTC). Yesterday’s hashes are deleted at the same time, so they can’t be linked across days or turned back into an IP address. This is the same approach privacy-focused analytics tools such as Plausible use.
Link-preview bots and crawlers (Slack, WhatsApp, iMessage, search engines and the like) are counted separately so they don’t inflate the numbers.
Nothing is stored on the visitor’s device. There are no cookies, no tracking pixels, no fingerprinting and no third-party scripts, and nothing is sent to anyone else.
This website itself
We count visits to this site’s own pages (the home page and this notice) with Plausible Analytics, which we host ourselves at plausible.valvomo.dev. It sets no cookies and stores no personal data. Short-link redirects and the manage page are never part of it.
Who can see the stats
Only someone holding the link’s edit link. Stats are never public, and we don’t look at them or sell them.
How long things are kept
A link and its counters are kept until someone with the edit link deletes it. Deleting removes the long URL, the edit-key fingerprint and all statistics. The short name stays reserved, so nobody can take it over and hijack old printed links. Links with an expiry date stop redirecting after that date, but they aren’t deleted.
Legal basis
Under the GDPR, the stored data is either not personal data at all (aggregate counters) or pseudonymous data held for less than a day (the daily visitor hash) to provide statistics and prevent abuse. For that, we rely on legitimate interest (Article 6(1)(f)). No consent banner is needed, because nothing is read from or stored on the visitor’s device.
Abuse and questions
To report a link used for phishing, malware or spam, or to ask about this notice, email [email protected]. Include the short link. Abusive links are disabled.