Privacy and terms
There is nothing to hand over
Shortening runs in your browser, and the short link is the compressed URL rather than a key to a row in a database. There is no mapping table, so there is no collection to sell or to lose.
What happens to a link you shorten
The compression and the QR code are produced entirely in your browser. The URL you paste is never sent to a server. To check that, shorten a link with the network switched off: it works.
Expanding is different, because it is an ordinary HTTP request: the payload is part of the path, so it reaches the server logs the way any other address does. Those logs are kept by the hosting provider (Vercel) on its standard terms and a short retention period. We build no statistics from them and hold nothing that would tie two requests to one person.
What we do not do
There are no accounts, so there is nothing to register. We set no cookies and run no analytics, no Google Analytics and no tracking pixels. The page loads our own code and our own fonts, and nothing else.
We do not count clicks on shortened links either, and there is nothing here to build a profile out of. Click statistics are how a classic shortener earns its keep; this one has nowhere to write them.
Personal data
We collect none ourselves. The only data using the service produces is the hosting provider's standard server logs, meaning the IP address and the request headers, processed to keep the service running and secure.
If you email us, we process your address and your message in order to answer it. Nothing beyond that.
A shortened link cannot be deleted, because it is not anywhere: the link is the address itself, compressed. The same property that makes nothing expire means there is nothing to withdraw. Whoever holds the link holds the URL.
Terms of use
The payload is not a secret. Anyone holding the short link can read the destination, locally and without asking us. Do not use shortening as a way of hiding a URL from the person you send it to.
Do not point links at unlawful content, at malware, or at pages impersonating somebody else. The redirect is pure arithmetic, so there is no list to purge, but we can block a specific destination at the redirect, and we will on a well-founded report.
The service is provided as it is, with no availability guarantee. It is free and unmetered; if you are building something you cannot afford to have stop, run your own instance. That is what the self-hosted build is for.
Who runs this
The service is operated by StackMade. Privacy questions, abuse reports and everything else: stackurl@stackmade.pl.
A self-hosted install is the same code on somebody else's infrastructure. Its operator is whoever deployed it, and this page says nothing about their practices. The logs and the liability are theirs.