What we log, what we don’t, and why there’s no cookie banner
Click analytics and visitor tracking are not the same thing. Keeping them separate is what lets a UK shortener run without asking anyone for consent.
Every shortener records clicks. Otherwise it could not tell you how many you got. The question worth asking a provider is what a click record contains, how long it lives, and whether it can be joined to anything else.
What a click record holds
Four fields, and that is the whole of it:
- Country, derived at the edge and stored as a country code. Not a city, not coordinates.
- Referrer, where the browser sends one.
- Device class: desktop, mobile or tablet. Not a device fingerprint, not a model string.
- A timestamp.
That record is attached to the link, not to a visitor. There is no visitor identifier in it, which means there is nothing to join two clicks together with, and therefore no profile that can be built from it. Analytics are retained for 24 months and exportable as CSV.
The IP question
We do handle IP addresses, because you cannot run bot filtering without them. What we do not do is keep them.
The address is truncated, the final octet is removed, and then it is salted and hashed. What is stored is that hash, for 30 days, purely so that automated traffic can be told apart from human traffic. The full address is never written to analytics storage, and the truncated hash is not exposed in reporting.
A session cookie when you sign in, and a 24-hour cookie that caps how often a free-plan interstitial is shown to the same browser. Neither is used for advertising profiles and neither is shared. That is the entire cookie inventory.
Why that adds up to no banner
Under UK PECR, consent is required for storing or accessing information on a device unless it is strictly necessary for a service the user requested. A sign-in session cookie is strictly necessary. A frequency cap on an interstitial is arguably the same, and we treat it conservatively by keeping it first-party, short-lived and unshared.
Because we run no third-party analytics, no advertising pixels and no cross-site identity graph, there is nothing left that needs consent. The banner most sites show exists because of the trackers behind it. Remove the trackers and the banner has no job.
Where it all lives
United Kingdom and Republic of Ireland regions only, encrypted at rest with AES-256 and in transit with TLS 1.3. Passwords are hashed with Argon2id. A data processing agreement is available on request, and so is the current processor list.
The short version: we sell a link service, not the data it generates. Advertising on free links is sold directly and served from our own infrastructure, creatives are static files, and advertisers receive delivery counts, never anything about a visitor.