Privacy
Shortit keeps as little data as possible. The IP address of a visitor who opens a link is never stored. That of an account holder who signs in or edits their links is kept for one year in a security log, which no administration screen displays.
Data controller
The publisher of Shortit, an individual acting in a non-professional capacity whose identity is disclosed to the host (see the legal notice). Contact for any question about your data: contact@shortit.fr.
Purposes, data, legal bases and retention periods
Create and manage your account, sign you in
- Data:
- Email address, name, password fingerprint (if you choose one), Google identifier (if you use it), sessions, display language and theme, method and date of the last sign-in (visible to the administration)
- Legal basis:
- Performance of the contract (terms of use), art. 6.1.b of the GDPR
- Retention:
- As long as the account exists; session: 7 days without use; sign-in code: 10 minutes. An account created with a password during an email-sending outage, whose address has never been verified, is deleted after 14 days; the IP address of that creation is recorded in the security log
Shorten your links and make them work
- Data:
- Destination, short address, title, expiry date, fingerprint of the password of a protected link
- Legal basis:
- Performance of the contract, art. 6.1.b
- Retention:
- As long as the account exists; link created without an account and never activated: 24 hours
Click statistics for the link’s owner
- Data:
- Date of the click, country, referring domain, device type, browser and system family, the day’s fingerprint (without IP address)
- Legal basis:
- Performance of the contract with the link’s owner; legitimate interest towards visitors (limited measurement, without IP address or persistent identifier), art. 6.1.f
- Retention:
- Detailed clicks: 90 days; daily totals: as long as the link exists
Send the service’s emails (codes, notices about your links, security alerts)
- Data:
- Email address, type of message. These emails contain no tracking pixel and no rewritten link: opening and click tracking is turned off at our sending services
- Legal basis:
- Performance of the contract, art. 6.1.b
- Retention:
- Record of the sending: 30 days (it also serves to limit sendings)
Security and abuse prevention (rate limits, blocklist, checking of destinations)
- Data:
- IP address in memory only, for the duration of the request; link destinations
- Legal basis:
- Legitimate interest (protecting the service and its visitors), art. 6.1.f
- Retention:
- IP address used for these checks: never recorded
Account security log (tracing the origin of a sign-in or a change in case of hacking or abuse)
- Data:
- IP address, date and nature of the action of an account holder: sign-in, creation or modification of a link, API key, domain, password, two-factor authentication, deletion of the account. Never the IP address of a link’s visitor
- Legal basis:
- Legitimate interest (security of the service and of accounts, fraud prevention), art. 6.1.f
- Retention:
- One year, then deletion; disclosed to the authorities only on legal requisition
Two-factor authentication (optional, if you turn it on)
- Data:
- Secret of the authenticator app, stored encrypted; ten backup codes, stored hashed (never readable); date of activation; indication, for each session, that the second step was passed
- Legal basis:
- Performance of the contract (security of the account, at your request), art. 6.1.b
- Retention:
- Until two-factor authentication is turned off or the account is deleted
Protect your links against hijacking (email code before editing or deleting a high-traffic link, alert when a destination changes)
- Data:
- Email address; fingerprint of the confirmation code, number of attempts and validity time, tied to your session; the alert contains the short address and the host names of the old and the new destination
- Legal basis:
- Legitimate interest (protecting your account and your visitors), art. 6.1.f
- Retention:
- Code: valid for 10 minutes; the record of the challenge disappears at the latest with the session (7 days without use); record of the email: 30 days
Pro plan features: redirection rules by country or device, webhooks on click milestones
- Data:
- The rules you write (condition, destination address); for a webhook: its https address, its signing secret (stored encrypted, shown only once), and the log of its deliveries (milestone, click count, response code, no response body). A visitor’s country is used in memory to pick a rule and is never recorded
- Legal basis:
- Performance of the contract (features you turn on), art. 6.1.b
- Retention:
- Rules and webhooks: until you delete them or the account; delivery log: 30 days
Teams (Pro plan): share links with people you invite
- Data:
- The team name; the e-mail address of invited people (only the team owner sees it, along with the members’); the fingerprint of the invitation token (the token itself exists only in the e-mail sent); each member’s role; the list of shared links. A member sees neither the other members’ addresses nor their API keys, domains or settings. No visitor IP address is involved; the IP address of team actions follows that of the account’s other actions
- Legal basis:
- Performance of the contract (feature you turn on), art. 6.1.b
- Retention:
- Invitation: 7 days, deleted as soon as it is accepted or cancelled; members and shares: until the person leaves the team, is removed, or the team or one of the accounts is deleted; record of the action in the audit log: 1 year
Let you know when the Pro plan opens, or send you the newsletter (only if you ask)
- Data:
- Email address, chosen topic, language, date of confirmation, version of the consent text shown. No IP address
- Legal basis:
- Consent, art. 6.1.a: you tick a box, never pre-ticked, then confirm through a link sent to your address (double confirmation). Withdrawal at any time, in one click, from every email
- Retention:
- Until you unsubscribe; after unsubscribing, the address is kept only so that we never write to you again. A request that is never confirmed sends no message. Full deletion on simple request to the contact address. Retention of an unconfirmed request: [TO FILL IN: duration]
Messages sent by the Shortit team
- Data:
- Messages about your account, your links or a report (deactivation decision, change of terms) are sent from contact@, abuse@ or noreply@; group mailings (newsletter, opening of the Pro plan) go to confirmed subscribers only. The send log keeps the author, the sender identity, the subject and the number of recipients, not their list. Retention of the send log: [TO FILL IN: duration]
- Legal basis:
- Performance of the contract for service messages; consent (art. 6.1.a) for group mailings
- Retention:
- See above
Check that the visitor of a protected form is not an automated program
- Data:
- Technical signals from your browser and IP address, processed by Cloudflare (Turnstile, in invisible mode: you see nothing); we only receive a success token, which we do not record. Details: the Turnstile Privacy Addendum from Cloudflare
- Legal basis:
- Legitimate interest (security of the service against abuse), art. 6.1.f; Cloudflare acts as a processor for detection and as a controller for improving detection (its own legitimate interest)
- Retention:
- Managed by Cloudflare; no record on our side
Process reports of illegal content
- Data:
- Reported address, reason, your email address if you choose to give it
- Legal basis:
- Legal obligation (handling of notifications of illegal content), art. 6.1.c; legitimate interest, art. 6.1.f
- Retention:
- One year after processing; an open report is kept until it is processed
Audit log (traceability of actions on links and of administration)
- Data:
- Author, date, action; destinations of the links concerned (the IP address appears only for the actions of account holders, previous line)
- Legal basis:
- Legitimate interest (security, evidence in case of dispute), art. 6.1.f
- Retention:
- One year
The country of a click comes from DB-IP’s “IP to Country Lite” database, kept on our server, with no external service: IP Geolocation by DB-IP (licence CC BY 4.0). Unique visitors are counted per day: their fingerprint depends on a salt that is changed and destroyed every day, so a visitor who came back on three days counts three times. We store neither the identification of the browser that opens a session (user-agent), nor your Google profile photo.
When you delete your account
Your links and their statistics are erased. A link that has worked keeps only its short address, reserved so that it is never reassigned. A link covered by a report that is still open is kept, destination included and without an owner, while that report is examined. Your two-factor secret and backup codes are erased. The audit log keeps the history of actions on links for one year. A subscription to the newsletter or to the Pro plan announcement is independent of the account: it is deleted on simple request to the contact address, or through the unsubscribe link in every email.
Recipients
Your data is neither sold nor transferred. The following have access to it: the publisher of Shortit, and an administrator to process reports (every consultation is logged; no password, no API key, no IP address is visible there; no function allows signing in in your place). Processors, each for that sole purpose:
- Hosting of the site and the database: InovaPerf (virtual private server), located in France, in Vélizy-Villacoublay, in a data centre operated by DC2Scale.
- Resend: sending of the service’s emails (your address and the content of the message).
- Mailjet: backup sending service, used only when the main service has reached its limit (your address and the content of the message, with no opening or click tracking).
- Cloudflare: domain names and reception of emails sent to shortit.fr. The site’s traffic does not go through Cloudflare, except for the Turnstile anti-bot widget on protected forms, which your browser loads from its servers.
- Google: only if you choose “Continue with Google”, to identify you.
Reports are also forwarded by email to the abuse address; they are kept there for one year after processing, as in the database.
Transfers outside the European Union
Resend, Cloudflare and Google are American companies. Resend adheres to the EU–US Data Privacy Framework (certification announced in March 2025), and its data processing agreement provides for the European Commission’s standard contractual clauses. Cloudflare relies on its certification under that same framework and, should it lapse, on the standard contractual clauses. For “Continue with Google”, you identify yourself directly with Google, under its own privacy policy: we send it no data about you, and we only receive your email address, your name and your Google identifier.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (for processing based on legitimate interest), as well as the right to set directives on what happens to your data after your death.
From Settings, you can already download your data (“Export my data”), correct your name and delete your account. For everything else, write to contact@shortit.fr; we reply within one month. If you visit a short link without having an account, the same rights apply, within the limit of what we can link to you: we keep neither your IP address nor any persistent identifier.
If you believe your rights are not being respected, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), online at www.cnil.fr (“Plaintes” section).
Cookies
Only the cookies necessary for the service, exempt from consent: see the page Cookies.